14402 matches found
Vulnerability in core server (CVE-2026-14669)
PostgreSQL tochar heap buffer overflow executes arbitrary code Heap buffer overflow in PostgreSQL tochartimestamptz allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQ...
Vulnerability in contrib module (CVE-2026-14671)
PostgreSQL refint plan cache type confusion executes arbitrary code Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the g...
Linux Distros Unpatched Vulnerability : CVE-2026-15741
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - SQL injection in PostgreSQL EXTRACT deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect...
Linux Distros Unpatched Vulnerability : CVE-2026-14679
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write onl...
Linux Distros Unpatched Vulnerability : CVE-2026-16241
The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea...
PT-2026-71464
Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when...
PT-2026-71476
Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description Type confusion involving the internal data type arguments...
PT-2026-71481
Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.5 PostgreSQL versions prior to 17.11 PostgreSQL versions prior to 16.15 PostgreSQL versions prior to 15.19 PostgreSQL versions prior to 14.24 Description A type confusion issue exists in the portal and cursor...
AlmaLinux 8 : postgresql:12 (ALSA-2026:52396)
The remote AlmaLinux 8 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:52396 advisory. postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation CVE-2026-6479 Tenable has extracted the preceding description block...
AlmaLinux 9 : postgresql (ALSA-2026:52395)
The remote AlmaLinux 9 host has packages installed that are affected by a vulnerability as referenced in the ALSA-2026:52395 advisory. postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation CVE-2026-6479 Tenable has extracted the preceding description block...
CVE-2026-71439 vulnerabilities
Vulnerabilities for packages: langfuse...
CVE-2026-73069 Twenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL Execution
Twenty is an open-source CRM customer relationship management platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATAMODEL permission to supply settings.asExpression for the system TSVECTOR field searchVector through PATCH /rest/metadata/fields/:id or the updateOneField...
CVE-2026-73069 Twenty: SQL Injection in the `searchVector` Field Settings Allows Arbitrary PostgreSQL Execution
Twenty is an open-source CRM customer relationship management platform. Prior to 2.15.0, Twenty allowed a workspace administrator with the DATAMODEL permission to supply settings.asExpression for the system TSVECTOR field searchVector through PATCH /rest/metadata/fields/:id or the updateOneField...
CVE-2026-73069
Twenty open-source CRM contains a SQL injection in the searchVector field configuration prior to version 2.15.0. A workspace administrator with DATA_MODEL permission could supply settings.asExpression for the system TS_VECTOR field via PATCH /rest/metadata/fields/:id or the updateOneField GraphQL...
CVE-2026-72775
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters channel, function, and trigger names into SQL statements without proper escaping. An authenticated user can inject arbitrary SQL...
EUVD-2026-56101
n8n before 1.123.67, 2.31.5, and 2.32.1 contains a SQL injection vulnerability in the PostgresTrigger node, which interpolates user-supplied identifier parameters channel, function, and trigger names into SQL statements without proper escaping. An authenticated user can inject arbitrary SQL...
RHSA-2026:52978 Red Hat Security Advisory: postgresql-jdbc security update
Bulletin has no description...
RHSA-2026:52930 Red Hat Security Advisory: postgresql-jdbc security update
Bulletin has no description...