Oracle Linux 8 : postgresql:12 (ELSA-2026-72274)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-72274 advisory. - add postgresql-CVE-2026-18408.patch - apply backport-of-the-patch-to-fix-CVE-2025-8714.patch - Resolves: CVE-2026-14662, CVE-2026-14664,...

CentOS Linux 7 [TuxCare] Security Update: postgresql / postgresql-contrib / postgresql-devel / etc Multiple Vulnerabilities (CENTOS7:CLSA-2026:1779466432)

The CentOS Linux 7 host has packages installed that are affected by multiple vulnerabilities as referenced in the TuxCare CENTOS7:CLSA-2026:1779466432 advisory. - Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an...

Rocky Linux 9.6 [TuxCare] Security Update: postgresql / postgresql-contrib / postgresql-docs / etc (ALMALINUX9.6:CLSA-2026:1779697425)

The Rocky Linux 9.6 host has packages installed that are affected by a vulnerability as referenced in the TuxCare ALMALINUX9.6:CLSA-2026:1779697425 advisory. - Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials...

EUVD-2026-89198

MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the MEOS binary and library WKB deserialization logic that allows unprivileged database users to crash the PostgreSQL backend process by supplying a crafted WKB payload with a negative length field. The negative...

CVE-2026-102639 MobilityDB through 1.3.0 Out-of-bounds Read DoS via WKB Deserialization

MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the MEOS binary and library WKB deserialization logic that allows unprivileged database users to crash the PostgreSQL backend process by supplying a crafted WKB payload with a negative length field. The negative...

CVE-2026-102639 MobilityDB through 1.3.0 Out-of-bounds Read DoS via WKB Deserialization

MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the MEOS binary and library WKB deserialization logic that allows unprivileged database users to crash the PostgreSQL backend process by supplying a crafted WKB payload with a negative length field. The negative...

CVE-2026-102639 MobilityDB through 1.3.0 Out-of-bounds Read DoS via WKB Deserialization

MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the MEOS binary and library WKB deserialization logic that allows unprivileged database users to crash the PostgreSQL backend process by supplying a crafted WKB payload with a negative length field. The negative...

CLEANSTART-2026-EP87494 pgjdbc is an open source postgresql JDBC Driver

Security vulnerability affects the sonarqube package. pgjdbc is an open source postgresql JDBC Driver...

CVE-2026-102639: Signed to Unsigned Conversion Error

MobilityDB version 1.3.0 and earlier contains an out-of-bounds read vulnerability in the MEOS binary and library WKB deserialization logic that allows unprivileged database users to crash the PostgreSQL backend process by supplying a crafted WKB payload with a negative length field. The negative...

postgresql:12 security update

12.22-12 - add postgresql-CVE-2026-18408.patch 12.22-11 - apply backport-of-the-patch-to-fix-CVE-2025-8714.patch 12.22-10 - Backport fixes for multiple CVEs - Resolves: CVE-2026-14662, CVE-2026-14664, CVE-2026-14668, CVE-2026-14669 - Resolves: CVE-2026-14670, CVE-2026-14671, CVE-2026-14677,...

CVE-2026-12265

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...

CVE-2026-12265 Missing Authorization on HA Failover Config allows Complete Data Destruction

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...

CVE-2026-12265 Missing Authorization on HA Failover Config allows Complete Data Destruction

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...

EUVD-2026-88237

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to Insufficient access control in HA failover endpoint leading to destructive PostgreSQL database operations...

CVE-2026-12265

Zohocorp ManageEngine DDI Central versions before 6201 are vulnerable to an insufficient access control flaw in the HA failover endpoint . This vulnerability allows an attacker to perform destructive PostgreSQL database operations , potentially leading to complete data destruction. The vulnerabil...

RLSA-2026:72274 Important: postgresql:12 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL code execution in restore operation CVE-2025-8714 postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pgdump CVE-2026-18408 For more details about the...

postgresql:12 security update

An update is available for module.pgrepack, module.pgaudit, pgrepack, postgres-decoderbufs, module.postgres-decoderbufs, module.postgresql, postgresql, pgaudit. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-97469

A flaw was found in PostgreSQL Anonymizer. An authenticated, unprivileged masked user can bypass access restrictions to execute restricted functions by embedding function calls within a subquery. By repeatedly invoking functions such as anon.hash, an attacker can collect output to deduce the...

postgresql: PostgreSQL: Arbitrary code execution via long POSIX timezone abbreviation

A heap buffer overflow flaw was found in the PostgreSQL tochartimestamptz function. An attacker can exploit this by supplying an overly long POSIX timezone abbreviation to execute arbitrary code as the database's operating system user, potentially resulting in complete system compromise...

postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl

A flaw was found in PostgreSQL. An integer wraparound vulnerability in 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This can lead to arbitrary code execution as the operating system...