Glances has SQL Injection via Process Names in TimescaleDB Export

Summary The TimescaleDB export module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize method wraps string values in single quotes but does not escape embedded single quotes, making SQL injection trivial via attacker-controlled data such as...

GHSA-X46R-MF5G-XPR6 Glances has SQL Injection via Process Names in TimescaleDB Export

Summary The TimescaleDB export module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize method wraps string values in single quotes but does not escape embedded single quotes, making SQL injection trivial via attacker-controlled data such as...

PT-2026-24168

Name of the Vulnerable Software and Affected Versions Glances versions prior to 4.5.1 Description Glances, a cross-platform system monitoring tool, contains a flaw in its TimescaleDB export module. The module builds SQL queries by concatenating strings with unverified system monitoring data. The...

SUSE CVE-2026-29089

TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the searchpath setting to locate unqualified database objects tables, functions, operators. If the searchpath includes user-writable...

CVE-2026-29089

A flaw was found in TimescaleDB, a time-series database extension for PostgreSQL. A malicious user can exploit this vulnerability by creating functions in user-writable schemas that shadow built-in PostgreSQL functions. During an extension upgrade, PostgreSQL's searchpath setting, which determine...

CVE-2026-29089

TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the searchpath setting to locate unqualified database objects tables, functions, operators. If the searchpath includes user-writable...

CVE-2026-29089 TimescaleDB uses untrusted search path during extension upgrade

TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the searchpath setting to locate unqualified database objects tables, functions, operators. If the searchpath includes user-writable...

CVE-2026-29089 TimescaleDB uses untrusted search path during extension upgrade

TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the searchpath setting to locate unqualified database objects tables, functions, operators. If the searchpath includes user-writable...

CVE-2026-29089

TimescaleDB (Postgres extension) contains a vulnerability in the upgrade path where PostgreSQL’s untrusted search_path can be abused. From versions 2.23.0–2.25.1 , if the search_path includes user-writable schemas, a malicious user could create functions shadowing builtin Postgres functions, caus...

CVE-2026-29089 TimescaleDB uses untrusted search path during extension upgrade

TimescaleDB is a time-series database for high-performance real-time analytics packaged as a Postgres extension. From version 2.23.0 to 2.25.1, PostgreSQL uses the searchpath setting to locate unqualified database objects tables, functions, operators. If the searchpath includes user-writable...

timescaledb 代码问题漏洞

Timescaledb is an extension to the temporal database developed by Tiger Data. In versions of TimescaleDB 2.23.0 to 2.25.1, there is a code vulnerability caused by improper setting of the searchpath, which may lead to arbitrary code execution...

EUVD-2022-29039

Malicious code in bioql PyPI...

EUVD-2023-29127

Malicious code in bioql PyPI...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: cloud-provider-vsphere, kyverno-notation-aws, cerbos, tempo, rancher-system-agent, oauth2-proxy, rabbitmq-default-user-credential-updater, render-template, opentofu, steampipe, clickhouse-operator, kapp, docker-cli, wal-g, lazydocker, helm-set-status, caddy,...

CVE-2025-47910 vulnerabilities

Vulnerabilities for packages: cerbos, dragonfly-operator, grafana-pyroscope, fulcio, mockgen, nri-mysql, k3d, rclone, kubernetes-dashboard-web, portieris, wal-g, nri-nginx, wait-for-port, steampipe, kubernetes-csi-node-driver-registrar, emissary, mattermost, bom, karpenter, guac, regclient,...

GHSA-8PJC-487G-W6P2 vulnerabilities

Vulnerabilities for packages: cerbos, dragonfly-operator, grafana-pyroscope, fulcio, mockgen, nri-mysql, k3d, rclone, kubernetes-dashboard-web, portieris, wal-g, nri-nginx, wait-for-port, steampipe, kubernetes-csi-node-driver-registrar, emissary, mattermost, bom, karpenter, guac, regclient,...

OPENSUSE-SU-2024:0384-1 Security update for zabbix

This update for zabbix fixes the following issues: Zabbix was updated to 6.0.33: - this version fixes CVE-2024-36461 and CVE-2024-22114 - New Features and Improvements + ZBXNEXT-9000 Changed query table for ASM disk group metrics in Oracle Database plugin and Oracle by ODBC template Agent Templat...

BIT-TIMESCALEDB-2022-24128

Timescale TimescaleDB 1.x and 2.x before 2.5.2 may allow privilege escalation during extension installation. The installation process uses commands such as CREATE x IF NOT EXIST that allow an unprivileged user to precreate objects. These objects will be used by the installer which executes as...

BIT-TIMESCALEDB-2023-25149

TimescaleDB, an open-source time-series SQL database, has a privilege escalation vulnerability in versions 2.8.0 through 2.9.2. During installation, TimescaleDB creates a telemetry job that is runs as the installation user. The queries run as part of the telemetry data collection were not run wit...

openSUSE: Security Advisory for timescaledb (openSUSE-SU-2023:0046-1)

The remote host is missing an update for the SPDX-FileCopyrightText: 2024 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...