Vulnerability in core server (CVE-2026-16239)

PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions...

PT-2026-71759

The native inference process that Elasticsearch uses to evaluate uploaded machine learning models accepts a model operation that computes a memory address from an offset supplied inside the model, without validating that the offset stays within the bounds of the underlying storage. A user with th...

PT-2026-71468

Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected...

PT-2026-71484

Untrusted data inclusion in pg dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql restrict meta-command input expansion. The fix for CVE-2025-871...

PT-2026-71480

Type confusion in PostgreSQL pg restore attribute stats allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before...

PT-2026-71743

IBM i 7.6, 7.5, 7.4, and 7.3 could allow a remote authenticated attacker to execute arbitrary code due to a buffer overflow...

Linux Distros Unpatched Vulnerability : CVE-2026-14676

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Heap buffer overflow in PostgreSQL pgstatstatements allows the query author to execute arbitrary code as the operating system user running the database, via...

ROS-20260813-73-0051

The vulnerability in Wireshark is related to overflowing of buffers in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20260813-73-0055

The vulnerability in perl-XML-Parser is related to buffer overflow in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

PT-2026-71464

Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when...

Debian dsa-6436 : chromium - security update

The remote Debian 13 host has packages installed that are affected by multiple vulnerabilities as referenced in the dsa-6436 advisory. - ------------------------------------------------------------------------- Debian Security Advisory DSA-6436-1 [email protected] https://www.debian.org/securit...

UBUNTU-CVE-2026-73248

calibre is an e-book manager. Prior to 9.12.0, calibre processes attacker-controlled compositetemplate metadata from a malicious EPUB, OPF, PDF, or similar file through program: and a nested template call whose formatter does not inherit allowpythontemplates=False, allowing a nested python:...

Vulnerability in core server (CVE-2026-14669)

PostgreSQL tochar heap buffer overflow executes arbitrary code Heap buffer overflow in PostgreSQL tochartimestamptz allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQ...

Vulnerability in contrib module (CVE-2026-14671)

PostgreSQL refint plan cache type confusion executes arbitrary code Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the g...

Vulnerability in client (CVE-2026-18408)

PostgreSQL psql \unrestrict lets superuser of pgdump origin server execute arbitrary code in psql client Untrusted data inclusion in pgdump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account...

Vulnerability in core server (CVE-2026-16238)

PostgreSQL type confusion in pgrestoreattributestats executes arbitrary code Type confusion in PostgreSQL pgrestoreattributestats allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major versi...

CVE-2026-26199 affecting package hdf5 for versions less than 1.14.6-4

CVE-2026-26199 affecting package hdf5 for versions less than 1.14.6-4. A patched version of the package is available...

CVE-2026-26197 affecting package hdf5 for versions less than 1.14.6-4

CVE-2026-26197 affecting package hdf5 for versions less than 1.14.6-4. A patched version of the package is available...

Important: Red Hat Security Advisory: Red Hat Lightspeed (formerly Insights) for Runtimes security update

An update is now available for Red Hat Lightspeed formerly Insights for Runtimes on RHEL 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each...

CVE-2026-19004

An application using the MongoDB BI Connector ODBC Driver may experience a memory-safety issue when processing output parameters from a stored procedure. Triggering this issue requires connecting to an untrusted or impersonated database server that returns crafted metadata. This may result in...