RLSA-2026:70186 Important: postgresql16 security update

PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine a...

Attackers Use Malicious Terraform Providers to Deliver Go Malware via HashiCorp Registry

Cybersecurity researchers have disclosed Go-based malware distributed via two Go Modules and two Terraform providers, marking the first time threat actors are using the centralized repository hosted by HashiCorp as a distribution vector for malicious payloads. According to Aikido, the list of...

postgresql security update

An update is available for postgresql. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list PostgreSQL is an advanced object-relational database management system DBM...

RLSA-2026:69607 Important: postgresql security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in...

RLSA-2026:69924 Important: postgresql:12 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY...

postgresql:12 security update

An update is available for module.pgrepack, module.postgres-decoderbufs, module.pgaudit, pgrepack, postgres-decoderbufs, postgresql, pgaudit, module.postgresql. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

CVE-2026-77285

The OpenBao Agent 's exec rendering mode contains a flaw where it can incorrectly write secrets from env_template to standard output . This vulnerability occurs when command/agent/exec/exec.go re-creates the template runner following repeated rendering failures, specifically when the num_retries ...

CVE-2026-77285 OpenBao Agent Writes Secrets to Stdout

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from envtemplate to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after...

CVE-2026-77285 OpenBao Agent Writes Secrets to Stdout

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from envtemplate to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after...

EUVD-2026-85518

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from envtemplate to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after...

CVE-2026-77285 OpenBao Agent Writes Secrets to Stdout

OpenBao is an open source identity-based secrets management system. Prior to 2.6.0, OpenBao Agent's exec rendering mode could write secrets from envtemplate to standard output when command/agent/exec/exec.go re-created the template runner after repeated rendering failures, primarily after...

MicroTrick

MikroTrick PoC — CVE-2026-86060 toma de control total no autenticada de RouterOS pocmikrotrick.py es un exploit autocontenido para la cadena de ataque SSH que CERT Polska divulgó como "MikroTrick" el 2026-09-05, explotada en la naturaleza desde al menos el 2026-09-02 contra dispositivos MikroTik...

are-you-get-tanstack-attack

Escáner de CVE de TanStack Router Una herramienta de escaneo de seguridad para detectar el CVE de TanStack Router | GHSA de TanStack Router en tus proyectos. Resumen Esta herramienta escanea tu código en busca de indicadores de la vulnerabilidad de TanStack Router CVE-2026-45321 /...

Popcorn-TJNULL-OSCP-

HackTheBox: Popcorn 渗透报告 日期： 2026年06月05日 难度： 简单 平台： HackTheBox 关键技术： 端口与服务枚举、目录模糊测试（Gobuster）、文件上传绕过、HTTP请求篡改（Burp Suite）、远程代码执行（RCE）、高级TTY Shell稳定化（Python）、本地内核/PAM漏洞利用（MOTD文件篡改）。 1. 侦察与枚举 端口扫描（快速侦察） 我们首先对所有65535个TCP端口进行一次快速扫描（-p-），以定位开放的入口点。我们使用 --min-rate 5000...

CVE-2026-95843

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, PostOffice.subscribe parses a shared-subscription filter through SharedSubscriptionUtils.extractShareName before validating the complete $share/shareName/topicFilter structure. A remote client can send a filter such as $share/grp withou...

CVE-2026-95842

Moquette is a lightweight Java MQTT broker. Prior to 0.18.1, SessionEventLoop.run catches only InterruptedException, and SessionEventLoopGroup does not restart a terminated loop. An MQTT command that raises an uncaught exception can terminate an event loop shared by multiple client sessions,...

CVE-2026-93349

Frictionless through 5.20.0rc1 contains an OS command injection vulnerability in the explore console command that allows an attacker who supplies a crafted Data Package descriptor to execute arbitrary operating system commands as the user who explores it. Attackers can place shell metacharacters ...

postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN

A flaw was found in PostgreSQL psql. During the COPY FROM STDIN operation, untrusted data can be mistakenly interpreted as psql commands if an error injection causes the command to fail prematurely. This could allow an attacker to achieve arbitrary command execution. Successful exploitation...

Important: Red Hat Security Advisory: postgresql:16 security update

An update for the postgresql:16 module is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severi...

postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump

A vulnerability in PostgreSQL allows a malicious origin-server superuser to achieve client-side arbitrary code execution during a database restore. By injecting untrusted data into a pgdump export, the attacker can exploit the input expansion of the psql \restrict meta-command. When a victim...