CLEANSTART-2026-KI68145 Security fixes in cloudnative-pg 1.26.3-r1

Package cloudnative-pg version 1.26.3-r1 fixes 10 vulnerabilities: ghsa-xgrm-4fwx-7qm8, ghsa-9jj7-4m8r-rfcm, CVE-2026-33815, CVE-2026-33816, ghsa-j88v-2chj-qfwx...

CLEANSTART-2026-RE09633 Security fixes in cloudnative-pg-fips 1.27.3-r1

Package cloudnative-pg-fips version 1.27.3-r1 fixes 1 vulnerabilities: CVE-2026-33186...

CLEANSTART-2026-DI33863 Security fixes in cloudnative-pg-fips 1.27.4-r0

Package cloudnative-pg-fips version 1.27.4-r0 fixes 3 vulnerabilities: CVE-2026-33816, ghsa-j88v-2chj-qfwx, CVE-2026-35469...

CLEANSTART-2026-LW15803 Security fixes in cloudnative-pg 1.27.4-r1

Package cloudnative-pg version 1.27.4-r1 fixes 5 vulnerabilities: CVE-2026-46600, CVE-2026-56852, ghsa-hrxh-6v49-42gf, CVE-2026-39822, CVE-2026-42505...

CLEANSTART-2026-IE71566 Security fixes in cloudnative-pg-fips 1.25.4-r0

Package cloudnative-pg-fips version 1.25.4-r0 fixes 5 vulnerabilities: CVE-2025-47913, CVE-2025-58181, CVE-2025-47914, CVE-2025-61729, CVE-2025-61727...

CLEANSTART-2026-ZZ97950 Security fixes in cloudnative-pg-fips 1.25.4-r2

Package cloudnative-pg-fips version 1.25.4-r2 fixes 4 vulnerabilities: CVE-2026-33186, CVE-2026-25679, CVE-2026-27142, CVE-2026-27139...

CLEANSTART-2026-LP67561 Security fixes in cloudnative-pg-fips 1.26.3-r0

Package cloudnative-pg-fips version 1.26.3-r0 fixes 3 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139...

CLEANSTART-2026-YS37582 Security fixes in cloudnative-pg-fips 1.27.3-r0

Package cloudnative-pg-fips version 1.27.3-r0 fixes 3 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139...

CLEANSTART-2026-ZG46602 Security fixes in cloudnative-pg-fips 1.28.1-r0

Package cloudnative-pg-fips version 1.28.1-r0 fixes 3 vulnerabilities: CVE-2026-25679, CVE-2026-27142, CVE-2026-27139...

Malicious code in pg-expense-example (npm)

Source: amazon-inspector d1d939ad3f0e8e9754bf3562f06692713a76d5c0f18ac13c956f9cb199ed0fbf On require/load, index.js unconditionally collects host identifiers hostname, username, platform, arch, cwd, pid and sends them as URL query parameters via HTTPS GET to a hardcoded Burp Collaborator-style...

@atlantjs/backend (>=11.0.11, <=11.0.79), @atlantjs/database (>=2.0.0, <=2.1.32) +5 more potentially affected by CVE-2026-73651 via typeorm (1.0.0)

typeorm NPM version 1.0.0 is affected by a known vulnerability. The following packages have a transitive dependency on typeorm and may be impacted: - @atlantjs/backend =11.0.11, =2.0.0, =0.48.60, =1.6.5, =2.1.5, =1.1.43, =1.1.45 Source cves: CVE-2026-73651 Source advisory: GHSA-2RP8-MM9Q-FP49...

CLEANSTART-2026-CI73950 Security fixes for CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-42502, CVE-2026-42506 applied in versions: 1.29.1-r0

Multiple security vulnerabilities affect the cloudnative-pg package. These issues are resolved in later releases. See references for individual vulnerability details...

Malicious code in alchemy-pg-search (RubyGems)

--- Credit: OpenSSF source...

CLEANSTART-2026-RR10818 Security fixes for CVE-2026-25680, CVE-2026-25681, CVE-2026-27136, CVE-2026-39821, CVE-2026-42502, CVE-2026-42506 applied in versions: 1.29.1-r0

Multiple security vulnerabilities affect the cloudnative-pg package. These issues are resolved in later releases. See references for individual vulnerability details...

PT-2026-63740

Multiple security vulnerabilities affect the cloudnative-pg package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2026-54760 Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.1, the SQLChatAgent SQL-injection mitigation, with default allowdangerousoperations=False, combines a raw-text regex blocklist DANGEROUSSQLPATTERNS with a sqlglot SELECT-only statement allowlist...

CVE-2026-54760 Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls

Langroid is a framework for building large-language-model-powered applications. Prior to version 0.65.1, the SQLChatAgent SQL-injection mitigation, with default allowdangerousoperations=False, combines a raw-text regex blocklist DANGEROUSSQLPATTERNS with a sqlglot SELECT-only statement allowlist...

Oracle Linux 9 : postgresql:18 (ELSA-2026-26204)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-26204 advisory. pgaudit 18.0-1 - Update to 18.0 - Initial import for postgresql18 pgrepack 1.5.3-1 - Update to 1.5.3 - Initial import for postgresql18 1.5.1-1 - Updat...

ROS-20260708-73-0015

The vulnerability of the loexport, loread, lolseek64, and lotell64 functions in the PostgreSQL database management system’s client library is related to the use of a initially dangerous function. Exploiting this vulnerability could allow an attacker to remotely rewrite the pgdump or psql stack...

django-buckets (>=0.1.1, <=0.1.5), django-isomorphic (>=0.0.1, <=0.0.2) +4 more potentially affected by CVE-2026-53878 via django (1.9.0)

django PYPI version 1.9.0 is affected by a known vulnerability. The following packages have a transitive dependency on django and may be impacted: - django-buckets =0.1.1, =0.0.1, =0.1.0, =0.1.1, =0.1.22a1 - kwikapi-django 0.0.1 Source cves: CVE-2026-53878 Source advisory: OSV:GHSA-8QCX-XF44-272X...