CVE-2026-105616

PostgreSQL restricts acces to the salt and shift via the SHOW command for users not member of pgreadallsettings. But they are visible in pgdbrolesetting or pgroles if they were set on the database, user or both. PostgreSQL Anonymizer's documentation recommends to use ALTER DATABASE / ALTER ROLE f...

CVE-2026-105616 PostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg_roles or pg_db_role_setting

PostgreSQL restricts acces to the salt and shift via the SHOW command for users not member of pgreadallsettings. But they are visible in pgdbrolesetting or pgroles if they were set on the database, user or both. PostgreSQL Anonymizer's documentation recommends to use ALTER DATABASE / ALTER ROLE f...

EUVD-2026-112288

PostgreSQL restricts acces to the salt and shift via the SHOW command for users not member of pgreadallsettings. But they are visible in pgdbrolesetting or pgroles if they were set on the database, user or both. PostgreSQL Anonymizer's documentation recommends to use ALTER DATABASE / ALTER ROLE f...

CVE-2026-105616

The PostgreSQL Anonymizer extension contains a vulnerability where the secret salt and shift of the anon function are exposed to unauthorized roles. While PostgreSQL restricts access via the SHOW command for users not in pg_read_all_settings, these secrets remain readable in pg_db_role_setting or...

PT-2026-129070

PostgreSQL restricts acces to the salt and shift via the SHOW command for users not member of pg read all settings. But they are visible in pg db role setting or pg roles if they were set on the database, user or both. PostgreSQL Anonymizer's documentation recommends to use ALTER DATABASE / ALTER...

GHSA-V8VM-CQH8-Q87Q NocoBase: Sensitive Data Exposure via SQL Blacklist Bypass

Security Vulnerability Report: Sensitive Data Exposure via SQL Blacklist Bypass Summary The checkSQL function in plugin-collection-sql implements a keyword-based blacklist to prevent dangerous SQL queries from being executed through the SQL Collection feature. However, the blacklist is incomplete...

Check PostgreSQL Privileges

Review current role capabilities and notable grants from kittysploit import from lib.protocols.postgresql.postgresqlclient import PostgreSQLClient class ModulePost, PostgreSQLClient: info = "name": "Check PostgreSQL Privileges", "description": "Review current role capabilities and notable grants"...