BIT-PROXYSQL-2026-48773 ProxySQL pre-auth heap overflow in MySQL and PostgreSQL first-packet handling

ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Versions 2.0.18 through 3.0.8 have a pre-authentication heap memory corruption vulnerability in the MySQL and PostgreSQL protocol first-read paths. A remote unauthenticated client can declare an oversized first packet length, and...

tirreno v0.10.1

tirreno tirreno is a security framework. tirreno tir.ˈrɛ.no helps understand, monitor, and protect your product from threats, fraud, and abuse. While classic cybersecurity focuses on infrastructure and network perimeter, most breaches occur through compromised accounts and application logic abuse...

CVE-2026-74891: Use of Hard-coded Credentials

opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...

CVE-2026-64657: Improper Neutralization of Special Elements used in an SQL Command

Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET searchpath statement without escaping embedded double quotes, allowing an...

Unity Linux 20.1070a Security Update: libpq (UTSA-2026-099550)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099550 advisory. Use of inherently dangerous function PQfn..., resultisint=0, ... in PostgreSQL libpq loexport, loread, lolseek64, and lotell64 functions allows the server superuser ...

PT-2026-73424

ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Versions 2.0.18 through 3.0.8 have a pre-authentication heap memory corruption vulnerability in the MySQL and PostgreSQL protocol first-read paths. A remote unauthenticated client can declare an oversized first packet length, and...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099479)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099479 advisory. Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use searchpath to find user-defined types, including...

Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099460)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099460 advisory. An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitab...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099519)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099519 advisory. Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AFUNIX socket to achieve sustained denial of service...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099535)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099535 advisory. Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099449)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099449 advisory. PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data...

FreeBSD : PostgreSQL -- Multiple vulnerabilities (05d311bc-9991-11f1-bc50-6cc21735f730)

The version of FreeBSD installed on the remote host is prior to tested version. It is, therefore, affected by multiple vulnerabilities as referenced in the 05d311bc-9991-11f1-bc50-6cc21735f730 advisory. The PostgreSQL project reports: CVE-2026-6464: psql COPY FROM STDIN, if the copy fails before...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099512)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099512 advisory. Improper neutralization of newlines in pgdump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client...

Unity Linux 20.1070a Security Update: libpq (UTSA-2026-099554)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099554 advisory. Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. Th...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099496)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099496 advisory. Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun. That...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099534)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099534 advisory. Buffer over-read in PostgreSQL GB18030 encoding validation allows a database input provider to achieve temporary denial of service on platforms where a 1-byte...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099526)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099526 advisory. Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before...

Unity Linux 20.1070a Security Update: libpq (UTSA-2026-099547)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099547 advisory. Symlink following in PostgreSQL pgbasebackup plain format and in pgrewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099502)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099502 advisory. Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operati...

PT-2026-76627

openssl encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...