CVE-2026-48773: Out-of-bounds Write

ProxySQL is a proxy for MySQL and its forks, as well as PostgreSQL. Versions 2.0.18 through 3.0.8 have a pre-authentication heap memory corruption vulnerability in the MySQL and PostgreSQL protocol first-read paths. A remote unauthenticated client can declare an oversized first packet length, and...

postgresql:15 security update

pgaudit 1.7.0-1 - Update to 1.7.0 - Support postgresql 15 - Related: 2128241 1.5.0-1 - Update to version 1.5.0 Related: 1855776 1.4.0-4 - Bump release for rebuild against libpq-12.1-3 1.4.0-3 - BuildRequires libpq-devel 1.4.0-2 - BuildRequires postgresql-server-devel 1.4.0-1 - Update to 1.4.0...

CVE-2026-12048: Improper Neutralization of Input During Web Page Generation

Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server ErrorResponse messages, including object names quoted back inside relation-does-not-exist errors and inside EXPLAIN Recheck Cond / Exact Heap Blocks fields was passed...

CVE-2026-12050: Improper Neutralization of Special Elements used in an SQL Command

SQL injection in pgAdmin 4's named restore point endpoint POST /browser/server/restorepoint/gid/sid. The user-supplied 'value' field was interpolated directly into the SQL string with str.format instead of being passed as a bound parameter, allowing an authenticated pgAdmin user with a connected...

CVE-2026-12044: Improper Neutralization of Special Elements used in an SQL Command

SQL injection in pgAdmin 4 across every dialog template that renders COMMENT ON ... IS ' ' for a user-supplied description field. The Jinja templates for Domains and their constraints, Foreign Tables, Languages, and Event Triggers, plus the Views OID-lookup query, interpolated the description...

NPM: budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL

NPM: budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL vulnerability discovered by ? in WordPress Npm budibase versions 3.39.19...

GHSA-QQF5-X7MJ-V43P budibase: Database Connector SQL Injections in PostgreSQL, MS SQL, and MySQL

Summary This advisory covers three distinct SQL Injection vulnerabilities within Budibase's database connectors PostgreSQL, Microsoft SQL Server, and MySQL. Because user-controlled schema and table configurations are interpolated directly into raw SQL queries without proper escaping or...

Insertion of Sensitive Information into Log File

Overview pghoard is a PostgreSQL automatic backup/restore service daemon Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File via the debug log process. An attacker can obtain sensitive database credentials by accessing debug-level logs that contain...

RHSA-2026:26561 Red Hat Security Advisory: postgresql:15 security update

Bulletin has no description...

RHSA-2026:26525 Red Hat Security Advisory: postgresql:16 security update

Bulletin has no description...

RHSA-2026:26524 Red Hat Security Advisory: postgresql:16 security update

Bulletin has no description...

PT-2026-53186

Summary This advisory covers three distinct SQL Injection vulnerabilities within Budibase's database connectors PostgreSQL, Microsoft SQL Server, and MySQL. Because user-controlled schema and table configurations are interpolated directly into raw SQL queries without proper escaping or...

PT-2026-76786

Name of the Vulnerable Software and Affected Versions Budibase versions prior to 3.39.19 Description The PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts fails to escape embedded double quotes when interpolating the user-controlled schema configuration field into a...

Splunk Enterprise Missing Authentication for Critical Function Vulnerability

Splunk Enterprise contains a missing authentication for critical function vulnerability which could allow an unauthenticated user to create or truncate arbitrary files through a PostgreSQL sidecar service endpoint...

CVE-2026-50267

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Abstractions 4.0.0 through 4.1.0, when MySQL or PostgreSQL service bindings from VCAPSERVICES include TLS client credentials, the Connectors libra...

CVE-2026-50267 Steeltoe: TLS private keys written to /tmp with default permissions, never deleted

Steeltoe is an open source project that provides a collection of libraries that helps users build cloud-native applications. In Steeltoe.Configuration.Abstractions 4.0.0 through 4.1.0, when MySQL or PostgreSQL service bindings from VCAPSERVICES include TLS client credentials, the Connectors libra...

Security Bulletin: IBM Watson Discovery Cartridge affected by vulnerability in postgresql-42.6.1.jar

Summary IBM Watson Discovery Cartridge affected by vulnerability in postgresql-42.6.1.jar Vulnerability Details CVEID:CVE-2026-42198 DESCRIPTION: pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service...

USN-8443-1 webpy vulnerability

It was discovered that web.py incorrectly handled sequence names in PostgreSQL insert queries. An attacker could possibly use this issue to perform SQL injection attacks, resulting in the alteration or exposure of database information...

postgresql: PostgreSQL libpq: Buffer overflow allows server superuser to overwrite client stack memory

A flaw was found in PostgreSQL libpq. A server superuser can exploit a buffer overflow vulnerability in the PQfn function, which is used by client functions such as loexport, loread, lolseek64, and lotell64. This allows the superuser to send an arbitrarily large response, overwriting the client's...

postgresql: PostgreSQL: Information disclosure via externally-controlled format string in timeofday() function

A flaw was found in PostgreSQL. This vulnerability, an externally-controlled format string in the timeofday function, allows a remote attacker to craft specific timezone zones. Successful exploitation can lead to the retrieval of sensitive portions of server memory, potentially disclosing...