CVE-2026-46421 Supply chain compromise via malicious package versions (@cap-js/sqlite, @cap-js/postgres, @cap-js/db-service)

The SAP Cloud Application Programming Model is a tool for building enterprise-grade cloud applications, and cap-js/cds-dbs is the monorepo for SQL database services for that tool. On April 29, 2026, compromised versions of @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected]....

CVE-2026-46421

The SAP Cloud Application Programming Model is a tool for building enterprise-grade cloud applications, and cap-js/cds-dbs is the monorepo for SQL database services for that tool. On April 29, 2026, compromised versions of @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected]....

CVE-2026-46421

The CVE concerns a supply-chain compromise in the SAP Cloud Application Programming Model’s cap-js/cds-dbs monorepo. On 2026-04-29, compromised versions of @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected] were published; these malicious packages harvested credentials (n...

PT-2026-60296

Name of the Vulnerable Software and Affected Versions NocoBase versions prior to 2.0.61 Description An issue exists in the @nocobase/plugin-notification-in-app-message where the 'GET /api/myInAppChannels:list' endpoint is exposed. A signed-up authenticated user can exploit this by providing a val...

CVE-2026-46421: Embedded Malicious Code

The SAP Cloud Application Programming Model is a tool for building enterprise-grade cloud applications, and cap-js/cds-dbs is the monorepo for SQL database services for that tool. On April 29, 2026, compromised versions of @cap-js/[email protected], @cap-js/[email protected], and @cap-js/[email protected]....

MAL-2026-10537 Malicious code in neon-postgres (npm)

--- -= Per source details. Do not edit below this line.=- Source: amazon-inspector 33e264a75c066f784e7900ad4f7f51598022eb9c7858fff489dc1861506ca855 neon-postgres is a clone of the porsager/postgres client with package metadata repository, author, homepage still pointing at the upstream project...

PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)

The fix for CVE-2026-40315 added input validation to SQLiteConversationStore only. Nine sibling backends — MySQL, PostgreSQL, async SQLite/MySQL/PostgreSQL, Turso, SingleStore, Supabase, SurrealDB — pass tableprefix straight into f-string SQL. Same root cause, same code pattern, same exploitation...

PYSEC-2026-2341 alerta-server has potential SQL Injection vulnerability in Query String Syntax (q=) API

Impact The Query string search API q= was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. Patches Fixed in v9.1.0. The Postgres query parser now uses parameterized queries wit...

Oracle Linux 9 : postgresql:18 (ELSA-2026-26204)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-26204 advisory. pgaudit 18.0-1 - Update to 18.0 - Initial import for postgresql18 pgrepack 1.5.3-1 - Update to 1.5.3 - Initial import for postgresql18 1.5.1-1 - Updat...

github.com/jackc/pgx/v5: github.com/jackc/pgx: Memory-safety vulnerability

A flaw was found in github.com/jackc/pgx. This memory-safety vulnerability could potentially lead to unexpected behavior or system instability...

Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access cancraft a specially designed SQL DML statementthat is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and postgr...

PYSEC-2026-1162 Apache Superset: SQLLab Improper readonly query validation allows unauthorized write access

Improper Authorization vulnerability in Apache Superset. On Postgres analytic databases an attacker with SQLLab access can craft a specially designed SQL DML statement that is Incorrectly identified as a read-only query, enabling its execution. Non postgres analytics database connections and...

Malicious code in postgres-docker-utils (npm)

--- -= Per source details. Do not edit below this line.=-...

MAL-2026-7349 Malicious code in postgres-docker-utils (npm)

--- -= Per source details. Do not edit below this line.=-...

📄 Tenable Nessus 10.12.0 SQL Injection

A SQL injection vulnerability exists in Tenable Nessus when importing malicious scan result files .nessus XML. Versions 10.12.0 and below are affected. Exploit Title: Tenable Nessus 10.12.1 - SQL Injection CVE: CVE-2026-57588 Date: 2026-06-26 Exploit Author: Mohammed Idrees Banyamer Author Countr...

CVE-2026-42153

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL healthcheck command generation used attacker-controlled database settings postgresuser and postgresdb in shell-form commands, allowing an authenticated user to...

CVE-2026-54291 Silent channel-binding authentication downgrade via unsupported certificate algorithms

pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to...

Security update 5.1.4 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-QubitProducts-exporterexporter: CVE-2022-21698: Replace github.com/prometheus/clientgolang with version 1.11.1 bsc1248707 golang-github-boynux-squidexporter: Non customer facing changes golang-github-lusitaniae-apacheexporter: Non customer...

SUSE-SU-2026:2766-1 Security update 5.1.4 for Multi-Linux Manager Client Tools

This update fixes the following issues: golang-github-QubitProducts-exporterexporter: - CVE-2022-21698: Replace github.com/prometheus/clientgolang with version 1.11.1 bsc1248707 golang-github-boynux-squidexporter: - Non customer facing changes golang-github-lusitaniae-apacheexporter: - Non custom...

GHSA-PMCH-G965-GRMR Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read

Summary SQLChatAgent in langroid ships a validatequery defense-in-depth layer whose DANGEROUSSQLPATTERNS regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses the canonical PostgreSQL filesystem-disclosure family pgreadfile, pgstatfile, pglslogdir,...