Security Bulletin: EDB Postgres AI Database with IBM is affected by Multiple Vulnerabilities.

Summary Multiple Vulnerabilities found in EDB PGAI database products. Hence, IBM strongly recommends upgrading to 18.6 Vulnerability Details CVEID:CVE-2026-30922 DESCRIPTION: pyasn1 is a generic ASN.1 library for Python. Prior to 0.6.3, the pyasn1 library is vulnerable to a Denial of Service DoS...

CVE-2026-91154 Missing authentication in Ecommerce Template product cache revalidation allows unauthenticated denial of service

Missing Authentication for Critical Function CWE-306 in the product cache revalidation Server Action src/app/actions.ts, revalidateProducts in MarcosCamara01 Ecommerce Template before commit ec97209 allows a remote, unauthenticated attacker to force expiration of the entire storefront product cac...

postgresql:12 security update

An update is available for module.pgrepack, module.postgres-decoderbufs, module.pgaudit, pgrepack, postgres-decoderbufs, postgresql, pgaudit, module.postgresql. This update affects Rocky Linux 8. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

Another-Metabase-RCE-CVE-2023-38646

Extension of the Pre-Auth RCE in Metabase CVE-2023-38646 explained here This helped me to avoid errors related to "database already in use" with H2 and postgre as engines "token": "TOKEN", "details": "isondemand": false, "isfullsync": false, "issample": false, "cachettl": null, "refingerprint":...

Oracle Linux 8 : postgresql:15 (ELSA-2026-69923)

The remote Oracle Linux 8 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69923 advisory. pgaudit 1.7.0-1 - Update to 1.7.0 - Support postgresql 15 - Related: 2128241 1.5.0-1 - Update to version 1.5.0 Related: 1855776 1.4.0-4 - Bump release...

PT-2026-98258

Name of the Vulnerable Software and Affected Versions AWS pgcollection versions 2.0.0 through 2.1.1 Description A type confusion issue exists in this PostgreSQL extension. An authenticated remote user can execute arbitrary code as the postgres operating system user by using crafted SQL statements...

postgresql:16 security update

pgaudit 16.0-1 - Update to 16.0 - Support postgresql 16 - Initial import for PG 16 module - Resolves: RHEL-3636 pgrepack 1.5.1-1 - Update to 1.5.1 postgres-decoderbufs 2.4.0-1.Final - Initial import for postgresql 16 stream - Related: RHEL-3636 postgresql 16.15-1 - Update to 16.15 - Fix...

postgresql:15 security update

pgaudit 1.7.0-1 - Initial import for postgresql 15 module - Update to 1.7.0 - Support postgresql 15 - Related: 2128410 pgrepack 1.4.8-2 - Add new build dependencies to fix build with lz4 enabled - Related: RHEL-47350 1.4.8-1 - Update to version 1.4.8 - Postgresql 15 is supported - Related: 212841...

postgresql:15 security update

pgaudit 1.7.0-1 - Update to 1.7.0 - Support postgresql 15 - Related: 2128241 1.5.0-1 - Update to version 1.5.0 Related: 1855776 1.4.0-4 - Bump release for rebuild against libpq-12.1-3 1.4.0-3 - BuildRequires libpq-devel 1.4.0-2 - BuildRequires postgresql-server-devel 1.4.0-1 - Update to 1.4.0...

Oracle Linux 9 : postgresql:15 (ELSA-2026-69914)

The remote Oracle Linux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ELSA-2026-69914 advisory. pgaudit 1.7.0-1 - Initial import for postgresql 15 module - Update to 1.7.0 - Support postgresql 15 - Related: 2128410 pgrepack 1.4.8-2 - Add new buil...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: php (UTSA-2026-054027)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-054027 advisory. In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using Postgres database extension, supplying invalid parameters to the parametriz...

faraday v5.24.2

Open Source Vulnerability Manager Security has two difficult tasks: designing smart ways of getting new information, and keeping track of findings to improve remediation efforts. With Faraday, you may focus on discovering vulnerabilities while we help you with the rest. Just use it in your termin...

CVE-2026-82028

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without...

CVE-2026-82028 Magistrala < 1.0.0 SQL Injection via format Parameter in Reader API

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without...

CVE-2026-82028 Magistrala < 1.0.0 SQL Injection via format Parameter in Reader API

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without...

CVE-2026-82028

Magistrala versions before 1.0.0 are affected by a SQL injection in the timescale-reader and postgres-reader HTTP API services. The root cause is a malicious format query parameter interpolated directly into the FROM clause without parameterization or identifier quoting. An authenticated attacker...

CVE-2026-82028: Improper Neutralization of Special Elements used in an SQL Command

Magistrala before 1.0.0 contains a SQL injection vulnerability in the timescale-reader and postgres-reader HTTP API services that allows authenticated attackers to inject arbitrary SQL by supplying a malicious format query parameter that is interpolated directly into the FROM clause without...

CVE-2026-87911

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...

CVE-2026-87911 Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...

CVE-2026-87911 Read-only enforcement bypass enabling operating system command execution in the SQL validation component of Amazon awslabs postgres-mcp-server

An OS command injection weakness in the read-only enforcement of the SQL validation component in Amazon awslabs postgres-mcp-server before 1.1.7 might allow an unauthenticated actor to execute operating system commands on the host of a self-managed PostgreSQL server by placing a crafted COPY ... ...