ANT-2026-XKHXVCFV · supabase/postgres · other

other low Severity Claude low · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-XKHXVCFV: Root-executed binaries fetched from S3 without integrity check Several Ansible tasks admin-mgr.yml:11,...

ANT-2026-W77T9B29 · supabase/postgres · other

other medium Severity Claude medium · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-W77T9B29: CI downloads unverified binary then assumes production AWS role The qemu-image-build GitHub Actions...

ANT-2026-F5JK7RDG · supabase/postgres · other

other high Severity Claude high · Security research firm - · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis of this finding, sealed at approval. ANT-2026-F5JK7RDG: Cloud image provisioned with default root password and SSH password auth The cloud-init user-data baked...

CVE-2026-64657

Budibase is an open-source low-code platform affected by three SQL injection vulnerabilities in its PostgreSQL , Microsoft SQL Server , and MySQL database connectors (prior to 3.39.19). The root cause is that user-controlled schema and table configuration fields are interpolated directly into raw...

CVE-2026-71472

The flaw resides in postgresql-start.sh within the search-v2-operator of acm-search-v2-rhel9. The WORK_MEM string supplied via a Search Custom Resource is passed unvalidated into both a bash script and an SQL query, enabling authenticated hub administrators or CR editors to inject shell commands ...

CVE-2026-71472

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...

CVE-2026-71472 Acm-search-v2-rhel9: search-v2-operator: shell-command and sql injection in postgresql-start.sh via cr-supplied work_mem

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...

EUVD-2026-60362

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...

CVE-2026-71472

A flaw was found in acm-search-v2-rhel9. This vulnerability allows an authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, to inject malicious shell commands or SQL statements. This occurs because the WORKMEM string provided in the Search CR is not properly...

PT-2026-76763

Name of the Vulnerable Software and Affected Versions acm-search-v2-rhel9 affected versions not specified Description An authenticated attacker, such as a hub administrator or a Search Custom Resource CR editor, can inject malicious shell commands or SQL statements. This issue exists because the...

CVE-2026-48528

CVE-2026-48528 affects Metacat versions 2.0.0–3.4.0 and describes an unauthenticated SQL injection in the /cn/v1/object and /cn/v2/object REST endpoints due to unsanitized nodeId input. The backend SQL queries concatenate user input, enabling arbitrary data extraction from PostgreSQL and potentia...

Improper Enforcement of Message Integrity During Transmission in a Communication Channel

Overview Affected versions of this package are vulnerable to Improper Enforcement of Message Integrity During Transmission in a Communication Channel via the negotiation process between GSSAPI and TLS encryption. An attacker can bypass intended authentication and encryption requirements by...

Integer Overflow or Wraparound

Overview Affected versions of this package are vulnerable to Integer Overflow or Wraparound via the levenshtein or levenshteinlessequal SQL functions. An attacker can execute arbitrary code as the operating system user running the database by providing specially crafted input values. Remediation...

Buffer Over-read

Overview Affected versions of this package are vulnerable to Buffer Over-read via the ascii function. An attacker can access up to 3 bytes of memory beyond the intended buffer by supplying a specially crafted text value. Remediation Upgrade libpq to version 14.24, 15.19, 16.15, 17.11 or higher...

Important: Red Hat Security Advisory: Red Hat build of Quarkus 3.27.5 release and security update

An update is now available for Red Hat build of Quarkus. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability. For more informatio...

CLEANSTART-2026-XX81961 Security fixes in postgres-operator 1.12.2-r2

Package postgres-operator version 1.12.2-r2 fixes 48 vulnerabilities: CVE-2025-22868, CVE-2025-47911, CVE-2025-47913, CVE-2025-47914, CVE-2025-58181...

CLEANSTART-2026-JS92568 Security fixes in postgres-operator 1.13.0-r2

Package postgres-operator version 1.13.0-r2 fixes 2 vulnerabilities: CVE-2026-46600, CVE-2026-56852...

CLEANSTART-2026-FZ96699 Security fixes in postgres-operator 1.13.0-r1

Package postgres-operator version 1.13.0-r1 fixes 3 vulnerabilities: ghsa-vgwf-h737-ff37, ghsa-5cgq-3rg8-m6cv, ghsa-rm3j-f69w-wqmq...

PT-2026-85882

Package postgres-operator version 1.13.0-r1 fixes 3 vulnerabilities: ghsa-vgwf-h737-ff37, ghsa-5cgq-3rg8-m6cv, ghsa-rm3j-f69w-wqmq...

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

SummaryThe Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string "memories", "alice" becomes memories.alice and scoped reads by matching that string with LIKE '%'. Because LIKE has no notion of the . separator, a scoped search or listnamespaces also matched sibling...