CVE-2026-17351 pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)

The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's executesqlquery tool to parse, via sqlparse, as exactly one non-transaction-control statement before running it inside a BEGIN TRANSACTION READ ONLY wrapper. sqlparse's string-literal lexing...

CVE-2026-17351 pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)

The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's executesqlquery tool to parse, via sqlparse, as exactly one non-transaction-control statement before running it inside a BEGIN TRANSACTION READ ONLY wrapper. sqlparse's string-literal lexing...

CVE-2026-16503

The VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432 ) using the default password "postgres" . Because Docker manages its own iptables rules, this configuration bypasses standard host UFW firewall protections. A remote attacker ca...

CVE-2026-16503 VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

EUVD-2026-51547

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

CVE-2026-16503 VPS.org one-click Supabase template deployment instance contains multiple vulnerabilities

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

SUSE CVE-2022-45786

There are issues with the AGE drivers for Golang and Python that enable SQL injections to occur. This impacts AGE for PostgreSQL 11 & AGE for PostgreSQL 12, all versions up-to-and-including 1.1.0, when using those drivers. The fix is to update to the latest Golang and Python drivers in addition t...

EUVD-2026-51315

A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the leappoldpostgresqldata option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read...

CVE-2026-16503: Initialization of a Resource with an Insecure Default

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

PT-2026-66762

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces 0.0.0.0:5432 with a default database password set to "postgres". Because Docker installs its own iptables rules, this exposure bypasses a standard host UFW configuration...

Fedora 44 : postgresql16 (2026-f8ee1fd482)

The remote Fedora 44 host has a package installed that is affected by multiple vulnerabilities as referenced in the FEDORA-2026-f8ee1fd482 advisory. Automatic update for postgresql16-16.14-1.fc44. Changelog for postgresql16 Thu May 14 2026 Packit - 16.14-1 - Update to version 16.14 - Resolves:...

CVE-2026-45376: Improper Neutralization of Special Elements used in an SQL Command

Decidim is a participatory democracy framework. Prior to 0.30.9, from 0.31.0 before 0.31.5, and in 0.32.0.rc1 before 0.32.0.rc2, the GET /admin/organization/users search interpolates params:term into raw Arel.sql ORDER BY similarity expressions before sanitization, allowing an authenticated...

CVE-2026-68563

A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the leappoldpostgresqldata option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read...

CVE-2026-68563 Ansible-collection-redhat-leapp: ansible-collection-redhat-leapp: information disclosure of postgresql data via insecure backup permissions

A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the leappoldpostgresqldata option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read...

CVE-2026-68563

A flaw was found in ansible-collection-redhat-leapp. When a remediation task is executed with elevated privileges and the leappoldpostgresqldata option is selected, a PostgreSQL data backup archive is created with insecure permissions. This allows a local non-root user on the managed node to read...

CVE-2026-68563

The CVE applies to the Ansible collection redhat leapp. When a remediation task runs with elevated privileges and leapp_old_postgresql_data is selected, a PostgreSQL data backup archive is created with insecure permissions. This may allow a local non-root user on the managed node to read sensitiv...

CVE-2026-62845 Kamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL drivers

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have ...

EUVD-2026-51312

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have ...

CVE-2026-62845 Kamaji: SQL injection via unescaped datastore identifiers in PostgreSQL/MySQL drivers

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have ...

CVE-2026-62845

Kamaji is the Hosted Control Plane Manager for Kubernetes. Prior to 26.7.4-edge, the PostgreSQL and MySQL datastore drivers build DDL statements by interpolating the user-supplied DataStoreUsername/DataStoreSchema directly into SQL via fmt.Sprintf, without escaping identifiers. These fields have ...