CVE-2026-45417: Improper Neutralization of Special Elements used in an SQL Command

DataEase is an open source data visualization and analysis tool. Prior to 2.10.23, DataEase datasource connection status checks concatenate configuration.getSchema into getTablesSql and execute the resulting SQL with executeQuery in io.dataease.datasource.provider.CalciteProvidercheckStatus,...

CVE-2026-62361: Improper Neutralization of Special Elements used in an SQL Command

listmonk is a standalone, self-hosted, newsletter and mailing list manager. Prior to 6.2.0, listmonk’s GET /api/subscribers/export endpoint injects the user-controlled query parameter into QuerySubscribersForExport in internal/core/subscribers.go without calling validateQueryTables, unlike GET...

ROS-20260714-73-0048

The vulnerability of the KILLCLIENT command in the PostgreSQL PgBouncer connection pool software is related to the absence of authentication. Exploiting this vulnerability can allow a malicious actor to cause service failures remotely...

ROS-20260714-73-0050

The vulnerability of the strlcat function in PostgreSQL PgBouncer software-related connectivity libraries is related to the issue of operations going beyond the buffer boundaries in memory. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code or cause service...

ROS-20260714-73-0049

The vulnerability of the PostgreSQL PgBouncer connection pool software relates to the assignment of the null pointer. Exploiting this vulnerability could allow a malicious actor to cause service failures...

Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls

SQLChatAgent validatequery dangerous-pattern regex is bypassable via quoted/commented/qualified function names SummaryThe SQLChatAgent SQL-injection mitigation, with default allowdangerousoperations=False, combines a raw-text regex blocklist DANGEROUSSQLPATTERNS with a sqlglot SELECT-only stateme...

Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read

SummarySQLChatAgent in langroid ships a validatequery defense-in-depth layerwhose DANGEROUSSQLPATTERNS regex blocklist enumerates dangerous SQLprimitives by specific function name. The list misses the canonicalPostgreSQL filesystem-disclosure family pgreadfile, pgstatfile,pglslogdir, pglswaldir,...

PYSEC-2026-2580 Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read

Summary SQLChatAgent in langroid ships a validatequery defense-in-depth layer whose DANGEROUSSQLPATTERNS regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses the canonical PostgreSQL filesystem-disclosure family pgreadfile, pgstatfile, pglslogdir,...

PYSEC-2026-2923 PraisonAI: SQL Injection via unvalidated `table_prefix` in 9 conversation store backends (incomplete fix for CVE-2026-40315)

The fix for CVE-2026-40315 added input validation to SQLiteConversationStore only. Nine sibling backends — MySQL, PostgreSQL, async SQLite/MySQL/PostgreSQL, Turso, SingleStore, Supabase, SurrealDB — pass tableprefix straight into f-string SQL. Same root cause, same code pattern, same exploitation...

PYSEC-2026-2376 Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections

An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language DML statements...

Apache Superset: Read-Only Bypass via Improper Input Validation on PostgreSQL Connections

An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection.While the system effectively blocks standard Data Manipulation Language DML statements...

PT-2026-59091

Impact A vulnerability in datastore search sql allowed attackers to inject SQL in order to gain access to private resources and PostgreSQL system information. Patches The issue has been patched in CKAN 2.10.10 and CKAN 2.11.5 Workarounds Disable the DataStore SQL search...

PT-2026-59235

Summary SQLChatAgent in langroid ships a validate query defense-in-depth layer whose DANGEROUS SQL PATTERNS regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses the canonical PostgreSQL filesystem-disclosure family pg read file, pg stat file, pg ls logdir...

Decidim - Admin user search allows SQL injection through similarity-based sorting

Description The admin organization user search uses the untrusted term value inside raw SQL ORDER BY expressions. Because the value is interpolated before Rails sanitization is applied, a crafted search string is executed by PostgreSQL as part of the sort expression. Impact - Exploitation require...

PT-2026-59025

Impact The Query string search API q= was vulnerable to SQL injection via the Postgres query parser, which built WHERE clauses by interpolating user-supplied search terms directly into SQL strings via f-strings. Patches Fixed in v9.1.0. The Postgres query parser now uses parameterized queries wit...

PT-2026-59090

Impact A vulnerability in datastore search sql allowed attackers to bypass authorization in order to gain access to private resources and PostgreSQL system information Patches The issue has been patched in CKAN 2.10.10 and CKAN 2.11.5 Workarounds Disable the DataStore SQL search...

PT-2026-60068

Name of the Vulnerable Software and Affected Versions Decidim versions prior to 0.30.9 Decidim versions 0.31.0 through 0.31.4 Decidim version 0.32.0.rc1 Description An authenticated organization administrator can execute blind PostgreSQL expressions and infer data through timing differences. The...

ROS-20260713-73-0045

The vulnerability of the mbufgetbytes and mbufgetchars functions in PostgreSQL’s PgBouncer connection pool lies in integer overflow. Exploiting this vulnerability could allow a malicious actor to cause a service failure by sending a specially crafted authentication packet called SCRAM...

PT-2026-59056

An Improper Input Validation vulnerability exists in Apache Superset that allows an authenticated user with SQLLab access to bypass the read-only verification check when using a PostgreSQL database connection. While the system effectively blocks standard Data Manipulation Language DML statements...

BIT-POSTGRESQL-JDBC-DRIVER-2026-54291 Silent channel-binding authentication downgrade via unsupported certificate algorithms

pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-SHA-256-PLUS with channel binding to plain SCRAM-SHA-256 without it, losing the man-in-the-middle protection the setting is meant to...