MiracleLinux 9 : [security - high] postgresql:16 (AXSA:2026-1882:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1882:01 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL:...

CVE-2026-85878

CVE-2026-85878 is an improper authorization vulnerability in Azure Database for PostgreSQL that allows an authorized attacker to elevate privileges over a network. Microsoft's CNA rates it CVSS 3.1 9.9 (CRITICAL) with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a low-complexity ne...

CVE-2026-53556

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled tablename value into generated SQL without safe identifier handling...

CVE-2026-53557

SQLBot , an intelligent Text-to-SQL system built on LLMs and RAG, contains a second-order SQL injection in its Excel datasource handling. Prior to 1.9.0 , an authenticated user can supply a crafted sheet["tableName"] value via POST /api/v1/datasource/, which is stored without safe identifier hand...

CVE-2026-53557 SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...

CVE-2026-53556

SQLBot , an intelligent Text-to-SQL system, is vulnerable to authenticated SQL injection in the POST /api/v1/datasource/previewData endpoint (prior to v1.9.0 ). The client-controlled table_name parameter is incorporated into generated SQL without safe identifier handling. An authenticated user ca...

CVE-2026-53556 SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled tablename value into generated SQL without safe identifier handling...

CVE-2026-54354 MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query Translation

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gmltype=Integer are configured, b...

CVE-2026-54354 MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query Translation

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gmltype=Integer are configured, b...

LInux-Kernel-InfoLeak-6.12.-Leveraged-to-do-cross-container-info-leak.-

LInux-Kernel-InfoLeak-6.12.-Leveraged-to-do-cross-container-info-leak.- POC shows how to leak postgresql stuff cause hugefile sub-system. Based on https://x.com/spendergrsec/status/1993794163880718700?s=20...

CVE-2018-1058

CVE-2018-1058 — PostgreSQL Search Path Demonstration This repository contains the final report and the reproducibility artifacts for: CVE-2018-1058: Privilege Escalation in PostgreSQL through Uncontrolled Search Path The goal is to demonstrate the search-path trust failure behind CVE-2018-1058...

Azure Database for PostgreSQL Elevation of Privilege Vulnerability

Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network...

ROOT-APP-MAVEN-CVE-2024-1597 CVE-2024-1597 in org.postgresql:postgresql - Patched by Root

Root has patched CVE-2024-1597 in the org.postgresql:postgresql package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2022-41946 CVE-2022-41946 in org.postgresql:postgresql - Patched by Root

Root has patched CVE-2022-41946 in the org.postgresql:postgresql package for Root:Maven. Multiple fixed versions available...

CVE-2026-20253

CVE-2026-20253 Lab Environment Splunk Enterprise Pre-Auth RCE via PostgreSQL Sidecar Service...

poc_cve-2026-42208

CVE-2026-42208 — LiteLLM Pre-Authentication SQL Injection A lab environment for reproducing and detecting CVE-2026-42208 , a critical pre-authentication SQL injection vulnerability in LiteLLM where unsanitized Bearer tokens reach a raw PostgreSQL query. Vulnerability Overview...

POC-CVE-2025-1094

POC CVE-2025-1094: PostgreSQL psql SQL Injection Proof of Concept for critical SQL Injection vulnerability in PostgreSQL client libpq and psql tool 📋 Table of Contents 1. Vulnerability Overview 2. Project Directory Structure 3. Attack Payload Analysis 4. Usage Guide 5. Mitigation & Prevention 1...

CVE-2026-2005_lab

CVE-2026-2005 — PostgreSQL pgcrypto Heap Overflow Lab A self-contained Docker lab for practicing exploitation of CVE-2026-2005, a heap buffer overflow in PostgreSQL's pgcrypto extension that enables remote code execution without superuser privileges. Affected versions: PostgreSQL ≤ 17.7 / 16.11 /...

cve-2026-2005

CVE-2026-2005 — PostgreSQL pgcrypto Heap Overflow → RCE Remote code execution via a single SQL query targeting PostgreSQL's pgcrypto extension. The vulnerability is a heap buffer overflow in pgpparsepubencsesskey that allows corruption of PostgreSQL's internal MemoryContext allocator metadata,...

CVE-2026-23980-Exploit

CVE-2026-23980 - Apache Superset Authenticated SQL Injection root@kitploit: / \ | | | | | || | \\ sqlExpression goes straight to the query. no parameterization. no hope. Apache Superset ChartDataRestApi.data - QueryContext.getdfpayload - SqlaTable.getsqlaquery - adhoc column sqlExpression /...