CVE-2026-83534 PostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize_database_parallel()

PostgreSQL Anonymizer contains a vulnerability in the anon.anonymizedatabaseparallel function that allows the owner of a table to run arbitrary code with superuser privilege. The issue is fixed in PostgreSQL Anonymizer 3.2.0 and later versions...

CVE-2026-19634 PostgreSQL Anonymizer: SQL injection in import_database_rules() and import_roles_rules() via crafted object names / JSON

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.importdatabaserules or anon.importrolesrules, the malicious code is executed with...

EUVD-2026-72142

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.importdatabaserules or anon.importrolesrules, the malicious code is executed with...

CVE-2026-19634

PostgreSQL Anonymizer is vulnerable to SQL injection in the anon.import_database_rules() and anon.import_roles_rules() functions. A user can craft a malicious JSON document with specially crafted object names; when a superuser subsequently calls one of these import functions, the injected code ex...

CVE-2026-19634 PostgreSQL Anonymizer: SQL injection in import_database_rules() and import_roles_rules() via crafted object names / JSON

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.importdatabaserules or anon.importrolesrules, the malicious code is executed with...

CVE-2026-19633

PostgreSQL Anonymizer is a PostgreSQL extension for data masking. This vulnerability allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated within the extension's masking ...

CVE-2026-19633 PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueries

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context of the extension’s masking mechanisms, the...

CVE-2026-19633 PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueries

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context of the extension’s masking mechanisms, the...

EUVD-2026-72141

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context of the extension’s masking mechanisms, the...

PT-2026-86535

Name of the Vulnerable Software and Affected Versions PostgreSQL Anonymizer versions prior to 3.1.4 Description Unprivileged masked users can execute arbitrary code by abusing operators, domain casts, or view subqueries that contain untrusted expressions. This occurs when these objects are...

PT-2026-86536

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.import database rules or anon.import roles rules, the malicious code is executed with...

PT-2026-86537

PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize database parallel function that allows the owner of a table to run arbitrary code with superuser privilege. The issue is fixed in PostgreSQL Anonymizer 3.2.0 and later versions...

Exploit for Missing Authorization in Postgresql

PostgreSQL CVE-2026-6471: logical decoding dlopen of an arbitr...

GHSA-MVXR-6M87-MV2Q vulnerabilities

Vulnerabilities for packages: logstash, pghero-fips, kube-logging-operator, pghero, ruby3.3-mail...

[SECURITY] Fedora 44 Update: perl-DBD-Pg-3.21.2-1.fc44

DBD::Pg is a Perl module that works with the DBI module to provide access to PostgreSQL databases...

PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution

PostgreSQL has released updates to address a security flaw that allows an account with the REPLICATION attribute to run arbitrary code as the operating-system user running the database server. The flaw, tracked as CVE-2026-6471 CVSS score: 7.2, has been present since logical decoding was introduc...

CVE-2026-85689

llmware 0.4.6 contains an SQL injection vulnerability in its collection-database layer (llmware/resources.py). Filter and lookup values are directly string-interpolated into SQL WHERE clauses without parameterization or escaping, affecting both the SQLite and PostgreSQL backends. The filter valid...

EUVD-2026-71138

llmware 0.4.6 contains an SQL injection vulnerability in the collection-database layer llmware/resources.py where filter and lookup values are directly string-interpolated into SQL WHERE clauses without parameterization or escaping, in both the SQLite and PostgreSQL backends. The filter validator...

CVE-2026-6471

creationtimestamp| type| source ---|---|--- 2026-09-04 12:12:46+00:00| seen| https://bsky.app/profile/devopsbriefly.bsky.social/post/3muowrtw6ak2d 2026-09-04 12:15:13+00:00| seen| https://bsky.app/profile/javascriptbriefly.bsky.social/post/3muowwa36x62s 2026-09-04 12:16:13+00:00| seen|...

Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL

Summary Multiple vulnerabilities were addressed in IBM Operator for PostgreSQL version v28.4.4. Vulnerability Details CVEID:CVE-2026-11822 DESCRIPTION: SQLite before 3.53.2 contains memory corruption vulnerabilities in the FTS5 full-text search extension that allow attackers to cause process...