Sangoma Switchvox SQL Injection Vulnerability

Sangoma Switchvox contains a SQL injection vulnerability which allows an unauthenticated remote attacker to execute arbitrary SQL statements against the backend PostgreSQL database using a single crafted request, including database operations and remote code execution...

PT-2026-84595

Baserow 2.3.3 contains a SQL injection vulnerability in the index formula function. A low-privileged authenticated user who can create or modify formula fields can provide an undocumented fourth argument that is treated as a SQL template and interpolated directly into a PostgreSQL expression. The...

Important: Red Hat Security Advisory: postgresql security update

An update for postgresql is now available for Red Hat Enterprise Linux 9.6 Extended Update Support. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available...

postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation

A flaw was found in PostgreSQL. Uncontrolled recursion during SSL Secure Sockets Layer and GSS Generic Security Service negotiation allows an attacker to achieve a sustained denial of service. This can be exploited by an attacker with access to a PostgreSQL AFUNIX socket. If SSL and GSS are both...

Important: Red Hat Security Advisory: postgresql security update

An update for postgresql is now available for Red Hat Enterprise Linux 9.4 Update Services for SAP Solutions. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is...

postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation

A flaw was found in PostgreSQL. Uncontrolled recursion during SSL Secure Sockets Layer and GSS Generic Security Service negotiation allows an attacker to achieve a sustained denial of service. This can be exploited by an attacker with access to a PostgreSQL AFUNIX socket. If SSL and GSS are both...

Exploit for Integer Overflow or Wraparound in Postgresql

CVE-2026-14662 – Out-of-bounds write vulnerability in PostgreS...

CVE-2026-14672

An observable response discrepancy in PostgreSQL's SCRAM authentication permits user enumeration. Unauthenticated attackers can verify if a specific user exists by observing the authentication iteration count, provided the targeted user is configured with a non-default scramiterations value...

PostgreSQL 14.x < 14.24 / 15.x < 15.19 / 16.x < 16.15 / 18.x < 18.6 amcheck Untrusted Search Path

The version of PostgreSQL installed on the remote host is 14 prior to 14.24, 15 prior to 15.19, 16 prior to 16.15, or 18 prior to 18.6. As such, it is potentially affected by a privilege escalation vulnerability: - Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function...

PostgreSQL 16.x < 16.15 / 17.x < 17.11 / 18.x < 18.6 SCRAM Observable Response Discrepancy

The version of PostgreSQL installed on the remote host is 16 prior to 16.15, 17 prior to 17.11, or 18 prior to 18.6. As such, it is potentially affected by an information disclosure vulnerability: - Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user ...

PostgreSQL 14.x < 14.24 / 15.x < 15.19 / 16.x < 16.15 / 17.x < 17.11 / 18.x < 18.6 Multiple Vulnerabilities

The version of PostgreSQL installed on the remote host is 14 prior to 14.24, 15 prior to 15.19, 16 prior to 16.15, 17 prior to 17.11, or 18 prior to 18.6. As such, it is potentially affected by multiple vulnerabilities: - Type confusion with PostgreSQL 'internal' data type arguments allows any us...

openSUSE 16: postgresql15 / postgresql15-contrib / postgresql15-devel / etc (openSUSE-SU-2026:21700-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21700-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE...

VulnCheck KEV: CVE-2026-9586

An unauthenticated SQL injection vulnerability exists in Sangoma Switchvox SMB Edition 8.3 104997. The /pa endpoint processes XML content beginning with and directly concatenates the user-controlled PhoneIP value into PostgreSQL queries without sanitization or parameterization. An unauthenticated...

RHEL 9 : postgresql (RHSA-2026:62116)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:62116 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Denial of Service via...

PostgreSQL 17.x < 17.11 / 18.x < 18.6 GSSAPI Improper Message Integrity Enforcement

The version of PostgreSQL installed on the remote host is 17 prior to 17.11 or 18 prior to 18.6. As such, it is potentially affected by a security bypass vulnerability: - Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pghba.con...

openSUSE 16: postgresql16 / postgresql16-contrib / postgresql16-devel / etc (openSUSE-SU-2026:21701-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21701-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE...

PostgreSQL 18.x < 18.6 Multiple Vulnerabilities

The version of PostgreSQL installed on the remote host is 18 prior to 18.6. As such, it is potentially affected by multiple vulnerabilities: - Heap buffer overflow in PostgreSQL pgstatstatements allows the query author to execute arbitrary code as the operating system user running the database, v...

openSUSE 16: postgresql14 / postgresql14-contrib / postgresql14-devel / etc (openSUSE-SU-2026:21699-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21699-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE...

openSUSE 16: libecpg6 / libpq5 / postgresql18 / postgresql18-contrib / etc (openSUSE-SU-2026:21703-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21703-1 advisory. - CVE-2026-6464: psql COPY FROM STDIN early failure processes data lines as psql commands bsc1275046. - CVE-2026-6469: ALTER TABLE ALTER TYPE...

RHEL 9 : postgresql (RHSA-2026:62117)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:62117 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Denial of Service via...