The vulnerability of the data selection evaluator type ctid in the PostgreSQL database management system relates to an incorrect session expiration time, allowing an attacker to disclose protected information.

The vulnerability of the data selection evaluator type “ctid” in the PostgreSQL database management system is related to an incorrect session duration. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information...

The vulnerability of the EXTRACT() function in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

The vulnerability of the ALTER TABLE ALTER TYPE command in the PostgreSQL database management system allows a hacker to gain unauthorized access to delete or modify data.

The vulnerability of the ALTER TABLE/ALTER TYPE command in the PostgreSQL database management system is related to deficiencies in access control. Exploiting this vulnerability could allow an attacker to gain unauthorized access to delete or modify data...

The vulnerability of regular expression functions in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of regular expression functions in the PostgreSQL database management system is related to buffer overflows in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

The vulnerability of the PostgreSQL database management system, related to buffer overflows in dynamic memory, allows attackers to execute arbitrary code or cause service interruptions.

The vulnerability of the PostgreSQL database management system is related to overflow in the buffer of dynamic memory. Exploiting this vulnerability allows an attacker to execute arbitrary code or cause a service failure...

The vulnerability of the psql utility in the PostgreSQL database management system allows a hacker to execute arbitrary commands.

The vulnerability of the psql utility in the PostgreSQL database management system lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

CVE-2026-76635: Improper Neutralization of Special Elements used in an SQL Command

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations...

The vulnerability of the SCRAM authentication subsystem in the PostgreSQL database management system allows a hacker to disclose sensitive information that is protected by this system.

The vulnerability of the SCRAM authentication subsystem in the PostgreSQL database management system is related to inconsistencies in the responses to incoming requests. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

The vulnerability of the PostgreSQL database management system, related to errors in data type mixing, allows a hacker to execute arbitrary code.

The vulnerability of the PostgreSQL database management system is related to errors in data type mixing. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the PostgreSQL database management system, related to errors in data type mixing, allows a hacker to execute arbitrary code.

The vulnerability of the PostgreSQL database management system is related to errors in data type mixing. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the functions for working with the tsvector and tsquery data types in the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the functions for working with the tsvector and tsquery data types in the PostgreSQL database management system is related to integer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

The vulnerability of the GSSAPI component of the PostgreSQL database management system, related to data type mixing errors, allows attackers to perform “man-in-the-middle” attacks.

The vulnerability of the GSSAPI component in the PostgreSQL database management system is related to the lack of integrity checks during the transmission of messages through the communication channel. Exploiting this vulnerability allows a malicious actor to carry out “man-in-the-middle” attacks...

The vulnerability of the ascii() function in the PostgreSQL database management system allows attackers to disclose sensitive information.

The vulnerability of the ascii function in the PostgreSQL database management system is related to reading data beyond the allowed range of memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

The vulnerability of the amcheck extension in the PostgreSQL database management system allows a hacker to enhance their privileges and execute arbitrary code.

The vulnerability of the amcheck extension in the PostgreSQL database management system is related to the use of an insecure search path. Exploiting this vulnerability allows a malicious actor to enhance their privileges and execute arbitrary code by manipulating the searchpath parameter...

The vulnerabilities of the levenshtein() and levenshtein_less_equal() functions, which are extensions to the fuzzystrmatch function in the PostgreSQL database management system, allow attackers to execute arbitrary code.

The vulnerability of the levenshtein and levenshteinlessequal functions in the fuzzystrmatch database extension of the PostgreSQL database management system is related to integer overflow. Exploiting this vulnerability could allow a malicious actor to execute arbitrary code...

The vulnerability of the logical decoding mechanism of the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of the logical decoding mechanism in the PostgreSQL database management system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

CVE-2026-55769: Untrusted Search Path

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG opened superuser connections without pinning searchpath in fillDefaultParameters in pkg/management/postgres/pool/profiles.go. A role holding DATABASE OWNER...

CVE-2026-55765: Plaintext Storage of a Password

CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments. Prior to 1.28.4 and 1.29.2, CloudNativePG embedded cleartext role passwords in ALTER ROLE and CREATE ROLE statements generated by SetUserPassword in pkg/management/postgres/utils/roles.go and...

PT-2026-79023

baserCMS before 5.3.0 contains a SQL injection vulnerability in BcDatabaseService.php that allows authenticated administrators to inject attacker-controlled table names and configuration values directly into SQL statements across sequence update, CSV export, and table management operations...

The vulnerability of PL/Tcl and PL/Perl extensions of the PostgreSQL database management system allows a hacker to execute arbitrary code.

The vulnerability of PL/Tcl and PL/Perl extensions of the PostgreSQL database management system is related to integer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...