RHEL 10 : postgresql18 (RHSA-2026:67280)

The remote Redhat Enterprise Linux 10 host has packages installed that are affected by multiple vulnerabilities as referenced in the RHSA-2026:67280 advisory. PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that...

ALSA-2026:67280 Important: postgresql18 security update

PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine a...

CVE-2026-90775

PostGIS addressstandardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the loadvalue array, causing the PostgreS...

DEBIAN-CVE-2026-90775

PostGIS addressstandardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the loadvalue array, causing the PostgreS...

CVE-2026-90775

PostGIS address_standardizer versions through 3.7.0 fail to validate the Weight parameter from caller-supplied rules tables before using it as an array index in the load_value array. Attackers with low privileges can craft malicious rule rows with out-of-range Weight values, triggering an out-of-...

CVE-2026-90775 PostGIS address_standardizer through 3.7.0 Out-of-Bounds Read via Unvalidated Rule Weight

PostGIS addressstandardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the loadvalue array, causing the PostgreS...

EUVD-2026-76997

PostGIS addressstandardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the loadvalue array, causing the PostgreS...

CVE-2026-90775 PostGIS address_standardizer through 3.7.0 Out-of-Bounds Read via Unvalidated Rule Weight

PostGIS addressstandardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the loadvalue array, causing the PostgreS...

CVE-2026-90775 PostGIS address_standardizer through 3.7.0 Out-of-Bounds Read via Unvalidated Rule Weight

PostGIS addressstandardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the loadvalue array, causing the PostgreS...

PT-2026-90844

Name of the Vulnerable Software and Affected Versions PostGIS address standardizer versions prior to 3.7.1 Description The address standardizer component fails to validate the Weight parameter provided in caller-supplied rules tables before utilizing it as an array index. This allows an attacker ...

Linux Distros Unpatched Vulnerability : CVE-2026-90775

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - PostGIS addressstandardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libpq (UTSA-2024-000296)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2024-000296 advisory. A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: libpq (UTSA-2023-002898)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2023-002898 advisory. IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct doll...

CVE-2026-90775: Out-of-bounds Read

PostGIS addressstandardizer through 3.7.0 fails to validate the Weight parameter from caller-supplied rules tables before using it as an array index. Attackers can craft malicious rule rows with out-of-range Weight values to trigger out-of-bounds reads in the loadvalue array, causing the PostgreS...

ROOT-APP-MAVEN-CVE-2025-49146 CVE-2025-49146 in org.postgresql:postgresql - Patched by Root

Root has patched CVE-2025-49146 in the org.postgresql:postgresql package for Root:Maven. Multiple fixed versions available...

CVE-2026-72708: Improper Neutralization of Special Elements used in an SQL Command

SPIP before 4.4.18 contains an unauthenticated blind SQL injection vulnerability in the SQL escaping layer that allows unauthenticated attackers to inject arbitrary SQL by supplying a crafted annee parameter value matching a word character followed by an open parenthesis, which bypasses escaping...

Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS : PHP vulnerabilities (USN-8743-1)

The remote Ubuntu 22.04 LTS / 24.04 LTS / 26.04 LTS / Pro Realtime 22.04 LTS / Pro Realtime 24.04 LTS host has packages installed that are affected by multiple vulnerabilities as referenced in the USN-8743-1 advisory. It was discovered that PHP incorrectly handled backslash escaping in the...

jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication

A flaw was found in pgjdbc, an open-source PostgreSQL JDBC Driver. A malicious server can exploit this vulnerability by instructing the driver to perform SCRAM-SHA-256 Salted Challenge Response Authentication Mechanism Secure Hash Algorithm 256 authentication with an excessively large iteration...

USN-8743-1: PHP vulnerabilities

It was discovered that PHP incorrectly handled backslash escaping in the PostgreSQL extension. An attacker could use this issue to perform SQL injection attacks. CVE-2026-17543 It was discovered that PHP incorrectly handled certain inputs to the bccomp function. An attacker could use this issue t...

USN-8743-1 php8.1, php8.3, php8.5 vulnerabilities

It was discovered that PHP incorrectly handled backslash escaping in the PostgreSQL extension. An attacker could use this issue to perform SQL injection attacks. CVE-2026-17543 It was discovered that PHP incorrectly handled certain inputs to the bccomp function. An attacker could use this issue t...