CVE-2026-74891: Use of Hard-coded Credentials

opensslencrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...

CVE-2026-64657: Improper Neutralization of Special Elements used in an SQL Command

Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET searchpath statement without escaping embedded double quotes, allowing an...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099517)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099517 advisory. Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocati...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099479)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099479 advisory. Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use searchpath to find user-defined types, including...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099466)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099466 advisory. Untrusted data inclusion in pgdump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099467)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099467 advisory. Use of inherently dangerous function PQfn..., resultisint=0, ... in PostgreSQL libpq loexport, loread, lolseek64, and lotell64 functions allows the server superuser ...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099525)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099525 advisory. Externally-controlled format string in PostgreSQL timeofday function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099502)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099502 advisory. Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operati...

PT-2026-76627

openssl encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099465)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099465 advisory. Improper validation of type oidvector in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of attacks that...

Unity Linux 20.1070a Security Update: libpq (UTSA-2026-099548)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099548 advisory. Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds...

Unity Linux 20.1070a Security Update: libpq (UTSA-2026-099550)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099550 advisory. Use of inherently dangerous function PQfn..., resultisint=0, ... in PostgreSQL libpq loexport, loread, lolseek64, and lotell64 functions allows the server superuser ...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099513)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099513 advisory. Symlink following in PostgreSQL pgbasebackup plain format and in pgrewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099509)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099509 advisory. Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds...

Unity Linux 20.1070e Security Update: python-django (UTSA-2026-099460)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099460 advisory. An issue was discovered in 5.2 before 5.2.9, 5.1 before 5.1.15, and 4.2 before 4.2.27. FilteredRelation is subject to SQL injection in column aliases, using a suitab...

Unity Linux 20.1070a Security Update: libpq (UTSA-2026-099547)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099547 advisory. Symlink following in PostgreSQL pgbasebackup plain format and in pgrewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099526)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099526 advisory. Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions before...

PostgreSQL: Multiple Vulnerabilities

Background PostgreSQL is an open source object-relational database management system. Description Multiple vulnerabilities have been discovered in PostgreSQL. Please review the CVE identifiers referenced below for details. Impact Please review the referenced CVE identifiers for details. Workaroun...

Unity Linux 20.1070a Security Update: postgresql-jdbc (UTSA-2026-099549)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099549 advisory. pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during...

Unity Linux 20.1070a Security Update: libpq (UTSA-2026-099554)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099554 advisory. Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. Th...