RHEL 8 : postgresql-jdbc (RHSA-2026:52978)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:52978 advisory. PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs...

RHEL 10 : postgresql-jdbc (RHSA-2026:52928)

The remote Redhat Enterprise Linux 10 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:52928 advisory. PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java program...

RHEL 9 : postgresql (RHSA-2026:52395)

The remote Redhat Enterprise Linux 9 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2026:52395 advisory. PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Denial of Service via...

Photon OS 5.0: Postgresql13 PHSA-2025-5.0-91-0490

An update of the postgresql13 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-91-0490. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

Important: postgresql security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation CVE-2026-6479 For more details about the security issues, including the impact, a CVSS score, acknowledgments, a...

Important: postgresql:12 security update

PostgreSQL is an advanced object-relational database management system DBMS. Security Fixes: postgresql: PostgreSQL: Denial of Service via uncontrolled recursion in SSL/GSS negotiation CVE-2026-6479 For more details about the security issues, including the impact, a CVSS score, acknowledgments, a...

RHEL 9 : postgresql-jdbc (RHSA-2026:52930)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:52930 advisory. PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs...

Photon OS 5.0: Postgresql13 PHSA-2024-5.0-91-0419

An update of the postgresql13 package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2024-5.0-91-0419. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

RHEL 9 : postgresql-jdbc (RHSA-2026:52929)

The remote Redhat Enterprise Linux 9 host has a package installed that is affected by a vulnerability as referenced in the RHSA-2026:52929 advisory. PostgreSQL is an advanced object-relational database management system. The postgresql-jdbc package includes the .jar files needed for Java programs...

[SECURITY] Fedora 43 Update: pgadmin4-9.17-1.fc43

pgAdmin is the most popular and feature rich Open Source administration and d evelopment platform for PostgreSQL, the most advanced Open Source database in the world...

[SECURITY] Fedora 44 Update: pgadmin4-9.17-1.fc44

pgAdmin is the most popular and feature rich Open Source administration and d evelopment platform for PostgreSQL, the most advanced Open Source database in the world...

LiteLLM CVE-2026-42208 Blind SQLi Detect

Detects CVE-2026-42208 in BerriAI LiteLLM 1.81.16 = version 1.83.7: failed-auth logging passes the raw Authorization bearer into a virtual-key SQL lookup. Probes POST /v1/chat/completions with x'-prefixed pgsleep payloads never sk- and requires delay scaling plus a fast sk- control to rule out...

LiteLLM Pre-Auth Blind SQLi (CVE-2026-42208)

CVE-2026-42208 in BerriAI LiteLLM 1.81.16 = version 1.83.7: the proxy virtual-key lookup builds SQL with WHERE v.token = 'token' and interpolates the raw bearer from failed auth logging. Inject via Authorization on LLM routes must NOT start with sk-. Calibrates timing, confirms pgsleep scales, th...

K000162806: PostgreSQL vulnerability CVE-2026-6472

Security Advisory Description Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use searchpath to find user-defined types, including extension-defined types. That is to say, the victim will execute arbitrary SQL functions of the attacker's choic...

Security Bulletin: Multiple Vulnerabilities in IBM Operator for PostgreSQL

Summary Multiple vulnerabilities were addressed in IBM Operator for PostgreSQL version v28.4.2. Vulnerability Details CVEID:CVE-2026-13757 DESCRIPTION: A flaw was found in p11-kit. The RPC message attribute parsing functions p11rpcmessagegetattribute and p11rpcmessagegetattributearrayvalue form a...

openSUSE 16: apache2-mod_php8 / php8 / php8-bcmath / php8-bz2 / php8-calendar / etc (openSUSE-SU-2026:21532-1)

The remote openSUSE 16 host has packages installed that are affected by multiple vulnerabilities as referenced in the openSUSE-SU-2026:21532-1 advisory. This update for php8 fixes the following issues - Update to version 8.4.24 - CVE-2026-7260: Stack overflow in phar with circular symlinks...

LangGraph: Namespace prefix matching crosses segment boundaries in Postgres and SQLite stores

Summary The Postgres and SQLite stores persist hierarchical namespaces as a dot-joined string "memories", "alice" becomes memories.alice and scoped reads by matching that string with LIKE '%'. Because LIKE has no notion of the . separator, a scoped search or listnamespaces also matched sibling...

CVE-2026-48080 OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deployment

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the GET /api/tenants/id endpoint returns the full tenant record to any authenticated TENANTADMIN of that tenant, including the databaseUrl field. This field contains...

CVE-2026-48080

OpenReception OpenReception’s appointment-booking software (before v1.0.2) exposed a live PostgreSQL connection string via GET /api/tenants/{id} to any TENANT_ADMIN, including the databaseUrl containing the instance-wide superuser credentials and plaintext password. This allowed cross-tenant acce...

CVE-2026-48080 OpenReception's tenant detail endpoint discloses live PostgreSQL connection string, superuser-scoped in the tested official deployment

OpenReception's appointment booking software provides an end-to-end encrypted appointment booking platform. Prior to version 1.0.2, the GET /api/tenants/id endpoint returns the full tenant record to any authenticated TENANTADMIN of that tenant, including the databaseUrl field. This field contains...