CVE-2026-61821: Missing Authorization

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, droppartitionid and droppartitiontime use partconfig.retentionschema as the target for ALTER TABLE SET SCHEMA and accept any nonempty schema name. A role with partmanuser access can select a target...

CVE-2026-61819: Improper Neutralization of Special Elements used in an SQL Command

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, when pgjobmon is installed and partconfig.jobmon is true, exception handlers in multiple pgpartman functions place pparenttable verbatim inside a SQL string literal used to call pgjobmon.addjob. A...

CVE-2026-61817: Improper Neutralization of Special Elements used in an SQL Command

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, runmaintenance, showpartitions, showpartitioninfo, undopartition, and partitiondatatime interpolate the writable partconfig.timedncoder text value without identifier quoting into dynamic SQL. A role...

CVE-2026-61818: Improper Neutralization of Special Elements used in an SQL Command

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, undopartition reads partconfig.timeencoder as unrestricted text and interpolates it without identifier quoting into a dynamically executed SELECT statement. A role with partmanuser access can store...

CVE-2026-61820: Improper Neutralization of Special Elements used in an SQL Command

pgpartman is a PostgreSQL extension that manages partitioned tables by time or ID. Prior to 5.5.0, inherittemplateproperties manually surrounds primary-key column names from pgattribute.attname with double quotes without escaping embedded double-quote characters. A partmanuser who owns a template...

MiracleLinux 9 : postgresql:16 (AXSA:2026-1882:01)

The remote MiracleLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the AXSA:2026-1882:01 advisory. postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions CVE-2026-14662 postgresql: PostgreSQL:...

CVE-2026-85878

CVE-2026-85878 is an improper authorization vulnerability in Azure Database for PostgreSQL that allows an authorized attacker to elevate privileges over a network. Microsoft's CNA rates it CVSS 3.1 9.9 (CRITICAL) with a vector of AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H, indicating a low-complexity ne...

CVE-2026-53556

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled tablename value into generated SQL without safe identifier handling...

CVE-2026-53557

SQLBot , an intelligent Text-to-SQL system built on LLMs and RAG, contains a second-order SQL injection in its Excel datasource handling. Prior to 1.9.0 , an authenticated user can supply a crafted sheet["tableName"] value via POST /api/v1/datasource/, which is stored without safe identifier hand...

CVE-2026-53557 SQLBot: Second-Order SQL Injection via Excel Datasource Leading to Remote Command Execution

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, an authenticated user can supply a crafted sheet"tableName" value in the Excel datasource configuration submitted through POST /api/v1/datasource/, and SQLBot stores that value without safe...

CVE-2026-53556 SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled tablename value into generated SQL without safe identifier handling...

CVE-2026-53556

SQLBot , an intelligent Text-to-SQL system, is vulnerable to authenticated SQL injection in the POST /api/v1/datasource/previewData endpoint (prior to v1.9.0 ). The client-controlled table_name parameter is incorporated into generated SQL without safe identifier handling. An authenticated user ca...

CVE-2026-53556 SQLBot: Authenticated SQL Injection in previewData Resulting in Arbitrary File Read

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled tablename value into generated SQL without safe identifier handling...

CVE-2026-54354 MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query Translation

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gmltype=Integer are configured, b...

CVE-2026-54354 MapServer: PostGIS Numeric Filter Value SQL Injection in MapServer Runtime Query Translation

MapServer is a system for developing web-based GIS applications. Prior to 8.6.4, MapServer's PostGIS runtime filter translation in src/mappostgis.cpp and msPostGISLayerTranslateFilter treats a filteritem as numeric when CONNECTIONTYPE POSTGIS and metadata such as gmltype=Integer are configured, b...

Azure Database for PostgreSQL Elevation of Privilege Vulnerability

Improper authorization in Azure Database for PostgreSQL allows an authorized attacker to elevate privileges over a network...

ROOT-APP-MAVEN-CVE-2024-1597 CVE-2024-1597 in org.postgresql:postgresql - Patched by Root

Root has patched CVE-2024-1597 in the org.postgresql:postgresql package for Root:Maven. Multiple fixed versions available...

ROOT-APP-MAVEN-CVE-2022-41946 CVE-2022-41946 in org.postgresql:postgresql - Patched by Root

Root has patched CVE-2022-41946 in the org.postgresql:postgresql package for Root:Maven. Multiple fixed versions available...

CVE-2026-53556: Improper Neutralization of Special Elements used in an SQL Command

SQLBot is an intelligent Text-to-SQL system based on large language models and RAG. Prior to 1.9.0, the POST /api/v1/datasource/previewData endpoint in backend/apps/datasource/crud/datasource.py incorporates the client-controlled tablename value into generated SQL without safe identifier handling...

PT-2026-95183

Name of the Vulnerable Software and Affected Versions Azure Database for PostgreSQL affected versions not specified Description Improper authorization allows an authorized attacker to elevate privileges over a network. Recommendations At the moment, there is no information about a newer version...