CVE-2026-20253

CVE-2026-20253 — Splunk Enterprise Pre-Auth RCE Lab Unauthenticated Arbitrary File Creation and Truncation via PostgreSQL Sidecar CVSS 9.8 · Critical · CWE-306 · Actively exploited CISA KEV ⚠️ Disclaimer This repository is intended strictly for educational and authorised security research purposes...

Astra Linux – Vulnerability in PostgresSQL 11

When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject arbitrary SQL queries during the initial establishment of a connection, despite the use of SSL certificate verification and encryption...

Astra Linux – Vulnerability in PostgresSQL 11

A man-in-the-middle attacker can inject false responses to the client’s first few queries, despite the use of SSL certificate verification and encryption...

Astra Linux – Vulnerability in Sogo

Before version 5.12.7, when PostgreSQL was used, SOGo allowed SQL injection attacks...

Astra Linux – Vulnerability in PHP 7.3

In PHP versions 7.4.x below 7.4.30, 8.0.x below 8.0.20, and 8.1.x below 8.1.7, when using the Postgres database extension, providing invalid parameters to the parameterized query may cause PHP to attempt to free memory by using uninitialized data as pointers. This could lead to a RCE vulnerabilit...

Astra Linux – Vulnerability in libpgjava

pgjdbc is the official PostgreSQL JDBC Driver. A security flaw was discovered in the JDBC driver for the postgresql database during security research. Systems that use the postgresql library will be vulnerable when an attacker controls the JDBC URL or connection properties. pgjdbc creates plugin...

Astra Linux – Vulnerability in libpgjava

The PostgreSQL JDBC Driver also known as PgJDBC prior to version 42.2.13 allowed XXE...

Astra Linux – Vulnerability in PostgresSQL 11

A flaw was discovered in PostgreSQL versions prior to 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20, and before 9.5.24. If a client application that creates additional database connections only reuses the basic connection parameters while dropping security-relevant parameters, ther...

[SECURITY] Fedora 45 Update: postgresql19-19beta1-6.fc45

PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine a...

[SECURITY] Fedora 45 Update: postgresql18-postgis-3.6.4-6.fc45

PostGIS adds support for geographic objects to the PostgreSQL object-relation al database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic informati on systems GIS, much like ESRI's SDE or Oracle's Spatial extension...

[SECURITY] Fedora 45 Update: postgresql18-18.3-12.fc45

PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine a...

[SECURITY] Fedora 45 Update: postgresql17-postgis-3.6.4-6.fc45

PostGIS adds support for geographic objects to the PostgreSQL object-relation al database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic informati on systems GIS, much like ESRI's SDE or Oracle's Spatial extension...

[SECURITY] Fedora 45 Update: postgresql17-17.9-10.fc45

PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine a...

[SECURITY] Fedora 45 Update: postgresql16-postgis-3.6.4-6.fc45

PostGIS adds support for geographic objects to the PostgreSQL object-relation al database. In effect, PostGIS "spatially enables" the PostgreSQL server, allowing it to be used as a backend spatial database for geographic informati on systems GIS, much like ESRI's SDE or Oracle's Spatial extension...

[SECURITY] Fedora 45 Update: postgresql16-16.14-5.fc45

PostgreSQL is an advanced Object-Relational database management system DBMS. The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine a...

[SECURITY] Fedora 45 Update: pgmodeler-1.2.2-4.fc45

PostgreSQL Database Modeler, or simply, pgModeler is an open source tool for modeling databases that merges the classical concepts of entity-relationship diagrams with specific features that only PostgreSQL implements. The pgModeler translates the models created by the user to SQL code and apply...

CVE-2026-104055

The postgresql-operator charm runs a Prometheus postgresexporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover th...

CVE-2026-104055 Monitoring-user password logged in cleartext by postgres_exporter in postgresql VM charm

The postgresql-operator charm runs a Prometheus postgresexporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover th...

CVE-2026-104055

The postgresql-operator charm contains a vulnerability where the Prometheus postgres_exporter writes the monitoring user's password in cleartext to its logs during database connection errors. An attacker with log-reading permissions can recover this password to gain read-only pg_monitor access to...

EUVD-2026-91803

The postgresql-operator charm runs a Prometheus postgresexporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover th...