CVE-2026-82039 UTMStack < 11.2.16 SQL Injection via searchGroupsByFilter

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query via String.forma...

EUVD-2026-91790

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query via String.forma...

CVE-2026-82039 UTMStack < 11.2.16 SQL Injection via searchGroupsByFilter

UTMStack before 11.2.16 contains a SQL injection vulnerability in UtmAssetGroupService.searchQueryBuilder that allows authenticated attackers to inject arbitrary SQL by supplying malicious assetType and groupName values that are inserted unsanitized into a native PostgreSQL query via String.forma...

ROS-20261002-73-0074

The vulnerability of the functions for working with the tsvector and tsquery data types in the PostgreSQL database management system is related to integer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

ROS-20261002-73-0091

The vulnerability of the ascii function in the PostgreSQL database management system is related to reading data beyond the allowed range of memory. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

ROS-20261002-73-0029

The vulnerabilities of the levenshtein and levenshteinlessequal functions in the fuzzystrmatch database extension of the PostgreSQL database management system are related to integer overflow. Exploiting these vulnerabilities could allow an attacker to execute arbitrary code...

ROS-20261002-73-0068

The vulnerability of regular expression functions in the PostgreSQL database management system is related to buffer overflows in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20261002-73-0060

The vulnerability of the PL/Per extension interface of the PostgreSQL database management system is related to buffer overflows in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

CVE-2026-104055: Insertion of Sensitive Information into Log File

The postgresql-operator charm runs a Prometheus postgresexporter to collect database metrics using a dedicated "monitoring" PostgreSQL user. On database connection errors, the exporter writes the monitoring user's password in cleartext to its logs. Any actor able to read those logs can recover th...

ROS-20261002-73-0073

The vulnerability of the functions for working with the tsvector and tsquery data types in the PostgreSQL database management system is related to integer overflow. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

ROS-20261002-73-0035

The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...

ROS-20261002-73-0009

The vulnerability of the psql utility in the PostgreSQL database management system lies in the inclusion of functions from an unverified and uncontrolled area. Exploiting this vulnerability allows a malicious actor to execute arbitrary commands remotely...

ROS-20261002-73-0001

The vulnerability of the logical decoding mechanism in the PostgreSQL database management system is related to the lack of authentication. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

ROS-20261002-73-0018

The vulnerability of the pgdump utility in the PostgreSQL database management system is related to the lack of measures taken to neutralize special elements in the output data. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20261002-73-0059

The vulnerability of the PL/Per extension interface of the PostgreSQL database management system is related to buffer overflows in dynamic memory. Exploiting this vulnerability allows a remote attacker to execute arbitrary code...

ROS-20261002-73-0061

The vulnerability of the data selection evaluator in PostgreSQL database management systems is related to incorrect session duration. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

ROS-20261002-73-0062

The vulnerability of the data selection evaluator in PostgreSQL database management systems is related to incorrect session duration. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

ROS-20261002-73-0064

The vulnerability of the data selection evaluator in PostgreSQL database management systems is related to incorrect session duration. Exploiting this vulnerability can allow an attacker to disclose sensitive information...

ROS-20261002-73-0025

The vulnerability of the PostgreSQL database management system is related to errors in data type mixing. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

ROS-20261002-73-0034

The vulnerability of the EXTRACT function in the PostgreSQL database management system is related to the lack of protective measures for SQL query structures. Exploiting this vulnerability allows an attacker who operates remotely to execute arbitrary code...