ROS-20260706-73-0056

The vulnerability of the ALTER SUBSCRIPTION...REFRESH PUBLICATION command in PostgreSQL database management systems lies in the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

ROS-20260706-73-0046

The vulnerability of the refint module in the PostgreSQL database management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

ROS-20260706-73-0047

The vulnerability of the refint module in the PostgreSQL database management system is related to the lack of measures taken to protect the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...

ROS-20260706-73-0029

The vulnerability of the pgbasebackup and pgrewind utilities in the PostgreSQL database management system is related to deficiencies in the mechanism for handling symbolic references. Exploiting this vulnerability allows a malicious actor to rewrite any files remotely...

ROS-20260706-73-0028

The vulnerability of the pgbasebackup and pgrewind utilities in the PostgreSQL database management system is related to deficiencies in the mechanism for handling symbolic references. Exploiting this vulnerability allows a malicious actor to rewrite any files remotely...

ROS-20260706-73-0004

The vulnerability of the pgcreatesubscriber function in the PostgreSQL database management system is related to the lack of protective measures for the SQL query structure. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

ROS-20260706-73-0057

The vulnerability of the ALTER SUBSCRIPTION...REFRESH PUBLICATION command in PostgreSQL database management systems lies in the lack of protective measures for SQL query structures. Exploiting this vulnerability allows a malicious actor to execute arbitrary SQL queries remotely...

ROS-20260706-73-0034

The vulnerability of the negotiation mechanisms for SSL and GSS in the PostgreSQL database management system is related to an uncontrolled recursion. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service interruptions...

ROS-20260706-73-0038

The vulnerability of the negotiation mechanisms for SSL and GSS in the PostgreSQL database management system is related to an uncontrolled recursion. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service interruptions...

ROS-20260706-73-0039

The vulnerability of the negotiation mechanisms for SSL and GSS in the PostgreSQL database management system is related to an uncontrolled recursion. Exploiting this vulnerability can allow a malicious actor, operating remotely, to cause service interruptions...

ROS-20260706-73-0027

The vulnerability of the pgbasebackup and pgrewind utilities in the PostgreSQL database management system is related to deficiencies in the mechanism for handling symbolic references. Exploiting this vulnerability allows a malicious actor to rewrite any files remotely...

CVE-2026-42153: Improper Neutralization of Special Elements used in an OS Command

Coolify is an open-source and self-hostable tool for managing servers, applications, and databases. Prior to 4.0.0-beta.474, PostgreSQL healthcheck command generation used attacker-controlled database settings postgresuser and postgresdb in shell-form commands, allowing an authenticated user to...

ROS-20260706-73-0005

The vulnerability of the pgrestoreattributestats function in the PostgreSQL database management system is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information that is protected by this function...

ROS-20260706-73-0006

The vulnerability of the pgrestoreattributestats function in the PostgreSQL database management system is related to reading beyond the buffer boundaries in memory. Exploiting this vulnerability can allow a malicious actor to disclose sensitive information that is protected by this function...

Langroid: SQLChatAgent _validate_query blocklist misses pg_read_file family enabling arbitrary file read

Summary SQLChatAgent in langroid ships a validatequery defense-in-depth layer whose DANGEROUSSQLPATTERNS regex blocklist enumerates dangerous SQL primitives by specific function name. The list misses the canonical PostgreSQL filesystem-disclosure family pgreadfile, pgstatfile, pglslogdir,...

RHSA-2026:34363 Red Hat Security Advisory: postgresql:13 security update

Bulletin has no description...

RHSA-2026:34362 Red Hat Security Advisory: postgresql:12 security update

Bulletin has no description...

AlmaLinux 9 : postgresql:15 (ALSA-2026:28037)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:28037 advisory. postgresql: PostgreSQL: Operating system account hijack via symlink following in pgbasebackup and pgrewind CVE-2026-6475 postgresql: PostgreSQL libpq:...

AlmaLinux 9 : postgresql:16 (ALSA-2026:26203)

The remote AlmaLinux 9 host has packages installed that are affected by multiple vulnerabilities as referenced in the ALSA-2026:26203 advisory. postgresql: PostgreSQL: Operating system account hijack via symlink following in pgbasebackup and pgrewind CVE-2026-6475 postgresql: PostgreSQL libpq:...

AlmaLinux 9 : postgresql-jdbc (ALSA-2026:22304)

The remote AlmaLinux 9 host has a package installed that is affected by a vulnerability as referenced in the ALSA-2026:22304 advisory. jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication CVE-2026-42198 Tenable has extracted the preceding descripti...