CVE-2026-65013-BOLA-IDOR

CVE-2026-65013-BOLA-IDOR Reproducible PoC ofBOLA / IDOR in the tRPC API of Onlook CVE-2026-65013. Any authenticated user can read, modify, and delete projects, members, and AI history of other users just by passing their UUIDs to the tRPC procedures versions = 0.2.32. | ---|--- CVE| CVE-2026-6501...

postgresql: PostgreSQL: Row-level security bypass via INSERT ON CONFLICT DO UPDATE

A flaw was found in PostgreSQL. An authenticated database user with table modification privileges can bypass Row-Level Security RLS policies, leading to unauthorized information disclosure. By executing iterated INSERT ... ON CONFLICT DO UPDATE statements, an attacker can read protected rows that...

postgresql: postgresql: row-level security bypass via DROP OWNED

A flaw was found in PostgreSQL. An authenticated database user can execute the DROP OWNED command to improperly remove their role from restrictive Row-Level Security RLS policies. By bypassing these access controls, the user can view or modify table rows that were intended to be restricted...

CVE-2026-120154

A flaw was found in PostgreSQL. An authenticated database user with table modification privileges can bypass Row-Level Security RLS policies, leading to unauthorized information disclosure. By executing iterated INSERT ... ON CONFLICT DO UPDATE statements, an attacker can read protected rows that...

CVE-2026-116311

A flaw was found in PostgreSQL. An authenticated database user can execute the DROP OWNED command to improperly remove their role from restrictive Row-Level Security RLS policies. By bypassing these access controls, the user can view or modify table rows that were intended to be restricted...

DEBIAN-CVE-2026-116311

Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries after the DROP OWNED. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are...

CVE-2026-116311

Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries after the DROP OWNED. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are...

ALPINE-CVE-2026-116311

Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries after the DROP OWNED. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are...

CVE-2026-116311

PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25 are vulnerable to a missing authorization flaw in the DROP OWNED command. This issue allows a role to remove itself from restrictive row-level security (RLS) policies on tables it does not own. By performing this action, a user can...

CVE-2026-116311 PostgreSQL DROP OWNED can remove restrictive row security policies from non-owned tables

Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries after the DROP OWNED. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are...

EUVD-2026-124491

Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries after the DROP OWNED. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are...

CVE-2026-116311

Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries after the DROP OWNED. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are...

CVE-2026-116311

Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries after the DROP OWNED. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are...

CVE-2026-116311: n/a PostgreSQL: Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security…

Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries after the DROP OWNED. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are...

Vulnerability in core server (CVE-2026-116311)

PostgreSQL DROP OWNED can remove restrictive row security policies from non-owned tables Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries...

PT-2026-145802

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 18.7 PostgreSQL versions prior to 17.12 PostgreSQL versions prior to 16.16 PostgreSQL versions prior to 15.20 PostgreSQL versions prior to 14.25 Description Missing authorization in the DROP OWNED command allows a...

CLSA-2026-1792796702 postgresql: Fix of 6 CVEs

CVE-2026-14678: fix out-of-bounds read in pgtrgm's GiST picksplit function with all-true signatures - CVE-2026-6470: require USAGE privilege on the subtype in CREATE TYPE AS RANGE, on the composite type in ALTER TABLE OF, and on the types used by stored expressions defaults, constraints, indexes,...

CVE-2026-115453

Authorization Bypass Through User-Controlled Key CWE-639 in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of any other user, because cartRepository.delete, cartRepository.updateQuantityInternal...

CVE-2026-115453 Cross user deletion and modification of cart and wishlist rows in Ecommerce Template through unscoped primary key queries

Authorization Bypass Through User-Controlled Key CWE-639 in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of any other user, because cartRepository.delete, cartRepository.updateQuantityInternal...

EUVD-2026-108213

Authorization Bypass Through User-Controlled Key CWE-639 in the cart and wishlist repositories of MarcosCamara01 Ecommerce Template allows any authenticated user to delete and modify the cart and wishlist rows of any other user, because cartRepository.delete, cartRepository.updateQuantityInternal...