CVE-2026-76601

Fabrik is a Joomla extension developed by fabrikar.com. In versions prior to 4.7.2 , the order plugin did not perform any access checks, allowing unauthenticated row reordering of data. An attacker can exploit this over the network without credentials or user interaction to alter the ordering of ...

EUVD-2026-64315

Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik 4.7.2 - The order plugin did not perform any access checks...

CVE-2026-76601 Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik < 4.7.2

Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik 4.7.2 - The order plugin did not perform any access checks...

PT-2026-79577

Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik 4.7.2 - The order plugin did not perform any access checks...

CVE-2026-76601: Improper Access Control

Joomla Extension - fabrikar.com - Unauthenticated row reordering in Fabrik 4.7.2 - The order plugin did not perform any access checks...

CVE-2026-76603: Improper Access Control

Joomla Extension - fabrikar.com - Unauthenticated row disclosure via form.inlineedit in Fabrik 4.7.2 - The inineedit form controller does not perform any access checks, disclosing items to unauthorized users...

USN-8653-1 postgresql-14, postgresql-16, postgresql-18 vulnerabilities

It was discovered that PostgreSQL incorrectly handled COPY FROM STDIN when an early failure occurred. An authenticated user could possibly use this issue to execute arbitrary SQL commands. CVE-2026-6464 It was discovered that PostgreSQL incorrectly reset extended statistics ownership during ALTER...

USN-8653-1: PostgreSQL vulnerabilities

It was discovered that PostgreSQL incorrectly handled COPY FROM STDIN when an early failure occurred. An authenticated user could possibly use this issue to execute arbitrary SQL commands. CVE-2026-6464 It was discovered that PostgreSQL incorrectly reset extended statistics ownership during ALTER...

EUVD-2026-62577

Wazuh is a free and open source platform used for threat prevention, detection, and response. From 4.6.0 until 4.14.6 and 5.0.0-beta3, DB::getFile and DB::searchFile in src/syscheckd/src/db/src/file.cpp concatenate a monitored file path into SQLite row filters. On non-Windows systems,...

BIT-POSTGRESQL-2026-14666 PostgreSQL row security caching disregards role modifications

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates t...

Froxlor: Credential and 2FA secret disclosure via Froxlor API endpoints

Summary Several Froxlor API command classes return sensitive authentication material in JSON API responses. The affected endpoints retrieve full database rows using SELECT , SELECT alias., or equivalent full-row queries, then return the results directly through $this-response... without removing...

GO-2026-6171 WITHDRAWN: Malformed RowDescription and DataRow messages cause panics in github.com/lib/pq

This report has been withdrawn with reason: "Report mistakenly added without having CVE / GHSA associated". github.com/lib/pq decodes attacker-controlled RowDescription and DataRow payloads without validating their structural relationship or encoded value widths required by binary decoders. A...

PT-2026-77286

Lemur manages TLS certificate creation. Prior to 1.9.3, POST /api/1/certificates/upload allowed a non-read-only user to create a duplicate row using another certificate body, authority id, serial, or external id without requiring permission on the underlying authority. PUT...

ANT-2026-9R51NPJC · c-blosc2 · Heap Buffer Overflow

heap-buffer-overflow high Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Trail of Bits. ANT-2026-9R51NPJC: Heap buffer overflow in NDLZ8 triple-mat...

Unity Linux 20.1050e / 20.1060e / 20.1070e Security Update: postgresql (UTSA-2026-099449)

The Unity Linux 20 host has a package installed that is affected by a vulnerability as referenced in the UTSA-2026-099449 advisory. PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access. Separately, statistics allow a user to read sampled data...

PostgreSQL row security caching disregards role modifications

...

SUSE CVE-2026-14666

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates t...

Improper Preservation of Consistency Between Independent Representations of Shared State

Overview Affected versions of this package are vulnerable to Improper Preservation of Consistency Between Independent Representations of Shared State due to incomplete tracking of changes in role membership, role attributes, and database ownership in the plan reuse process. An attacker can access...

CVE-2026-14666

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates t...

ALPINE-CVE-2026-14666

Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates t...