SUSE-SU-2026:22149-1 Security update for postgresql17

This update for postgresql17 fixes the following issues Security issues: - CVE-2026-6472: ensure the user has CREATE privilege on the schema specified bsc1265172. - CVE-2026-6473: integer overflows in memory-allocation calculations bsc1265173. - CVE-2026-6474: Guard against malicious time zone...

NPM: n8n: Microsoft SQL Node Prototype Pollution

NPM: n8n: Microsoft SQL Node Prototype Pollution vulnerability discovered by ? in WordPress Npm n8n versions 2.24.0...

n8n: Microsoft SQL Node Prototype Pollution

Impact An authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter. This pollutes Object.prototype process-wide for the lifetime of the n8n server process, causing...

GHSA-X6P3-M6H9-FX7R n8n: Microsoft SQL Node Prototype Pollution

Impact An authenticated user with permission to create or modify workflows could achieve global prototype pollution via the Microsoft SQL node by supplying a crafted value as the table parameter. This pollutes Object.prototype process-wide for the lifetime of the n8n server process, causing...

CVE-2026-49073 WordPress Directorist Booking plugin <= 3.0.3 - SQL Injection vulnerability

Improper Neutralization of Special Elements used in an SQL Command 'SQL Injection' vulnerability in wpWax Directorist Booking allows Blind SQL Injection. This issue affects Directorist Booking: from n/a through 3.0.3...

CVE-2026-49073

Summary: CVE-2026-49073 affects the WordPress plugin Directorist Booking (wpWax Directorist Booking) versions up to 3.0.3. The issue is an SQL Injection in the plugin, allowing blind SQL injection through improper neutralization of special elements in SQL commands. The CVSSBase score is 8.5 (HIGH...

CVE-2026-49080

CVE-2026-49080 : Unauthenticated SQL Injection affecting the WordPress plugin wpDataTables, version

CVE-2026-39438 WordPress ListingPro plugin <= 2.9.10 - SQL Injection vulnerability

Unauthenticated SQL Injection in ListingPro = 2.9.10 versions...

CVE-2026-39438

CVE-2026-39438 : Unauthenticated SQL Injection in the WordPress ListingPro plugin (versions

GHSA-9C38-2MCM-Q7F7 n8n: Merge Node SQL Mode Prototype Pollution

Impact An authenticated user with permission to create or modify workflows could pollute the sandbox used by the Merge node's SQL Query mode. Because the sandbox context was cached and reused across all workflow executions on the instance, prototype mutations introduced by one user's workflow...

n8n: Merge Node SQL Mode Prototype Pollution

Impact An authenticated user with permission to create or modify workflows could pollute the sandbox used by the Merge node's SQL Query mode. Because the sandbox context was cached and reused across all workflow executions on the instance, prototype mutations introduced by one user's workflow...

NPM: n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes

NPM: n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes vulnerability discovered by ? in WordPress Npm n8n versions 2.25.7...

n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes

Impact An authenticated user with permission to create or modify workflows could supply a crafted parameters to the TimescaleDB and/or legacy Postgres v1 node's allowing arbitrary SQL to be injected and executed against the connected database within the privileges of the configured database...

Security Bulletin: IBM QRadar SIEM is vulnerable to using components with known vulnerabilities

Summary Multiple components with known vulnerabilities were addressed in IBM QRadar SIEM 7.5.0 UP15 IF04 Vulnerability Details CVEID:CVE-2026-6638 DESCRIPTION: SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute...

WordPress JobSearch plugin <= 3.2.9 - SQL Injection vulnerability

SQL Injection vulnerability discovered by Nguyen Ba Khanh in WordPress Plugin JobSearch versions = 3.2.9...

postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser

A flaw was found in PostgreSQL. An attacker with pgcreatesubscription rights can exploit a SQL injection vulnerability in the pgcreatesubscriber utility. This allows the attacker to execute arbitrary SQL commands with superuser privileges when pgcreatesubscriber is next run, leading to potential...

postgresql: PostgreSQL: Arbitrary code execution vulnerability in 'refint' module

A flaw was found in PostgreSQL. A stack buffer overflow in the 'refint' module allows an unprivileged database user to execute arbitrary code as the operating system user running the database. Additionally, a separate vulnerability exists where, if an application uses a user-controlled column as ...

postgresql: PostgreSQL: Arbitrary code execution vulnerability in 'refint' module

A flaw was found in PostgreSQL. A stack buffer overflow in the 'refint' module allows an unprivileged database user to execute arbitrary code as the operating system user running the database. Additionally, a separate vulnerability exists where, if an application uses a user-controlled column as ...

BIT-MYSQL-CLIENT-2026-44172 MariaDB: mysql_real_escape_string() incorrectly handled big5

MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysqlrealescapestring and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections,...

BIT-MARIADB-MIN-2026-44172 MariaDB: mysql_real_escape_string() incorrectly handled big5

MariaDB server is a community developed fork of MySQL server. In versions 3.3.18 and 3.4.8, an application that was taking non-validated user input, escaping it with mysqlrealescapestring and sending it to the database using text protocol and big5 character set was vulnerable to SQL injections,...