EUVD-2026-54182

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read in the Dictionary compression reverse row iterator tsl/src/compression/algorithms/dictionary.c. The forward path validates the decoded index; the reverse path uses an assertion compiled out of release builds,...

EUVD-2026-54179

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator that allows authenticated attackers to cause a denial of service by storing a crafted compressed datum with an internally inconsistent BitArray...

EUVD-2026-54183

TimescaleDB through 2.29.1, fixed in commit 517c13e, contains an out-of-bounds read vulnerability that allows authenticated attackers to cause query-result integrity failures or backend crashes by supplying a crafted Simple8b selector-11 value, which is stored in the signed int16 Arrow...

CVE-2026-70634

TimescaleDB 2.29.1 contains an out-of-bounds read in the Dictionary compression reverse row iterator (tsl/src/compression/algorithms/dictionary.c). The reverse path does not validate the 64-bit Simple8b index (an assertion is compiled out in release builds); attackers with DML access to a physica...

CVE-2026-70633

TimescaleDB up to version 2.29.1 contains an out-of-bounds read vulnerability in the Gorilla compression reverse row iterator. According to the CVE entry, an authenticated attacker with DML access to a compressed hypertable can craft a datum with an internally inconsistent BitArray, causing an un...

CVE-2026-71276

Magistrala formerly Mainflux's message-readers API reads a format value from the HTTP query string readers/api/http/transport.go with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader readers/postgres/messages.go: fmt.Sprintf"SELECT FROM...

EUVD-2026-53361

Magistrala formerly Mainflux's message-readers API reads a format value from the HTTP query string readers/api/http/transport.go with no validation and interpolates it directly into raw SQL queries via fmt.Sprintf in both the PostgreSQL reader readers/postgres/messages.go: fmt.Sprintf"SELECT FROM...

SQL Injection

Overview n8n-nodes-base is a Base nodes of n8n Affected versions of this package are vulnerable to SQL Injection in the postgres and timescaleDb nodes, which incorporate node parameters into database queries without adequate parameterization. A user with permission to create or modify workflows c...

CVE-2026-54310

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could supply a crafted parameters to the TimescaleDB and/or legacy Postgres v1 node's allowing arbitrary SQL to be injected and executed against the...

CVE-2026-54310

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could supply a crafted parameters to the TimescaleDB and/or legacy Postgres v1 node's allowing arbitrary SQL to be injected and executed against the...

CVE-2026-54310

CVE-2026-54310 affects n8n, specifically the TimescaleDB and legacy Postgres v1 nodes. An authenticated user who can create or modify workflows could supply crafted parameters to these nodes, enabling arbitrary SQL injection and execution against the connected database within the privileges of th...

CVE-2026-54310 n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes

n8n is an open source workflow automation platform. Prior to 2.25.7 and 2.26.2, an authenticated user with permission to create or modify workflows could supply a crafted parameters to the TimescaleDB and/or legacy Postgres v1 node's allowing arbitrary SQL to be injected and executed against the...

NPM: n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes

NPM: n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes vulnerability discovered by ? in WordPress Npm n8n versions 2.25.7...

n8n: SQL Injection in Postgres v1/TimesclaeDB Nodes

Impact An authenticated user with permission to create or modify workflows could supply a crafted parameters to the TimescaleDB and/or legacy Postgres v1 node's allowing arbitrary SQL to be injected and executed against the connected database within the privileges of the configured database...

CVE-2026-41889 vulnerabilities

Vulnerabilities for packages: gotrue-fips, chainloop-control-plane-fips, spqr, zitadel, sftpgo-plugin-eventstore, step-fips, gitaly, gitlab-cng, gitlab-cng-fips, falcosidekick-fips, hydra, teleport, openbao-fips, step, bento, trillian-fips, goose, sqlexporter-fips, spire-server, ferretdb,...

SUSE CVE-2026-32611

Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix commit 39161f0 addressed SQL injection in the TimescaleDB export module by converting all SQL operations to use parameterized queries and psycopg.sql composable objects. However, the DuckDB export module...

CVE-2026-32611

Glances is an open-source system cross-platform monitoring tool. The GHSA-x46r fix commit 39161f0 addressed SQL injection in the TimescaleDB export module by converting all SQL operations to use parameterized queries and psycopg.sql composable objects. However, the DuckDB export module...

SQL Injection

Glances is vulnerable to SQL Injection. The vulnerability is due to constructing SQL queries using string concatenation with unsanitized data in the TimescaleDB export module, where values are wrapped in quotes without proper escaping, allowing attacker-controlled inputs e.g., process names or...

SUSE CVE-2026-30930

Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, The TimescaleDB export module constructs SQL queries using string concatenation with unsanitized system monitoring data. The normalize method wraps string values in single quotes but does not escape embedded single...

Linux Distros Unpatched Vulnerability : CVE-2026-30930

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Glances is an open-source system cross-platform monitoring tool. Prior to 4.5.1, The TimescaleDB export module constructs SQL queries using string concatenation...