CVE-2026-116313

PostgreSQL contains an untrusted search path vulnerability in the vacuumdb utility, specifically within the --missing-stats-only catalog query. This flaw allows a database owner to execute arbitrary SQL as the user running the vacuumdb process by shadowing operators. Affected versions include Pos...

EUVD-2026-124493

Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query. The pgupgrade documentation recommends an affected vacuumdb invocation. Within major version...

Security update for postgresql96

This update for postgresql96 fixes the following issues: Upgrade to version 9.6.20: CVE-2020-25695, bsc1178666: Block DECLARE CURSOR ... WITH HOLD and firing of deferred triggers within index expressions and materialized view queries. CVE-2020-25694, bsc1178667: a Fix usage of complex...

Security update for postgresql10

This update for postgresql10 fixes the following issues: Upgrade to version 10.15: CVE-2020-25695, bsc1178666: Block DECLARE CURSOR ... WITH HOLD and firing of deferred triggers within index expressions and materialized view queries. CVE-2020-25694, bsc1178667: a Fix usage of complex...

Security update for postgresql10

This update for postgresql10 fixes the following issues: Upgrade to version 10.15: CVE-2020-25695, bsc1178666: Block DECLARE CURSOR ... WITH HOLD and firing of deferred triggers within index expressions and materialized view queries. CVE-2020-25694, bsc1178667: a Fix usage of complex...

Security update for postgresql10

This update for postgresql10 fixes the following issues: Upgrade to version 10.15: CVE-2020-25695, bsc1178666: Block DECLARE CURSOR ... WITH HOLD and firing of deferred triggers within index expressions and materialized view queries. CVE-2020-25694, bsc1178667: a Fix usage of complex...

Security update for postgresql12

This update for postgresql12 fixes the following issues: Upgrade to version 12.5: CVE-2020-25695, bsc1178666: Block DECLARE CURSOR ... WITH HOLD and firing of deferred triggers within index expressions and materialized view queries. CVE-2020-25694, bsc1178667: a Fix usage of complex...