https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-09-29T23:06:36.805168+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/alsa-2026:67280 ALSA-2026:67280 — Important: postgresql18 security update 2026-09-29T23:06:38.015125+00:00

Affected: AlmaLinux:10: postgresql18, AlmaLinux:10: postgresql18-contrib, AlmaLinux:10: postgresql18-docs, AlmaLinux:10: postgresql18-plperl, AlmaLinux:10: postgresql18-plpython3, AlmaLinux:10: postgresql18-private-devel, AlmaLinux:10: postgresql18-private-libs, AlmaLinux:10: postgresql18-server, AlmaLinux:10: postgresql18-server-devel, AlmaLinux:10: postgresql18-static and 4 more

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

* postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476) * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662) * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408) * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464) * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471) * postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680) * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664) * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677) * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via int…

 https://vulnerability.circl.lu/vuln/bdu:2026-11968 bdu:2026-11968 2026-09-29T23:06:38.015337+00:00 bdu:2026-11968 https://vulnerability.circl.lu/vuln/bell-cve-2026-16238 BELL-CVE-2026-16238 2026-09-29T23:06:38.015378+00:00

Affected: Alpaquita:25: postgresql17, Alpaquita:stream: postgresql18

 https://vulnerability.circl.lu/vuln/bit-postgresql-2026-16238 BIT-postgresql-2026-16238 — PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code 2026-09-29T23:06:38.015416+00:00

Affected: Bitnami: postgresql

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1024 certfr-2026-avi-1024 — De multiples vulnérabilités ont été découvertes dans PostgreSQL. Certaines d'entre elles permettent à un attaquant de p… 2026-09-29T23:06:38.015457+00:00 certfr-2026-avi-1024 https://vulnerability.circl.lu/vuln/fkie_cve-2026-16238 fkie_cve-2026-16238 2026-09-29T23:06:38.015485+00:00

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.

 https://vulnerability.circl.lu/vuln/ghsa-6q3v-qqc9-g2rv GHSA-6q3v-qqc9-g2rv 2026-09-29T23:06:38.015525+00:00

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before PostgreSQL 18 are unaffected.

 https://vulnerability.circl.lu/vuln/opensuse-su-2026:11565-1 openSUSE-SU-2026:11565-1 — libecpg6-18.6-1.1 on GA media 2026-09-29T23:06:38.015550+00:00

libecpg6-18.6-1.1 on GA media

 https://vulnerability.circl.lu/vuln/rlsa-2026:67280 RLSA-2026:67280 — Important: postgresql18 security update 2026-09-29T23:06:38.015608+00:00

Affected: Rocky Linux:10: postgresql18

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

* postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476)

* postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662)

* postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408)

* postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464)

* postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)

* postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680)

* postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)

* postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677)

* postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparo…

 https://vulnerability.circl.lu/vuln/suse-su-2026:23577-1 SUSE-SU-2026:23577-1 — Security update for postgresql18 2026-09-29T23:06:38.015692+00:00

Security update for postgresql18

 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-16238 UBUNTU-CVE-2026-16238 2026-09-29T23:06:38.015733+00:00

Affected: Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:26.04:LTS: postgresql-18

Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.