https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 29 Sep 2026 23:06:36 +0000 https://vulnerability.circl.lu/vuln/alsa-2026:67280 <p><strong>Affected:</strong> AlmaLinux:10: postgresql18, AlmaLinux:10: postgresql18-contrib, AlmaLinux:10: postgresql18-docs, AlmaLinux:10: postgresql18-plperl, AlmaLinux:10: postgresql18-plpython3, AlmaLinux:10: postgresql18-private-devel, AlmaLinux:10: postgresql18-private-libs, AlmaLinux:10: postgresql18-server, AlmaLinux:10: postgresql18-server-devel, AlmaLinux:10: postgresql18-static and 4 more</p> <p>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you&#39;ll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.</p> <p>Security Fix(es):</p> <p>* postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476) * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662) * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408) * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464) * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471) * postgresql: PostgreSQL: Arbitrary code execution via type confusion with &#34;internal&#34; arguments (CVE-2026-14680) * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664) * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677) * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via int…</p> <p><strong>Affected:</strong> AlmaLinux:10: postgresql18, AlmaLinux:10: postgresql18-contrib, AlmaLinux:10: postgresql18-docs, AlmaLinux:10: postgresql18-plperl, AlmaLinux:10: postgresql18-plpython3, AlmaLinux:10: postgresql18-private-devel, AlmaLinux:10: postgresql18-private-libs, AlmaLinux:10: postgresql18-server, AlmaLinux:10: postgresql18-server-devel, AlmaLinux:10: postgresql18-static and 4 more</p> <p>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you&#39;ll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.</p> <p>Security Fix(es):</p> <p>* postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476) * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662) * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408) * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464) * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471) * postgresql: PostgreSQL: Arbitrary code execution via type confusion with &#34;internal&#34; arguments (CVE-2026-14680) * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664) * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677) * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via int…</p> https://vulnerability.circl.lu/vuln/alsa-2026:67280 https://vulnerability.circl.lu/vuln/bdu:2026-11968 bdu:2026-11968 https://vulnerability.circl.lu/vuln/bdu:2026-11968 https://vulnerability.circl.lu/vuln/bell-cve-2026-16238 <p><strong>Affected:</strong> Alpaquita:25: postgresql17, Alpaquita:stream: postgresql18</p> <p><strong>Affected:</strong> Alpaquita:25: postgresql17, Alpaquita:stream: postgresql18</p> https://vulnerability.circl.lu/vuln/bell-cve-2026-16238 https://vulnerability.circl.lu/vuln/bit-postgresql-2026-16238 <p><strong>Affected:</strong> Bitnami: postgresql</p> <p>Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.</p> <p><strong>Affected:</strong> Bitnami: postgresql</p> <p>Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.</p> https://vulnerability.circl.lu/vuln/bit-postgresql-2026-16238 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1024 certfr-2026-avi-1024 https://vulnerability.circl.lu/vuln/certfr-2026-avi-1024 https://vulnerability.circl.lu/vuln/fkie_cve-2026-16238 <p>Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.</p> <p>Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-16238 https://vulnerability.circl.lu/vuln/ghsa-6q3v-qqc9-g2rv <p>Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before PostgreSQL 18 are unaffected.</p> <p>Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before PostgreSQL 18 are unaffected.</p> https://vulnerability.circl.lu/vuln/ghsa-6q3v-qqc9-g2rv https://vulnerability.circl.lu/vuln/opensuse-su-2026:11565-1 <p>libecpg6-18.6-1.1 on GA media</p> <p>libecpg6-18.6-1.1 on GA media</p> https://vulnerability.circl.lu/vuln/opensuse-su-2026:11565-1 https://vulnerability.circl.lu/vuln/rlsa-2026:67280 <p><strong>Affected:</strong> Rocky Linux:10: postgresql18</p> <p>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you&#39;ll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.</p> <p>Security Fix(es):</p> <p>* postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476)</p> <p>* postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662)</p> <p>* postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408)</p> <p>* postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464)</p> <p>* postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)</p> <p>* postgresql: PostgreSQL: Arbitrary code execution via type confusion with &#34;internal&#34; arguments (CVE-2026-14680)</p> <p>* postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)</p> <p>* postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677)</p> <p>* postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparo…</p> <p><strong>Affected:</strong> Rocky Linux:10: postgresql18</p> <p>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you&#39;ll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.</p> <p>Security Fix(es):</p> <p>* postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476)</p> <p>* postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662)</p> <p>* postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408)</p> <p>* postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464)</p> <p>* postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)</p> <p>* postgresql: PostgreSQL: Arbitrary code execution via type confusion with &#34;internal&#34; arguments (CVE-2026-14680)</p> <p>* postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)</p> <p>* postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677)</p> <p>* postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparo…</p> https://vulnerability.circl.lu/vuln/rlsa-2026:67280 https://vulnerability.circl.lu/vuln/suse-su-2026:23577-1 <p>Security update for postgresql18</p> <p>Security update for postgresql18</p> https://vulnerability.circl.lu/vuln/suse-su-2026:23577-1 https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-16238 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:26.04:LTS: postgresql-18</p> <p>Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:26.04:LTS: postgresql-18</p> <p>Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before PostgreSQL 18 are unaffected.</p> https://vulnerability.circl.lu/vuln/ubuntu-cve-2026-16238