https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T18:43:02.995686+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/alsa-2026:67280 ALSA-2026:67280 — Important: postgresql18 security update 2026-10-02T18:43:04.183426+00:00

Affected: AlmaLinux:10: postgresql18, AlmaLinux:10: postgresql18-contrib, AlmaLinux:10: postgresql18-docs, AlmaLinux:10: postgresql18-plperl, AlmaLinux:10: postgresql18-plpython3, AlmaLinux:10: postgresql18-private-devel, AlmaLinux:10: postgresql18-private-libs, AlmaLinux:10: postgresql18-server, AlmaLinux:10: postgresql18-server-devel, AlmaLinux:10: postgresql18-static and 4 more

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

* postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476) * postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662) * postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408) * postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464) * postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471) * postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680) * postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664) * postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677) * postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via int…

 https://cve.radiocsirt.org/vuln/bdu:2026-11973 bdu:2026-11973 2026-10-02T18:43:04.183547+00:00 bdu:2026-11973 https://cve.radiocsirt.org/vuln/bell-cve-2026-19385 BELL-CVE-2026-19385 2026-10-02T18:43:04.183568+00:00

Affected: Alpaquita:25: postgresql17, Alpaquita:stream: postgresql18

 https://cve.radiocsirt.org/vuln/bit-postgresql-2026-19385 BIT-postgresql-2026-19385 — PostgreSQL pg_dump heap buffer overflow executes arbitrary code 2026-10-02T18:43:04.183606+00:00

Affected: Bitnami: postgresql

Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1024 certfr-2026-avi-1024 — De multiples vulnérabilités ont été découvertes dans PostgreSQL. Certaines d'entre elles permettent à un attaquant de p… 2026-10-02T18:43:04.183630+00:00 certfr-2026-avi-1024 https://cve.radiocsirt.org/vuln/euvd-2026-361664 EUVD-2026-361664 2026-10-02T18:43:04.183646+00:00 EUVD-2026-361664 https://cve.radiocsirt.org/vuln/fkie_cve-2026-19385 fkie_cve-2026-19385 2026-10-02T18:43:04.183658+00:00

Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

 https://cve.radiocsirt.org/vuln/ghsa-4g6h-pg6m-qwgx GHSA-4g6h-pg6m-qwgx 2026-10-02T18:43:04.183685+00:00

Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-19385 msrc_CVE-2026-19385 — PostgreSQL pg_dump heap buffer overflow executes arbitrary code 2026-10-02T18:43:04.183701+00:00 msrc_CVE-2026-19385 https://cve.radiocsirt.org/vuln/oesa-2026-3420 OESA-2026-3420 — postgresql security update 2026-10-02T18:43:04.183717+00:00

Affected: openEuler:24.03-LTS-SP4: postgresql

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es):

Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic, not taken from the application's user. Hence, application users attacking the database, through the application as a conduit, are unlikely. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14662)

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed even with the wrong key. This in turn loses the…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11552-1 openSUSE-SU-2026:11552-1 — postgresql14-14.24-1.1 on GA media 2026-10-02T18:43:04.183783+00:00

postgresql14-14.24-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:57198 RHSA-2026:57198 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-02T18:43:04.183815+00:00

postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers postgresql: PostgreSQL amcheck: Privilege escalation via untrusted search path postgresql: PostgreSQL pg_dump: Arbitrary code execution via crafted transform lists

 https://cve.radiocsirt.org/vuln/rlsa-2026:67280 RLSA-2026:67280 — Important: postgresql18 security update 2026-10-02T18:43:04.183836+00:00

Affected: Rocky Linux:10: postgresql18

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you'll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package.

Security Fix(es):

* postgresql: PostgreSQL: SQL injection in pg_createsubscriber allows arbitrary SQL execution as superuser (CVE-2026-6476)

* postgresql: PostgreSQL: Arbitrary code execution via integer wraparound in tsvector and tsquery functions (CVE-2026-14662)

* postgresql: PostgreSQL: Arbitrary code execution via untrusted data inclusion in pg_dump (CVE-2026-18408)

* postgresql: PostgreSQL psql: Arbitrary command execution via untrusted data in COPY FROM STDIN (CVE-2026-6464)

* postgresql: PostgreSQL: Arbitrary code execution via logical decoding plugin (CVE-2026-6471)

* postgresql: PostgreSQL: Arbitrary code execution via type confusion with "internal" arguments (CVE-2026-14680)

* postgresql: PostgreSQL: Arbitrary code execution via heap buffer overflow in regexp (CVE-2026-14664)

* postgresql: pltcl: plperl: PostgreSQL: Arbitrary code execution in 32-bit pltcl and plperl (CVE-2026-14677)

* postgresql-fuzzystrmatch: PostgreSQL fuzzystrmatch: Arbitrary code execution via integer wraparo…

 https://cve.radiocsirt.org/vuln/suse-su-2026:23577-1 SUSE-SU-2026:23577-1 — Security update for postgresql18 2026-10-02T18:43:04.183877+00:00

Security update for postgresql18

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-19385 UBUNTU-CVE-2026-19385 2026-10-02T18:43:04.183904+00:00

Affected: Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:Pro:16.04:LTS: postgresql-9.5, Ubuntu:Pro:18.04:LTS: postgresql-10, Ubuntu:20.04:LTS: postgresql-12, Ubuntu:22.04:LTS: postgresql-14, Ubuntu:24.04:LTS: postgresql-16, Ubuntu:26.04:LTS: postgresql-18

Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2844 WID-SEC-W-2026-2844 — PostgreSQL: Mehrere Schwachstellen 2026-10-02T18:43:04.183933+00:00

Ein Angreifer kann mehrere Schwachstellen in PostgreSQL ausnutzen, um beliebigen Programmcode auszuführen, SQL-Injection-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder Denial-of-Service-Zustände herbeizuführen.