https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T23:51:13.863709+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-1249 certfr-2026-avi-1249 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer… 2026-10-02T23:51:14.533294+00:00 certfr-2026-avi-1249 https://cve.radiocsirt.org/vuln/cleanstart-2026-aj39907 Withdrawn: CLEANSTART-2026-AJ39907 — gRPC-Go is the Go language implementation of gRPC 2026-10-02T23:51:14.533403+00:00

Withdrawn by the publisher.

Affected: CleanStart: step

Multiple security vulnerabilities affect the step package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-309231 EUVD-2026-309231 2026-10-02T23:51:14.533472+00:00 EUVD-2026-309231 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41889 fkie_cve-2026-41889 2026-10-02T23:51:14.533488+00:00

pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.

 https://cve.radiocsirt.org/vuln/ghsa-j88v-2chj-qfwx GHSA-j88v-2chj-qfwx — pgx: SQL Injection via placeholder confusion with dollar quoted string literals 2026-10-02T23:51:14.533515+00:00

Affected: Go: github.com/jackc/pgx/v5, Go: github.com/jackc/pgx/v4, Go: github.com/jackc/pgx

### Impact

SQL Injection can occur when:

1. The non-default simple protocol is used. 2. A dollar quoted string literal is used in the SQL query. 3. That string literal contains text that would be would be interpreted as a placeholder outside of a string literal. 4. The value of that placeholder is controllable by the attacker.

e.g.

```go attackValue := `$tag$; drop table canary; --` _, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue) ```

This is unlikely to occur outside of a contrived scenario.

### Patches

The problem is resolved in v5.9.2.

### Workarounds

Do not use the simple protocol to execute queries matching all the above conditions.

 https://cve.radiocsirt.org/vuln/msrc_cve-2026-41889 msrc_CVE-2026-41889 — pgx: SQL Injection via placeholder confusion with dollar quoted string literals 2026-10-02T23:51:14.533552+00:00 msrc_CVE-2026-41889 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10976-1 openSUSE-SU-2026:10976-1 — steampipe-2.4.4-1.1 on GA media 2026-10-02T23:51:14.533570+00:00

steampipe-2.4.4-1.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:15856 RHSA-2026:15856 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update 2026-10-02T23:51:14.533586+00:00

github.com/jackc/pgx: golang: pgx: SQL injection via specific SQL query conditions

 https://cve.radiocsirt.org/vuln/suse-su-2026:22575-1 SUSE-SU-2026:22575-1 — Security update for alloy 2026-10-02T23:51:14.533602+00:00

Security update for alloy

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-41889 UBUNTU-CVE-2026-41889 2026-10-02T23:51:14.533635+00:00

Affected: Ubuntu:26.04:LTS: golang-github-jackc-pgx-v5

pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.