https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 15:37:16 +0000 https://cve.radiocsirt.org/vuln/bdu:2026-11954 bdu:2026-11954 https://cve.radiocsirt.org/vuln/bdu:2026-11954 https://cve.radiocsirt.org/vuln/bell-cve-2026-14666 <p><strong>Affected:</strong> Alpaquita:25: postgresql17, Alpaquita:stream: postgresql18</p> <p><strong>Affected:</strong> Alpaquita:25: postgresql17, Alpaquita:stream: postgresql18</p> https://cve.radiocsirt.org/vuln/bell-cve-2026-14666 https://cve.radiocsirt.org/vuln/bit-postgresql-2026-14666 <p><strong>Affected:</strong> Bitnami: postgresql</p> <p>Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application&#39;s pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.</p> <p><strong>Affected:</strong> Bitnami: postgresql</p> <p>Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application&#39;s pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.</p> https://cve.radiocsirt.org/vuln/bit-postgresql-2026-14666 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1024 certfr-2026-avi-1024 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1024 https://cve.radiocsirt.org/vuln/euvd-2026-361645 EUVD-2026-361645 https://cve.radiocsirt.org/vuln/euvd-2026-361645 https://cve.radiocsirt.org/vuln/fkie_cve-2026-14666 <p>Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application&#39;s pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.</p> <p>Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application&#39;s pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-14666 https://cve.radiocsirt.org/vuln/ghsa-fvh5-w7wg-xp3g <p>Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application&#39;s pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.</p> <p>Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application&#39;s pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.</p> https://cve.radiocsirt.org/vuln/ghsa-fvh5-w7wg-xp3g https://cve.radiocsirt.org/vuln/msrc_cve-2026-14666 msrc_CVE-2026-14666 https://cve.radiocsirt.org/vuln/msrc_cve-2026-14666 https://cve.radiocsirt.org/vuln/oesa-2026-3420 <p><strong>Affected:</strong> openEuler:24.03-LTS-SP4: postgresql</p> <p>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you&amp;amp;apos;ll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es):</p> <p>Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic, not taken from the application&amp;apos;s user. Hence, application users attacking the database, through the application as a conduit, are unlikely. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14662)</p> <p>Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed even with the wrong key. This in turn loses the…</p> <p><strong>Affected:</strong> openEuler:24.03-LTS-SP4: postgresql</p> <p>PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you&amp;amp;apos;ll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es):</p> <p>Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic, not taken from the application&amp;apos;s user. Hence, application users attacking the database, through the application as a conduit, are unlikely. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14662)</p> <p>Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed even with the wrong key. This in turn loses the…</p> https://cve.radiocsirt.org/vuln/oesa-2026-3420 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11552-1 <p>postgresql14-14.24-1.1 on GA media</p> <p>postgresql14-14.24-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:11552-1 https://cve.radiocsirt.org/vuln/suse-su-2026:23577-1 <p>Security update for postgresql18</p> <p>Security update for postgresql18</p> https://cve.radiocsirt.org/vuln/suse-su-2026:23577-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-14666 <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:Pro:16.04:LTS: postgresql-9.5, Ubuntu:Pro:18.04:LTS: postgresql-10, Ubuntu:20.04:LTS: postgresql-12, Ubuntu:22.04:LTS: postgresql-14, Ubuntu:24.04:LTS: postgresql-16, Ubuntu:26.04:LTS: postgresql-18</p> <p>Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application&#39;s pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.</p> <p><strong>Affected:</strong> Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:Pro:16.04:LTS: postgresql-9.5, Ubuntu:Pro:18.04:LTS: postgresql-10, Ubuntu:20.04:LTS: postgresql-12, Ubuntu:22.04:LTS: postgresql-14, Ubuntu:24.04:LTS: postgresql-16, Ubuntu:26.04:LTS: postgresql-18</p> <p>Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policies continue until some other event invalidates the cache or connection termination ends the session. This permits a user to complete reads and modifications that were recently permitted but now forbidden. An attacker must tailor an attack to a particular application&#39;s pattern of privilege removal and role-specific row security policies. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-14666 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2844 <p>Ein Angreifer kann mehrere Schwachstellen in PostgreSQL ausnutzen, um beliebigen Programmcode auszuführen, SQL-Injection-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder Denial-of-Service-Zustände herbeizuführen.</p> <p>Ein Angreifer kann mehrere Schwachstellen in PostgreSQL ausnutzen, um beliebigen Programmcode auszuführen, SQL-Injection-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder Denial-of-Service-Zustände herbeizuführen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-2844