Most recent entries from all

bdu:2026-11959

BELL-CVE-2026-14673

Affected: Alpaquita:25: postgresql17, Alpaquita:stream: postgresql18

BIT-postgresql-2026-14673 — PostgreSQL amcheck does not clear untrusted search path

Affected: Bitnami: postgresql

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16, 15, and 14, minor versions before PostgreSQL 18.6, 16.15, 15.19, and 14.24 are affected. PostgreSQL 17 is unaffected.

certfr-2026-avi-1024 — De multiples vulnérabilités ont été découvertes dans PostgreSQL. Certaines d'entre elles permettent à un attaquant de p…

certfr-2026-avi-1024

EUVD-2026-361650

fkie_cve-2026-14673

GHSA-qp83-ppf3-v924

Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the amcheck function. Within major versions 18, 16, 15, and 14, minor versions before PostgreSQL 18.5, 16.15, 15.19, and 14.24 are affected. PostgreSQL 17 is unaffected.

msrc_CVE-2026-14673 — PostgreSQL amcheck does not clear untrusted search path

msrc_CVE-2026-14673

OESA-2026-3420 — postgresql security update

Affected: openEuler:24.03-LTS-SP4: postgresql

PostgreSQL is an advanced Object-Relational database management system (DBMS). The base postgresql package contains the client programs that you&apos;ll need to access a PostgreSQL DBMS server, as well as HTML documentation for the whole system. These client programs can be located on the same machine as the PostgreSQL server, or on a remote machine that accesses a PostgreSQL server over a network connection. The PostgreSQL server can be found in the postgresql-server sub-package. Security Fix(es):

Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the operating system user running the database. These types are typically sourced from application logic, not taken from the application's user. Hence, application users attacking the database, through the application as a conduit, are unlikely. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.(CVE-2026-14662)

Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts encrypted data as input, decryption will succeed even with the wrong key. This in turn loses the…

openSUSE-SU-2026:11552-1 — postgresql14-14.24-1.1 on GA media

postgresql14-14.24-1.1 on GA media

RHSA-2026:54751 — Red Hat Security Advisory: Red Hat Hardened Images RPMs bug fix and enhancement update

postgresql: PostgreSQL pgcrypto: Information disclosure via cleartext storage with disabled ciphers postgresql: PostgreSQL amcheck: Privilege escalation via untrusted search path

SUSE-SU-2026:23577-1 — Security update for postgresql18

Security update for postgresql18

UBUNTU-CVE-2026-14673

Affected: Ubuntu:Pro:14.04:LTS: postgresql-9.3, Ubuntu:Pro:16.04:LTS: postgresql-9.5, Ubuntu:Pro:18.04:LTS: postgresql-10, Ubuntu:20.04:LTS: postgresql-12, Ubuntu:22.04:LTS: postgresql-14, Ubuntu:24.04:LTS: postgresql-16, Ubuntu:26.04:LTS: postgresql-18

WID-SEC-W-2026-2844 — PostgreSQL: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in PostgreSQL ausnutzen, um beliebigen Programmcode auszuführen, SQL-Injection-Angriffe durchzuführen, Sicherheitsmaßnahmen zu umgehen, Daten offenzulegen oder zu manipulieren oder Denial-of-Service-Zustände herbeizuführen.