https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Sat, 03 Oct 2026 02:38:07 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1249 certfr-2026-avi-1249 https://cve.radiocsirt.org/vuln/certfr-2026-avi-1249 https://cve.radiocsirt.org/vuln/cleanstart-2026-aj39907 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: step</p> <p>Multiple security vulnerabilities affect the step package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: step</p> <p>Multiple security vulnerabilities affect the step package. gRPC-Go is the Go language implementation of gRPC. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-aj39907 https://cve.radiocsirt.org/vuln/euvd-2026-309231 EUVD-2026-309231 https://cve.radiocsirt.org/vuln/euvd-2026-309231 https://cve.radiocsirt.org/vuln/fkie_cve-2026-41889 <p>pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.</p> <p>pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-41889 https://cve.radiocsirt.org/vuln/ghsa-j88v-2chj-qfwx <p><strong>Affected:</strong> Go: github.com/jackc/pgx/v5, Go: github.com/jackc/pgx/v4, Go: github.com/jackc/pgx</p> <p>### Impact</p> <p>SQL Injection can occur when:</p> <p>1. The non-default simple protocol is used. 2. A dollar quoted string literal is used in the SQL query. 3. That string literal contains text that would be would be interpreted as a placeholder outside of a string literal. 4. The value of that placeholder is controllable by the attacker.</p> <p>e.g.</p> <p>```go attackValue := `$tag$; drop table canary; --` _, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue) ```</p> <p>This is unlikely to occur outside of a contrived scenario.</p> <p>### Patches</p> <p>The problem is resolved in v5.9.2.</p> <p>### Workarounds</p> <p>Do not use the simple protocol to execute queries matching all the above conditions.</p> <p><strong>Affected:</strong> Go: github.com/jackc/pgx/v5, Go: github.com/jackc/pgx/v4, Go: github.com/jackc/pgx</p> <p>### Impact</p> <p>SQL Injection can occur when:</p> <p>1. The non-default simple protocol is used. 2. A dollar quoted string literal is used in the SQL query. 3. That string literal contains text that would be would be interpreted as a placeholder outside of a string literal. 4. The value of that placeholder is controllable by the attacker.</p> <p>e.g.</p> <p>```go attackValue := `$tag$; drop table canary; --` _, err = tx.Exec(ctx, `select $tag$ $1 $tag$, $1`, pgx.QueryExecModeSimpleProtocol, attackValue) ```</p> <p>This is unlikely to occur outside of a contrived scenario.</p> <p>### Patches</p> <p>The problem is resolved in v5.9.2.</p> <p>### Workarounds</p> <p>Do not use the simple protocol to execute queries matching all the above conditions.</p> https://cve.radiocsirt.org/vuln/ghsa-j88v-2chj-qfwx https://cve.radiocsirt.org/vuln/msrc_cve-2026-41889 msrc_CVE-2026-41889 https://cve.radiocsirt.org/vuln/msrc_cve-2026-41889 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10976-1 <p>steampipe-2.4.4-1.1 on GA media</p> <p>steampipe-2.4.4-1.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10976-1 https://cve.radiocsirt.org/vuln/rhsa-2026:15856 <p>github.com/jackc/pgx: golang: pgx: SQL injection via specific SQL query conditions</p> <p>github.com/jackc/pgx: golang: pgx: SQL injection via specific SQL query conditions</p> https://cve.radiocsirt.org/vuln/rhsa-2026:15856 https://cve.radiocsirt.org/vuln/suse-su-2026:22575-1 <p>Security update for alloy</p> <p>Security update for alloy</p> https://cve.radiocsirt.org/vuln/suse-su-2026:22575-1 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-41889 <p><strong>Affected:</strong> Ubuntu:26.04:LTS: golang-github-jackc-pgx-v5</p> <p>pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.</p> <p><strong>Affected:</strong> Ubuntu:26.04:LTS: golang-github-jackc-pgx-v5</p> <p>pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-41889