CVE-2026-116317 is a heap-based buffer overflow vulnerability in the PostgreSQL function ts_rank_cd(). It affects multiple PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25. The flaw allows a database user to execute arbitrary code with the privileges of the operating system user running the database by supplying an invalid tsvector containing duplicate positions.
CVE-2026-116316 is a vulnerability in PostgreSQL where improper protection of alternate paths in security-restricted operations allows an object creator to execute arbitrary SQL as the operation's caller. This occurs via domain, enum, or range types created in the temporary schema pg_temp. The vulnerability affects versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. The attack requires the victim session to run a query with an unqualified type name, which common security-restricted operations like autovacuum do not do, so they are not affected.
CVE-2026-116315 is a heap-based buffer overflow vulnerability in PostgreSQL's tsvector_delete() function. It allows a database user to execute arbitrary code with the privileges of the operating system user running the database. The flaw is triggered by a tsvector with lexeme data that uses a nonstandard but valid ordering requiring additional alignment padding. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-116314 is a high-severity vulnerability in PostgreSQL's pg_restore utility caused by improper input validation. It allows an attacker to execute arbitrary code with the privileges of the operating system user running pg_restore by using a specially crafted non-plain archive. This differs from typical SQL injection during restore, as it enables code execution at the OS level. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-116313 is a high-severity vulnerability in PostgreSQL versions 18.0 up to but not including 18.7. It involves an untrusted search path in the vacuumdb utility, which allows a database owner to execute arbitrary SQL commands as the database user running vacuumdb. This occurs via shadowing operators used in the --missing-stats-only catalog query. Versions prior to PostgreSQL 18 are not affected. The issue is fixed in PostgreSQL 18.7.
CVE-2026-116312 is a vulnerability in PostgreSQL affecting versions 15 through 18 prior to specific minor releases. It involves improper preservation of consistency between independent representations of shared state during a MERGE operation on partitioned tables. This flaw can cause an AFTER trigger to process the wrong new row when a MERGE performs an INSERT before an UPDATE. The issue is fixed in PostgreSQL versions 15.20, 16.16, 17.12, and 18.7.
CVE-2026-116311 is a vulnerability in PostgreSQL where missing authorization in the DROP OWNED command allows a role to remove itself from restrictive row level security policies. This enables the role to read or modify rows that the policy was intended to deny after executing DROP OWNED. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-116310 is a use-after-free vulnerability in PostgreSQL affecting versions 17 and 18 prior to 17.12 and 18.7 respectively. It occurs in the COPY FROM error reporting code path and can lead to disclosure of portions of server memory when a longer input row follows an ignored or nullified conversion error. The file_fdw extension also reaches the same vulnerable code path. This vulnerability has a CVSS score of 4.3, indicating medium severity.
CVE-2026-116309 is a type confusion vulnerability in PostgreSQL's plperl procedural language. It allows an object creator to potentially execute arbitrary code by blessing a non-hash reference into PostgreSQL::InServer::ARRAY. Versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The vulnerability has a high severity with a CVSS score of 8.8. A fix is available in the specified versions.
CVE-2026-116308 is a buffer over-read vulnerability in PostgreSQL's dict_int component that allows a database user to disclose portions of server memory by using a zero-length token. This issue affects PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25. The vulnerability has a medium severity rating with a CVSS score of 4.3. It does not impact integrity or availability, only confidentiality. Fixed versions have been released to address this flaw.
CVE-2026-116307 is a use-after-free vulnerability in the PostgreSQL plperl procedural language. It allows an object creator to execute arbitrary code with the privileges of the operating system user running the database by re-entering plperl and freeing a prepared query during an outer invocation. This affects PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25.
CVE-2026-116306 is a high-severity type confusion vulnerability in PostgreSQL affecting composite-value field assignment. It allows an object creator to execute arbitrary code with the privileges of the operating system user running the database. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The vulnerability is fixed in these versions.
CVE-2026-116304 is a use-after-free vulnerability in PostgreSQL affecting versions before 18.7, 17.12, 16.16, 15.20, and 14.25. It involves improper coordination of anonymous RECORD type identifiers among parallel workers, allowing a database user to execute arbitrary code as the operating system user running the database.
CVE-2026-116303 is a vulnerability in PostgreSQL where missing authorization checks allow a database user to invoke cast functions without having EXECUTE privilege on those functions. This can occur via foreign keys, to_json(), and other mechanisms. The vulnerability affects PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25. Exploitation requires the attacker to identify access-restricted cast functions in each database and assess confidentiality impact, which is generally limited or rare. The CVSS score is low, reflecting limited impact and complexity.
Multiple vulnerabilities have been addressed in Citrix products including Secure Access Client, NetScaler ADC, NetScaler Gateway, and NetScaler Console. The specific details of these vulnerabilities and their impacts are not provided in the available information.
In late October 2026, attackers exploited PHP2Shell vulnerabilities in Check Point Mobile Access portals on Security Gateways, initially targeting Israeli organizations. The attackers gained root privileges, deployed PHP webshells for persistence, installed TSGA malware and TSProxy backdoors, and moved laterally to VMware ESXi infrastructure. The campaign culminated in deploying the destroy_v6 wiper and a politically-themed ransom rejection note. A second wave of scanning targeted organizations worldwide, indicating opportunistic attacks. The toolset is linked to the PhiliKit malware family and possibly Chinese-nexus actors, though attribution is uncertain.
An incorrect authorization vulnerability was found in AWX's WebSocket consumer. The consumer_access() function only enforces access controls for object-level event groups (job_events, workflow_events, ad_hoc_command_events) but does not restrict subscriptions to global broadcast groups such as 'jobs-status_changed'. When an authenticated user subscribes to a global broadcast group, the server accepts the subscription without verifying that the user has permission to view the associated resources. In multi-organization deployments, this allows a low-privilege user in one organization to receive real-time job status metadata from all organizations, including job IDs, status transitions, timestamps, and infrastructure topology details such as instance group names, bypassing the organization isolation enforced by the REST API.
CVE-2026-120869 is a critical vulnerability in Citrix NetScaler Console that allows an unauthenticated attacker to bypass authentication controls and access restricted resources. The flaw affects versions prior to 14.1-74.34. A fix is available in version 14.1-74.34.
CVE-2026-123039 is a high-severity vulnerability in Checkpoint's Quantum Security Gateway. The Gaia OS DynamicCLI daemon runs as root and listens on a world-writable local socket (/tmp/dynamic_socket) without authenticating connecting processes. This allows an authenticated local user to send commands to the socket and have them executed with root privileges.
CVE-2026-120490 is a vulnerability in Checkpoint Scalable Platforms (ElasticXL, Maestro, Chassis) where an administrator with permissions to edit and install Access Control Policy and NAT rules can create a NAT rule that redirects traffic to the Gateway's Sync interface. This bypasses the built-in Sync protection and could allow execution of operating system commands and file writes on the Gateway with superuser privileges. The CVSS score is 3.8, indicating low severity.
