CVE-2026-15741 is a high-severity SQL injection vulnerability in PostgreSQL's EXTRACT() deparse functionality. It allows an object owner to execute arbitrary SQL commands with superuser privileges via a malicious object definition. This affects various tools that consume expression deparses, including pg_dump and psql commands like \sf. Versions prior to PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are vulnerable.
CVE-2026-14679 is a stack-based buffer overflow vulnerability in PostgreSQL affecting versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. The flaw occurs during argument name matching for OUT parameters, allowing an object creator to write limited bytes (0x0 and 0x1) to the stack. This vulnerability has a high severity score of 8.2 and can lead to denial of service or other impacts on availability. No known exploits are reported in the wild. A fix is implied by the version boundaries but no explicit patch links or vendor advisory content are provided.
CVE-2026-14678 is a buffer over-read vulnerability in the pg_trgm index picksplit function of PostgreSQL. This flaw allows reading past the end of a heap buffer, potentially enabling a table maintainer to infer limited memory values through index split behavior. The vulnerability affects multiple PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. The CVSS score is 4.3, indicating medium severity.
Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14670 is a heap-based buffer overflow vulnerability in the PostgreSQL plperl extension. It allows a function owner to execute arbitrary code as the operating system user running the database by exploiting a crafted function body that returns a tied hash. This vulnerability affects multiple PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. The vulnerability has a high severity with a CVSS score of 8.8.
Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-14663 is a vulnerability in PostgreSQL's pgcrypto module where cleartext data can be recovered due to disabled ciphers in OpenSSL. This flaw affects multiple encryption and decryption functions, allowing decryption to succeed even with incorrect keys, thereby bypassing the Modification Detection Code (MDC) protection. Versions prior to PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. The vulnerability has a medium severity with a CVSS score of 6.5.
CVE-2026-14662 is an integer overflow or wraparound vulnerability in PostgreSQL's tsvector and tsquery data type functions. It allows an unprivileged database user to cause the server to undersize memory allocation and write out-of-bounds with crafted large inputs, potentially leading to arbitrary code execution as the operating system user running the database. The vulnerability affects PostgreSQL versions before 18.6, 17.11, 16.15, 15.19, and 14.24. Application users attacking through typical application interfaces are unlikely to exploit this issue because these types are usually sourced from application logic rather than directly from user input. Similar issues were addressed in CVE-2026-6473.
In the Linux kernel, the following vulnerability has been resolved: super: fix emergency thaw deadlock on frozen block devices do_thaw_all_callback() calls bdev_thaw() while holding sb->s_umount exclusively. If the block device was frozen via bdev_freeze() dropping the last block layer freeze reference calls fs_bdev_thaw() which reacquires s_umount: do_thaw_all_callback(sb) super_lock_excl(sb) # holds sb->s_umount bdev_thaw(sb->s_bdev) mutex_lock(&bdev->bd_fsfreeze_mutex) # bd_fsfreeze_count drops 1 -> 0 bd_holder_ops->thaw == fs_bdev_thaw get_bdev_super(bdev) bdev_super_lock(bdev, true) super_lock(sb, true) down_write(&sb->s_umount) # same task: deadlock The emergency thaw worker deadlocks against itself holding both s_umount and bd_fsfreeze_mutex. That fscks any subsequent unmount, freeze, or thaw of that filesystem and block device. [ 81.878470] sysrq: Show Blocked State [ 81.880140] task:kworker/0:1 state:D stack:0 pid:11 tgid:11 ppid:2 task_flags:0x4208060 flags:0x00080000 [ 81.884876] Workqueue: events do_thaw_all [ 81.886656] Call Trace: [ 81.887759] <TASK> [ 81.888763] __schedule+0x579/0x1420 [ 81.890372] schedule+0x3a/0x100 [ 81.891794] schedule_preempt_disabled+0x15/0x30 [ 81.893848] rwsem_down_write_slowpath+0x1ea/0x900 [ 81.895191] ? __pfx_do_thaw_all_callback+0x10/0x10 [ 81.896528] down_write+0xbd/0xc0 [ 81.897505] super_lock+0x91/0x180 [ 81.898457] ? __mutex_lock+0xa99/0x1140 [ 81.900748] ? __mutex_unlock_slowpath+0x1f/0x400 [ 81.902069] bdev_super_lock+0x5b/0x150 [ 81.903132] get_bdev_super+0x10/0x60 [ 81.904042] fs_bdev_thaw+0x23/0xf0 [ 81.904755] bdev_thaw+0x82/0x100 [ 81.905484] do_thaw_all_callback+0x2c/0x50 [ 81.906298] __iterate_supers+0x5d/0x130 [ 81.907067] do_thaw_all+0x20/0x40 [ 81.907739] process_one_work+0x206/0x5e0 [ 81.908545] worker_thread+0x1e2/0x3c0 [ 81.909339] ? __pfx_worker_thread+0x10/0x10 [ 81.910171] kthread+0xf4/0x130 [ 81.910799] ? __pfx_kthread+0x10/0x10 [ 81.911528] ret_from_fork+0x2e2/0x3b0 [ 81.912259] ? __pfx_kthread+0x10/0x10 [ 81.913010] ret_from_fork_asm+0x1a/0x30 [ 81.913806] </TASK> bdev_super_lock() even documents the violated requirement with lockdep_assert_not_held(&sb->s_umount). Acquiring bd_fsfreeze_mutex under s_umount also inverts the bd_fsfreeze_mutex vs. s_umount ordering established by bdev_{freeze,thaw}() and can thus ABBA against a concurrent block-layer freeze even when the recursive path isn't hit. Fix this by not holding s_umount around the bdev_thaw() loop at all. Pin the superblock with an active reference instead as filesystems_freeze_callback() does. The active reference keeps the superblock from being shut down and so ->s_bdev stays valid without holding s_umount. The block-layer-held freeze is dropped by fs_bdev_thaw() with FREEZE_MAY_NEST | FREEZE_HOLDER_USERSPACE exactly as a regular unfreeze would and thaw_super_locked() handles filesystem-level freezes as before. The emergency thaw path has deadlocked like this in one form or another for a long long time but the current exclusively-held shape dates back to commit [1] where thaw_bdev() already ended in thaw_super() with s_umount held by do_thaw_all_callback().
A vulnerability in the Linux kernel's libceph component was resolved, addressing unsafe bare decode operations in the decode_lockers() function. These unsafe decodes could allow a malicious or compromised Ceph OSD to trigger slab-out-of-bounds reads, potentially leading to memory corruption. The flaw involves missing bounds checks before decoding certain fields, which could result in out-of-bounds reads and influence over lock type fields. The issue affects Linux Azure kernel versions including 3.0 and several 4.11.x, 4.13.x, and 4.15.x builds. A patch is available that replaces unsafe decode calls with safe variants, preventing out-of-bounds reads. The vulnerability has a CVSS score of 9.8, indicating high severity. No known exploits in the wild have been reported. The vulnerability is relevant in multi-tenant Ceph deployments where a malicious OSD can trigger the flaw against kernel clients using the lock.get_info method.
Consul Community Edition and Consul Enterprise 1.13.0 through 2.0.2 are vulnerable to an unauthenticated denial of service through unbounded connection acceptance on the external gRPC listeners. A remote attacker may exhaust agent file descriptors, goroutines, and memory by opening many incomplete connections, potentially preventing legitimate clients from connecting. This vulnerability, CVE-2026-15972, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Consul Community Edition and Consul Enterprise 1.20.1 through 2.0.2 are vulnerable to an L7 intention authorization bypass when a service proxy is configured with a custom public listener. An authenticated mesh workload may reach HTTP paths that are blocked by a path-based deny intention. This vulnerability, CVE-2026-15970, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Consul Community Edition and Consul Enterprise 1.2.0 through 2.0.2 are vulnerable to an uncontrolled resource consumption issue in the Connect CA roots endpoint that may allow a remote caller to grow the agent's Connect CA roots cache without bound, defeating the operator's cache-disable configuration. This vulnerability, CVE-2026-19015, is fixed in Consul 2.0.3 and Consul Enterprise 1.21.17, 1.22.11, and 2.0.3.
Dinky's SysConfigController.getAll() handler for GET /api/sysConfig/getAll carries a method-level @SaIgnore annotation that short-circuits the class-level @SaCheckLogin, so the Sa-Token interceptor lets the request through with no session or role check. Any remote unauthenticated caller who can reach the Dinky HTTP port (8888 by default) receives the full live system configuration (54 entries on a stock v1.2.5 install) with one parameterless GET. Only one credential field (sys.maven.settings.repositoryPassword) has a desensitization handler wired; the other credential-bearing fields (sys.env.settings.dinkyToken, sys.ldap.settings.userPassword, sys.resource.settings.oss.accessKey and secretKey, and sys.dolphinscheduler.settings.token) return in cleartext. A bare install leaks the shipped defaults, including the hardcoded dinkyToken efda1551-7958-4e0f-80a8-dfd107df3e38 and minioadmin/minioadmin OSS keys; once an operator configures LDAP, object storage, or DolphinScheduler through the Settings Center, those live third-party credentials leak from the same endpoint. Because dinkyToken is the sole gate on the sibling POST /download/uploadFromRsByLocal arbitrary file write, this disclosure defeats token rotation as a mitigation for that vulnerability. Affects Dinky v1.2.5 (the current release, 2025-11-05) and the development branch (dev HEAD 63b5a5a), where the affected code is byte-identical.
A malicious file identified by the SHA-256 hash 848f1546a84dd92cce3c1463e3e964698533d93d6ea7be00e000db5efbb1d2f4 was observed by OffSeq Mirage honeypot sensors eight times between August 6 and August 11, 2026. The file is associated with attacker activity involving the MITRE ATT&CK technique T1105 (Ingress Tool Transfer). The malicious payload could be a dropper, web shell, miner, or post-exploitation tool. The attacker infrastructure was observed in Chile (CL) and China (CN). There is no known exploit in the wild or vendor patch information available. Organizations are advised to match this hash against files in their environment and threat intelligence feeds.
The Content Egg – Affiliate Product Importer & Price Comparison WordPress plugin up to version 11.3.0 contains a path traversal vulnerability that allows authenticated users with author-level access or higher to delete arbitrary files on the server. This occurs because the plugin insufficiently validates the 'img_file' field, enabling crafted input to bypass filtering and cause deletion via PHP's unlink() function. This vulnerability can lead to denial of service or potentially remote code execution if critical files are deleted.
The Smash Balloon Social Photo Feed – Easy Social Feeds Plugin for WordPress contains a reflected cross-site scripting (XSS) vulnerability in all versions up to and including 6.11.3. This vulnerability arises from insufficient input sanitization and output escaping of the REQUEST_URI query string, allowing unauthenticated attackers to inject arbitrary scripts that execute when a user interacts with a crafted link. The vulnerability has a medium severity rating with a CVSS score of 4.7.
A malicious file identified by the SHA-256 hash 4af5a5c98ad132095c6fbe7b02c242153a190a01cc321e50a916a0ca46fbaa62 was observed 618 times in attacker activity between August 4 and August 11, 2026. The file is associated with the MITRE ATT&CK technique T1105 (Ingress Tool Transfer) and was seen originating from attacker infrastructure in Germany. This hash fingerprints a specific malicious payload that could be a dropper, web shell, miner, or post-exploitation tool. Organizations are advised to match this hash against files in their environments and security tools to detect potential compromise.