Threats affecting pkg:generic/htslib

A vulnerability in PostgreSQL involving external control of file names in the dblink and CREATE/ALTER SUBSCRIPTION features allows a user to cause persistent denial of service by appending invalid data to a chosen file. This occurs through the "sslkeylogfile" connection parameter, which appends data in NSS keylog format to a user-specified file but cannot add arbitrary bytes. The issue affects PostgreSQL major version 18 before minor version 18.7, and versions before 18 if libpq version 18 or later is used by the server.

CVE-2026-120154 is a vulnerability in PostgreSQL's INSERT ... ON CONFLICT feature that allows an attacker with INSERT, UPDATE, and applicable SELECT privileges on a table to read all rows in that table, bypassing row security policies. This issue affects PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25. Unlike a related vulnerability (CVE-2026-16237), this flaw does not allow unauthorized writes. The vulnerability has a medium severity with a CVSS score of 4.3.

A type confusion vulnerability in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code with the privileges of the operating system user running the database. This occurs via an output parameter of type "any". Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

A server-side request forgery (SSRF) vulnerability exists in JeecgBoot up to version 3.9.6, specifically in the RestTemplate.exchange function within the flow-run Endpoint component. This vulnerability allows remote attackers to manipulate requests, potentially leading to unauthorized internal network access or data exposure. Public exploit code is available, but no vendor response or patch has been provided.

ComfyUI-Easy-Use version 1.3.6 has a path traversal vulnerability in the save_preview() handler that allows an unauthenticated attacker to overwrite custom node Python entry points by uploading files to the custom_nodes directory. This can lead to arbitrary code execution with the privileges of the ComfyUI process upon restart.

CVE-2026-126996 is a medium severity vulnerability in SakanaAI text-to-LoRA version 0.0.1. It affects the get_tokenizer function in the src/hyper_llm_modulator/utils/model_loading.py file, where manipulation of the base_model_name_or_path argument can lead to a path traversal vulnerability. This flaw can be exploited remotely and has been publicly disclosed. The project has been informed but has not yet responded or issued a fix.

A type confusion vulnerability in PostgreSQL extended statistics allows an object creator to execute arbitrary code with the privileges of the operating system user running the database. This occurs via a statistics expression of an anonymous RECORD type whose backend-local type identifier denotes a different row type in another session. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

A SQL injection vulnerability exists in PostgreSQL extension-script substitutions that allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser. This occurs via schema or owner names containing newlines or special substrings. The issue affects PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25.

A use-after-free vulnerability in PostgreSQL's expanded-record domain checks allows an object creator to execute arbitrary code with the privileges of the operating system user running the database. This occurs due to repeated domain checks over a composite type that reuse a dangling memory-context pointer. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

A missing authorization check in PostgreSQL's REASSIGN OWNED command allows a role granted INHERIT but not SET privileges to transfer objects to the granted role. This flaw also permits reassignment of database ownership without requiring the CREATEDB privilege. The issue affects PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25. Equivalent ALTER ... OWNER commands do not exhibit this vulnerability.

A missing authorization vulnerability in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running a superuser-owned subscription. This affects only subscriptions owned by superusers. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are vulnerable.

A heap-based buffer overflow vulnerability exists in PostgreSQL foreign batch inserts, allowing a foreign server to execute arbitrary code by reporting that it inserted more rows than actually supplied. This affects PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25.

A type confusion vulnerability in PostgreSQL version 18 prior to 18.7 allows an object creator to execute arbitrary code as the operating system user running the database. The flaw arises from incomplete invalidation of the PostgreSQL type-cache during composite type changes while the cache entry is being populated. Versions before PostgreSQL 18 are not affected.

A type confusion vulnerability in PostgreSQL's plpgsql record-field assignment allows an object creator to execute arbitrary code with the privileges of the operating system user running the database. This occurs via a reentrant domain CHECK that modifies a RECORD variable's row type during a value cast. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

A use-after-free vulnerability exists in the PostgreSQL dblink extension that allows an object creator to execute arbitrary code with the privileges of the operating system user running the database. This occurs due to type conversion code that re-enters dblink and closes a connection while an outer dblink call is still reading its results. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

A use-after-free vulnerability exists in PostgreSQL's pg_show_all_settings() function that allows a database user to retrieve memory contents. This occurs when loading a module while the function scans custom-variable placeholders that the module replaces and frees. The issue affects PostgreSQL major versions 16 through 18, specifically versions prior to 18.7, 17.12, and 16.16. Versions before 16 are not affected.

A use-after-free vulnerability exists in PostgreSQL trigger functions that allows an object creator to execute arbitrary code with the privileges of the operating system user running the database. This issue arises via a cursor over a transition table. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The vulnerability has a high severity rating with a CVSS score of 8.8.

A type confusion vulnerability in PostgreSQL statistics import allows a table maintainer to execute arbitrary code as the operating system user running the database. This occurs via nested SET DATA TYPE during conversion of values to import. The issue affects PostgreSQL major version 18 prior to minor version 18.7. Versions before PostgreSQL 18 are not affected.

A vulnerability in PostgreSQL's REINDEX CONCURRENTLY operation on a dropped index allows an object creator to execute arbitrary code as the operating system user running the database. This issue affects versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25. The flaw arises from an index expression that issues DROP INDEX, enabling code execution.

A use-after-free vulnerability in the PostgreSQL portal setup allows an object creator to execute arbitrary code with the privileges of the operating system user running the database. This occurs when user-defined code runs during planning or executor startup and closes the portal currently being prepared. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.