Threats affecting pkg:bitnami/postgresql

Improper Privilege Management vulnerability in Apache Syncope. AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication. This issue affects Apache Syncope: from 3.0.12 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.

Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expression is executed directly on the server, with no sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue by rejecting BPMN definitions including expression attributes.

A security update for the Linux kernel in Red Hat Enterprise Linux 10 addresses a vulnerability identified as CVE-2026-98432. The flaw involves improper freeing of inet_opt and ireq_opt after an RCU grace period in the IPv4 networking code. This update also includes a bug fix related to the NVIDIA GPU vfio_pci module alias. The update is rated as important by Red Hat Product Security and requires a system reboot to take effect.

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

Multiple heap buffer overflow vulnerabilities were identified in the libsoup HTTP client and server library for GNOME, specifically related to WebSocket handling. These include issues from WebSocket Pong signal type confusion, message reassembly, receive-buffer growth, and client-frame masking. Red Hat has issued an important security update addressing these vulnerabilities in Red Hat Enterprise Linux 8.6. The update mitigates the risk of potential memory corruption caused by these heap buffer overflows.

A security vulnerability in the pki-core component of Red Hat Certificate System allows code execution via unsanitized profile content in certprofile-import (CVE-2026-76561). This issue affects Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Telecommunications Update Service. Red Hat has released an important security update to address this vulnerability.

Red Hat has issued a security advisory for the opentelemetry-collector component in Red Hat Enterprise Linux 9.8 Extended Update Support. The update addresses multiple denial of service vulnerabilities in various Go language packages used by the collector, as well as a man-in-the-middle vulnerability involving untrusted intermediate certificates. The vulnerabilities include crafted HTTP Range headers, excessive HTTP/2 SETTINGS frames, memory limit bypass in multipart form parsing, multiple ECH outer extension references, and untrusted intermediate certificates. These issues could allow denial of service attacks or man-in-the-middle attacks if exploited.

Dell OpenManage Enterprise versions prior to 4.8.0 contain a path traversal vulnerability (CWE-22) that allows a high privileged attacker with adjacent network access to potentially access the filesystem. This vulnerability is fixed in version 4.8.0 and later.

Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-register allows Privilege Escalation. This issue affects eta-register: from 2.0.8 before 2.0.9.

Dell OpenManage Enterprise versions prior to 4.8.0 contain a vulnerability involving incorrect permission assignment for a critical resource. This flaw allows a low privileged local attacker to bypass protection mechanisms. The vulnerability has a medium severity rating with a CVSS score of 5.5. A fix is available in version 4.8.0 and later.

This analysis covers a Horus Loader 64-bit Windows loader sample linked to the Stealth Falcon campaign and CVE-2025-33053. The loader employs techniques such as IP obfuscation, WebDAV execution, and integrates with the Mythic command and control (C2) framework. It performs clean kernel32/ntdll mapping, security process checks, IPv6 payload reconstruction, and injection into suspended msedge.exe processes.

Dell OpenManage Enterprise versions prior to 4.8.0 have an improper verification of cryptographic signatures vulnerability (CWE-347). This flaw allows a high privileged local attacker to potentially gain unauthorized filesystem access. The vulnerability has a CVSS 3.1 score of 6.4, indicating a medium severity. A fix is available starting from version 4.8.0.

A bug fix and enhancement update for the Red Hat Real Time Linux Kernel addresses an assertion failure in the gfs2_glock_hold() function on RHEL-8 systems.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Incorrect Permission Assignment for Critical Resource vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Protection mechanism bypass.

Multiple security vulnerabilities have been identified in Flatpak, a system for building, distributing, and running sandboxed desktop applications on Linux. These include arbitrary code execution due to missing symlink protection, arbitrary write access as root via extra-data extraction, a buffer overflow in OCI delta stream path names on 32-bit systems, and local privilege escalation via symlink traversal in the revokefs writer. Red Hat has issued an important security update addressing these issues for Red Hat Enterprise Linux 10.0 Extended Update Support and related products.

Dell OpenManage Enterprise, versions prior to 4.8.0, contains an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability. A low privileged attacker with adjacent network access could potentially exploit this vulnerability, leading to Command execution.

CVE-2026-118871 is an SQL injection vulnerability that allows attackers with login access to steal database information. The vulnerability is classified with a medium severity score of 6.5 and requires low privileges to exploit. No public exploits or patches are currently documented.

This vulnerability involves the logging of irrelevant properties by an Event Publisher output adapter, which can include sensitive user credentials or confidential information if misconfigured. An attacker with access to the 'wso2carbon' log files could extract this sensitive data, potentially leading to unauthorized access. The issue is due to improper handling of configuration properties in logging.

CVE-2025-13647 is a vulnerability where the affected component does not properly validate the content-type header in certain requests. This flaw allows attackers to craft requests with manipulated content-type headers, leading to unintended exposure of file paths for certificate files. The information disclosure could aid attackers in further compromising system confidentiality. The vulnerability has a medium severity with a CVSS score of 5.8.