Threats affecting pkg:bitnami/postgresql

Joomla Extension - regularlabs.com - Exposure of Sensitive Information to Unauthorized Actor in Users Anywhere extension for Joomla < 3.0.1 - An administrator can disable output of user email addresses or usernames in Users Anywhere. In affected code, attributes supplied inside a {user} or [email] / [username] tag can change those plugin settings for that render. For example, [email allow_output_email="1"] can display an email address even when Allow output of email is set to No. This bypasses the personal-data output setting; it does not bypass a separate policy that disallows Users Anywhere tags from the content source altogether.

A security vulnerability (CVE-2026-32597) in the Python JWT library (pyjwt) allows acceptance of unknown 'crit' header extensions, violating RFC 7515 section 4.1.11 requirements. This issue affects certain Red Hat Enterprise Linux 8.6 packages and has been rated with an Important security impact by Red Hat. A security update is available to address this issue.

CVE-2026-114364 is an SQL injection vulnerability in Apache Syncope affecting versions 3.0.0-M0 through 3.0.16, 4.0.0-M0 through 4.0.8, and 4.1.0-M0 through 4.1.3. It is an incomplete fix of a previous vulnerability (CVE-2026-77051) that allows an administrator with sufficient privileges to execute arbitrary SQL commands via unsanitized opEvent parameters. Users are advised to upgrade to versions 4.0.9 or 4.1.4 to remediate this issue.

Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements for Implementations can create a malicious Groovy class running untrusted code on a separate Thread, thus bypassing the Groovy security sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.

Authorization bypass through User-Controlled key vulnerability in Apache Syncope. A delegated administrator can relocate a Realm subtree across administrative realm boundaries without permission for the destination This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.

Warracker versions before 1.0.4 have a missing authorization vulnerability in the Paperless-ngx integration. Authenticated non-administrative users can bypass document ownership restrictions by linking another user's private document ID to their own warranty using the 'other' document type. This allows unauthorized read access to private documents via insufficient authorization checks in specific route handlers.

Improper Privilege Management vulnerability in Apache Syncope. AuthProfile self-updates allow non-admin users to configure impersonation for WA surrogate authentication. This issue affects Apache Syncope: from 3.0.12 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0-M0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue.

Improper isolation or compartmentalization vulnerability in Apache Syncope. An administrator with adequate entitlements can import arbitrary BPMN process definitions via the REST API and then start the process. When a BPMN process containing a JUEL expression is imported and started, the expression is executed directly on the server, with no sandbox. This issue affects Apache Syncope: from 3.0.0-M0 through 3.0.16, from 4.0.0-M0 through 4.0.8, from 4.1.0 through 4.1.3. Users are recommended to upgrade to version 4.0.9 / 4.1.4, which fix this issue by rejecting BPMN definitions including expression attributes.

A security update for the Linux kernel in Red Hat Enterprise Linux 10 addresses a vulnerability identified as CVE-2026-98432. The flaw involves improper freeing of inet_opt and ireq_opt after an RCU grace period in the IPv4 networking code. This update also includes a bug fix related to the NVIDIA GPU vfio_pci module alias. The update is rated as important by Red Hat Product Security and requires a system reboot to take effect.

An authentication bypass in Barracuda Email Security Gateway versions earlier than 9.4.0.030 allows an unauthenticated remote attacker to invoke a configuration-import function and restore a crafted, compatible backup archive, resulting in unauthorized modification of the appliance’s global configuration.

Improper neutralization of shell metacharacters in the timezone configuration field in certain Barracuda appliance products using common Barracuda code allows an authenticated administrator to inject OS commands that execute with root privileges when the crafted timezone value is subsequently processed.

Multiple heap buffer overflow vulnerabilities were identified in the libsoup HTTP client and server library for GNOME, specifically related to WebSocket handling. These include issues from WebSocket Pong signal type confusion, message reassembly, receive-buffer growth, and client-frame masking. Red Hat has issued an important security update addressing these vulnerabilities in Red Hat Enterprise Linux 8.6. The update mitigates the risk of potential memory corruption caused by these heap buffer overflows.

A security vulnerability in the pki-core component of Red Hat Certificate System allows code execution via unsanitized profile content in certprofile-import (CVE-2026-76561). This issue affects Red Hat Enterprise Linux 8.8 Update Services for SAP Solutions and Telecommunications Update Service. Red Hat has released an important security update to address this vulnerability.

CVE-2026-84375 is a denial of service vulnerability in the js-yaml JavaScript YAML parser used in Red Hat OpenShift Virtualization v4.22 images. The flaw allows an attacker to craft a specially designed YAML document that triggers excessive CPU consumption due to inefficient processing of merge keys with empty sources. This can cause prolonged CPU usage and potentially exhaust system resources when parsing untrusted YAML input.

Red Hat has issued a security advisory for the opentelemetry-collector component in Red Hat Enterprise Linux 9.8 Extended Update Support. The update addresses multiple denial of service vulnerabilities in various Go language packages used by the collector, as well as a man-in-the-middle vulnerability involving untrusted intermediate certificates. The vulnerabilities include crafted HTTP Range headers, excessive HTTP/2 SETTINGS frames, memory limit bypass in multipart form parsing, multiple ECH outer extension references, and untrusted intermediate certificates. These issues could allow denial of service attacks or man-in-the-middle attacks if exploited.

Dell OpenManage Enterprise versions prior to 4.8.0 contain a path traversal vulnerability (CWE-22) that allows a high privileged attacker with adjacent network access to potentially access the filesystem. This vulnerability is fixed in version 4.8.0 and later.

Missing Authorization vulnerability in TÜBİTAK BİLGEM Software Technologies Research Institute eta-register allows Privilege Escalation. This issue affects eta-register: from 2.0.8 before 2.0.9.

Dell OpenManage Enterprise versions prior to 4.8.0 contain a vulnerability involving incorrect permission assignment for a critical resource. This flaw allows a low privileged local attacker to bypass protection mechanisms. The vulnerability has a medium severity rating with a CVSS score of 5.5. A fix is available in version 4.8.0 and later.

This analysis covers a Horus Loader 64-bit Windows loader sample linked to the Stealth Falcon campaign and CVE-2025-33053. The loader employs techniques such as IP obfuscation, WebDAV execution, and integrates with the Mythic command and control (C2) framework. It performs clean kernel32/ntdll mapping, security process checks, IPv6 payload reconstruction, and injection into suspended msedge.exe processes.

CVE-2026-33818 is a denial of service vulnerability in the Go encoding/asn1 package used by Red Hat OpenShift Virtualization v4.14 images. An attacker can supply a specially crafted, deeply nested ASN.1 structure that causes excessive recursion during unmarshalling, leading to stack exhaustion and service unavailability. The flaw can be triggered remotely without authentication. Red Hat has released updated OpenShift Virtualization v4.14 images containing fixes and enhancements. No direct mitigation other than applying the updated images is currently recommended.