Search: 17.9-6

CVE-2026-15742 is an integer overflow or wraparound vulnerability in PostgreSQL's fuzzystrmatch extension. It allows a user with database privileges to execute arbitrary code as the operating system user running the database by providing extreme inputs to the levenshtein() or levenshtein_less_equal() SQL functions. This affects multiple PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24.

CVE-2026-15741 is a high-severity SQL injection vulnerability in PostgreSQL's EXTRACT() deparse functionality. It allows an object owner to execute arbitrary SQL commands with superuser privileges via a malicious object definition. This affects various tools that consume expression deparses, including pg_dump and psql commands like \sf. Versions prior to PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are vulnerable.

CVE-2026-14679 is a stack-based buffer overflow vulnerability in PostgreSQL affecting versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. The flaw occurs during argument name matching for OUT parameters, allowing an object creator to write limited bytes (0x0 and 0x1) to the stack. This vulnerability has a high severity score of 8.2 and can lead to denial of service or other impacts on availability. No known exploits are reported in the wild. A fix is implied by the version boundaries but no explicit patch links or vendor advisory content are provided.

CVE-2026-14678 is a buffer over-read vulnerability in the pg_trgm index picksplit function of PostgreSQL. This flaw allows reading past the end of a heap buffer, potentially enabling a table maintainer to infer limited memory values through index split behavior. The vulnerability affects multiple PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. The CVSS score is 4.3, indicating medium severity.

Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system user running the database. CVE-2026-6473 had fixed similar problems. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

CVE-2026-14670 is a heap-based buffer overflow vulnerability in the PostgreSQL plperl extension. It allows a function owner to execute arbitrary code as the operating system user running the database by exploiting a crafted function body that returns a tied hash. This vulnerability affects multiple PostgreSQL versions prior to 18.6, 17.11, 16.15, 15.19, and 14.24. The vulnerability has a high severity with a CVSS score of 8.8.

Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case involved unanticipated data growth when round-tripped through pg_wchar. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

CVE-2026-14663 is a vulnerability in PostgreSQL's pgcrypto module where cleartext data can be recovered due to disabled ciphers in OpenSSL. This flaw affects multiple encryption and decryption functions, allowing decryption to succeed even with incorrect keys, thereby bypassing the Modification Detection Code (MDC) protection. Versions prior to PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. The vulnerability has a medium severity with a CVSS score of 6.5.

CVE-2026-14662 is an integer overflow or wraparound vulnerability in PostgreSQL's tsvector and tsquery data type functions. It allows an unprivileged database user to cause the server to undersize memory allocation and write out-of-bounds with crafted large inputs, potentially leading to arbitrary code execution as the operating system user running the database. The vulnerability affects PostgreSQL versions before 18.6, 17.11, 16.15, 15.19, and 14.24. Application users attacking through typical application interfaces are unlikely to exploit this issue because these types are usually sourced from application logic rather than directly from user input. Similar issues were addressed in CVE-2026-6473.

Deserialization of Untrusted Data vulnerability in ash-project ash allows an unauthenticated attacker to inject a filter expression through a forged keyset pagination cursor, resulting in SQL injection or code execution depending on the data layer. Read actions with keyset pagination decode the client-supplied page[:after] or page[:before] cursor in decode_values/2 in lib/ash/page/keyset.ex using non_executable_binary_to_term/2 with [:safe]. That guard blocks new atoms, funs, and ports, but not a struct built from atoms already interned in a running Ash application, so a decoded %Ash.Query.Call{} expression survives and is spliced into the keyset filter as a comparison value in do_filters/4 and evaluated. Because the cursor bypasses the Ash.Expr macro, the runtime never applies the private?/public? gate that would otherwise reject it. On AshPostgres the injected fragment is inlined into the SQL query; on the ETS and Simple data layers it is evaluated in-process as an arbitrary function call. This issue affects ash: from 1.17.0 before 3.31.3.

Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution.

Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain an Authentication Bypass by Spoofing vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution.

Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution.

Dell Display and Peripheral Manager (DDPM Windows), versions prior to 2.3.0.17, contain Improper Access Control vulnerability. A low privileged attacker with local access could potentially exploit this vulnerability, leading to Elevation of Privileges and arbitrary code execution.

GitLab has remediated an issue in GitLab CE/EE affecting all versions from 17.6 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user with developer role to modify certain package registry metadata without the required maintainer-level permissions due to improper authorization checks.

GitLab has remediated an issue in GitLab EE affecting all versions from 17.7 before 19.0.6, 19.1 before 19.1.4, and 19.2 before 19.2.2 that under certain conditions could have allowed an authenticated user to view restricted configuration settings due to improper authorization checks on a group settings page.

IBM WebSphere Application Server - Liberty 17.0.0.3 through 26.0.0.8 is vulnerable to a privilege escalation when using Liberty collectives.

Semaphore UI is a web interface for managing DevOps tools. Prior to 2.18.17 and 2.19.5-beta2, repository git_url handling passes an attacker-controlled --upload-pack option to CmdGitClient.GetLastRemoteCommitHash through POST /api/project/{id}/repositories and scheduled commit-hash polling, allowing a project Manager or Owner to execute arbitrary OS commands in the Semaphore server process. This issue is fixed in versions 2.18.17 and 2.19.5-beta2.

Quay 3.17.4