psqlODBC before 18.00.0006 hit by stack buffer overflow
Canadian Centre for Cyber Security advisory AV26-1115 warns psqlODBC users must upgrade to 18.00.0006 to fix large-object read buffer overflow in ODBC escape parser.
Stories per day · 30 days
Relatedbuffer-overflow1hnsw1ivfflat1managed-database1odbc1pg-cron1pgvector1privilege-escalation1psqlodbc1snowflake1timescale1vector-search1
13 stories, newest first · one card per story
Stories tagged #postgresql
Snowflake Postgres role chain reached OS command execution, now fixed
Varonis chained CREATEROLE, pg_cron, and archive_command in its own test tenant; Snowflake patched before publication.
2
Pg_vectorsearch: An index that is faster than pgvector's IVFFlat and HNSW
Timescale's pg_vectorsearch claims a PostgreSQL vector index faster than pgvector IVFFlat and HNSW.
Update modules/auxiliary/scanner/postgres/postgres_login.rb
Rapid7 updated Metasploit's PostgreSQL login scanner module, with no vulnerability details disclosed.
Epistemic Typing as a PostgreSQL Table Access Method: Adversarial Conflict Resolution Under Confidence Forgery and Sybil Coordination
KNDB, a PostgreSQL 18 access method, resists confidence forgery and Sybil writes using engine-assigned epistemic types.
Misconfigured Supabase apps expose data in over 16,000 databases
UpGuard found over 16,000 misconfigured Supabase databases exposing PII, passwords, tokens, and some payment data.
3
Critical pgAdmin Authentication Bypass Lets Attackers Login as Administrator Without Credentials
pgAdmin 4 versions 6.2-9.17 contain critical auth bypass CVE-2026-86863 (CVSS 9.8) letting unauthenticated attackers impersonate administrators; fixed in 9.18.
3
Weekly Cybersecurity Newsletter Bulletin – Microsoft 0-day, FortiOS, PAN-OS Flaw, Revolut Data Breach, and 20+ Stories
Weekly roundup: Microsoft patches 973 flaws including two actively exploited zero-days; FortiOS CAPWAP flaw deploys PivotC2 RAT; PAN-OS root RCE disclosed.
USN-8743-1: PHP vulnerabilities
Ubuntu fixes three PHP flaws, including SQL injection in the PostgreSQL extension (CVE-2026-17543) and an out-of-bounds write in bccomp().
PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution
PostgreSQL fixed CVE-2026-6471 (CVSS 7.2), a 12-year-old logical decoding flaw letting replication-role accounts execute arbitrary code as the database OS user.
3
PostgreSQL Hit by 12-Year-Old Vulnerability Allowing Server Takeover
PostgreSQL flaw CVE-2026-6471, present since 2014, lets low-privilege replication accounts execute code and take over database servers; patches released.
3
Decade-old PostgreSQL flaw turns backup account into a backdoor
Cyera disclosed CVE-2026-6471, a decade-old PostgreSQL flaw letting REPLICATION-attribute accounts achieve RCE and superuser compromise, patched August 13.
3
CVE-2026-9586 | Sangoma Switchvox Unauthenticated SQL Injection Remote Code Execution Vulnerability
CVE-2026-9586, a critical unauthenticated SQL injection to RCE in Sangoma Switchvox, is being actively exploited against internet-facing systems per honeypot observations.
3