Export limit exceeded: 415253 CVEs match your query. Please refine your search to export 10,000 CVEs or fewer.
Search
Search Results (415253 CVEs found)
| CVE | Vendors | Products | Updated | CVSS v3.1 |
|---|---|---|---|---|
| CVE-2026-116323 | 2026-11-12 | 8.8 High | ||
| Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running the database, via a domain CHECK that re-enters the Tcl interpreter and frees or changes a string still used by the outer result conversion. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. | ||||
| CVE-2026-116322 | 2026-11-12 | 5.3 Medium | ||
| Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for authentication_timeout to arrive while it holds a spinlock during cancel handling. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected. | ||||
| CVE-2026-116321 | 2026-11-12 | 4.3 Medium | ||
| Improper null termination in PostgreSQL array element assignment allows a database user to disclose server memory, via changing the final byte of a fixed-length name value to a nonzero byte and passing it to code that treats the value as a C string. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. | ||||
| CVE-2026-116320 | 2026-11-12 | 8.8 High | ||
| Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via dropping the final reference to a Perl array or hash while PostgreSQL is converting that object. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. | ||||
| CVE-2026-116319 | 2026-11-12 | 8.8 High | ||
| Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via reentrant return_next() calls. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. | ||||
| CVE-2026-116318 | 2026-11-12 | 8.8 High | ||
| SQL injection in PostgreSQL pg_dump allows an object creator to execute arbitrary SQL as the user restoring the dump, via an inherited column having a child-local not-null constraint whose name requires quoting. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected. | ||||
| CVE-2026-116317 | 2026-11-12 | 8.8 High | ||
| Heap-based buffer overflow in PostgreSQL ts_rank_cd() may allow a database user to execute arbitrary code as the operating system user running the database, via an invalid tsvector containing duplicate positions. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. | ||||
| CVE-2026-116316 | 2026-11-12 | 8.8 High | ||
| Improper protection of alternate path in PostgreSQL security-restricted operations allows an object creator to execute arbitrary SQL as the operation's caller, via a domain, enum, or range type created in pg_temp. The victim session must later run a query containing an unqualified type name, e.g. "SELECT '1'::bigint"; autovacuum and other common security-restricted operation users do not do so, so they are unaffected. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. | ||||
| CVE-2026-116315 | 2026-11-12 | 8.8 High | ||
| Heap-based buffer overflow in PostgreSQL tsvector_delete() allows a database user to execute arbitrary code as the operating system user running the database, via a tsvector whose lexeme data uses a nonstandard but valid ordering that requires additional alignment padding in the result. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. | ||||
| CVE-2026-116314 | 2026-11-12 | 8.8 High | ||
| Improper input validation in PostgreSQL pg_restore allows a non-plain archive provider to execute arbitrary code as the operating system user running pg_restore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination, but it does not legitimately confer arbitrary code execution in the pg_restore OS process. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. | ||||
| CVE-2026-116313 | 2026-11-12 | 7.2 High | ||
| Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query. The pg_upgrade documentation recommends an affected vacuumdb invocation. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected. | ||||
| CVE-2026-116312 | 2026-11-12 | 5.4 Medium | ||
| Inconsistent transition-capture state in PostgreSQL MERGE allows a table data modifier to make an AFTER trigger process the wrong new row, via a partitioned table MERGE that performs an INSERT before an UPDATE. Within major versions 15-18, minor versions before PostgreSQL 18.7, 17.12, 16.16, and 15.20 are affected. Versions before PostgreSQL 15 are unaffected. | ||||
| CVE-2026-116311 | 2026-11-12 | 5.4 Medium | ||
| Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries after the DROP OWNED. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. | ||||
| CVE-2026-116310 | 2026-11-12 | 4.3 Medium | ||
| Use after free in PostgreSQL COPY FROM error reporting allows a database user to disclose portions of server memory, via a longer input row following an ignored or nullified conversion error. file_fdw reaches the same code path in affected version 18. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected. | ||||
| CVE-2026-116309 | 2026-11-12 | 8.8 High | ||
| Type confusion in PostgreSQL plperl may allow an object creator to execute arbitrary code, via blessing a non-hash reference into PostgreSQL::InServer::ARRAY. We have not confirmed or ruled out a way to control the pointer sufficiently to achieve security impact, but we are proceeding as though that is possible. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. | ||||
| CVE-2026-116308 | 2026-11-12 | 4.3 Medium | ||
| Buffer over-read in PostgreSQL dict_int allows a database user to disclose portions of server memory, via a zero-length token. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. | ||||
| CVE-2026-116307 | 2026-11-12 | 8.8 High | ||
| Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via re-entering plperl and freeing a prepared query while an outer invocation is executing it. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. | ||||
| CVE-2026-111824 | 1 Apache | 1 Roller | 2026-11-12 | N/A |
| Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in Apache Roller 6.1.6 allows an authenticated user with the Author role on a weblog that uses a custom theme to store script that runs in the browser of anyone who opens the file's resource URL. The fix for CVE-2026-82387 serves uploaded media as a download unless it is an image, audio, video, PDF or plain text, but media files found through a custom theme were served with the type their path implies, and the upload form let the uploader choose that path. Media uploads are disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which serves these files under the same rules as other media and no longer accepts the path from the upload form. | ||||
| CVE-2026-118408 | 1 Apache | 1 Roller | 2026-11-12 | 3.1 Low |
| Missing Authorization in Apache Roller 4.0 through 6.1.6 allows any logged-in user to read unpublished entries of a weblog they have no role in. The entry preview checked that the user was logged in, but not that the user had a role in the weblog being previewed. The attacker must know the weblog name and the entry's link name. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which requires a role in the weblog to preview its entries. | ||||
| CVE-2026-118410 | 1 Apache | 1 Roller | 2026-11-12 | 3.7 Low |
| Exposure of Resource to Wrong Sphere in Apache Roller 4.0 through 6.1.6 allows an unauthenticated visitor to read an entry after its author has withdrawn it to draft through the AtomPub API. The entry was removed from the weblog but stayed in the search index, and public search showed its content. AtomPub is disabled by default. Users are recommended to upgrade to Apache Roller 6.1.7 or later, which shows only published entries in search results. | ||||