Security
CVE Feed
Latest vulnerabilities from the National Vulnerability Database.
48124
Total
3850
Critical
14244
High
13921
Medium
| CVE ID | Severity | Score | Description | Published |
|---|---|---|---|---|
| CVE-2026-73585 | MEDIUM | 6.3 | A flaw was found in sblim-cmpi-base. Insecure temporary file creation in the provider registration scripts allows a local unprivileged user to perform a symlink attack. … | Aug 13, 2026 |
| CVE-2026-73584 | MEDIUM | 6.3 | A flaw was found in sblim-sfcb. A local, low-privileged attacker can exploit a race condition during privileged instance migration by manipulating a temporary file in … | Aug 13, 2026 |
| CVE-2026-73583 | MEDIUM | 6.6 | A flaw was found in sblim-sfcb. A local attacker with access to the system can exploit an unsafe deserialization vulnerability in the provider-manager's inter-process communication … | Aug 13, 2026 |
| CVE-2026-6471 | HIGH | 7.2 | Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, … | Aug 13, 2026 |
| CVE-2026-6470 | MEDIUM | 4.3 | Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a … | Aug 13, 2026 |
| CVE-2026-6469 | LOW | 3.8 | Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table … | Aug 13, 2026 |
| CVE-2026-6464 | HIGH | 8.1 | Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If … | Aug 13, 2026 |
| CVE-2026-49827 | CRITICAL | 9.8 | WebErpMesv2 is a Resource Management and Manufacturing execution system Web for industry. Versions 1.19 and prior allow any self-registered user to upload arbitrary PHP files … | Aug 13, 2026 |
| CVE-2026-49478 | HIGH | 8.7 | Fulcio is a certificate authority for issuing code signing certificates for an OpenID Connect (OIDC) identity. Versions through 1.8.5 improperly follow cross-host redirects and attach … | Aug 13, 2026 |
| CVE-2026-19385 | HIGH | 8.8 | Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running … | Aug 13, 2026 |
| CVE-2026-18408 | HIGH | 8.8 | Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client … | Aug 13, 2026 |
| CVE-2026-18024 | MEDIUM | 4.3 | Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a … | Aug 13, 2026 |
| CVE-2026-16241 | LOW | 3.8 | Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value … | Aug 13, 2026 |
| CVE-2026-16239 | HIGH | 8.8 | Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a … | Aug 13, 2026 |
| CVE-2026-16238 | HIGH | 8.8 | Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range … | Aug 13, 2026 |
| CVE-2026-15742 | HIGH | 8.8 | Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user … | Aug 13, 2026 |
| CVE-2026-15741 | HIGH | 8.8 | SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression … | Aug 13, 2026 |
| CVE-2026-14681 | MEDIUM | 4.2 | Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite … | Aug 13, 2026 |
| CVE-2026-14680 | HIGH | 8.8 | Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls … | Aug 13, 2026 |
| CVE-2026-14679 | HIGH | 8.2 | Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only … | Aug 13, 2026 |
| CVE-2026-14678 | MEDIUM | 4.3 | Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory … | Aug 13, 2026 |
| CVE-2026-14677 | HIGH | 8.8 | Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds … | Aug 13, 2026 |
| CVE-2026-14676 | HIGH | 8.8 | Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries … | Aug 13, 2026 |
| CVE-2026-14673 | LOW | 3.8 | Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that … | Aug 13, 2026 |
| CVE-2026-14672 | MEDIUM | 5.3 | Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This … | Aug 13, 2026 |