https://vulnerability.circl.lu/rss/recent/all/10 Most recent entries from all 2026-10-10T01:24:10.424775+00:00 Vulnerability-Lookup info@circl.lu python-feedgen Contains only the most 10 recent entries. https://vulnerability.circl.lu/vuln/cve-2026-6464 CVE-2026-6464 — PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands 2026-10-10T01:24:10.427893+00:00

Affected: PostgreSQL

Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that it awaits input rows, psql processes the in-line data rows as psql commands. "COPY FROM" with a filename is unaffected. The server administrator has no inherent control over the data rows, so a complete attack requires the attacker to separately acquire control of both the server and the data rows. Alternatively, an attacker controlling data rows alone might complete an attack through a coincidental error that they don't control. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.

 https://vulnerability.circl.lu/vuln/usn-8653-1 USN-8653-1 — postgresql-14, postgresql-16, postgresql-18 vulnerabilities 2026-10-10T01:24:10.428006+00:00

Affected: Ubuntu:22.04:LTS: postgresql-14, Ubuntu:24.04:LTS: postgresql-16, Ubuntu:26.04:LTS: postgresql-18

It was discovered that PostgreSQL incorrectly handled COPY FROM STDIN when an early failure occurred. An authenticated user could possibly use this issue to execute arbitrary SQL commands. (CVE-2026-6464)

It was discovered that PostgreSQL incorrectly reset extended statistics ownership during ALTER TABLE ALTER TYPE operations. An attacker could possibly use this issue to obtain sensitive information or gain unintended privileges. (CVE-2026-6469)

It was discovered that PostgreSQL failed to check the USAGE privilege on types. An authenticated user could possibly use this issue to obtain sensitive information. (CVE-2026-6470)

It was discovered that PostgreSQL logical decoding could load arbitrary shared libraries. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-6471)

It was discovered that PostgreSQL had integer wraparound issues in tsvector and tsquery allocations. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14662)

It was discovered that PostgreSQL pgcrypto silently used cleartext when OpenSSL-disabled ciphers were requested. An authenticated user could possibly use this issue to obtain sensitive information. (CVE-2026-14663)

It was discovered that PostgreSQL had a heap buffer overflow in regular expression processing. An authenticated user could possibly use this issue to execute arbitrary code. (CVE-2026-14664)

It was discovered that PostgreSQL row security policies were not properly…