Vulnerability-Lookup

URL	Tags
https://www.postgresql.org/support/security/CVE-2…

Vendor	Product	Version	CPE status
n/a	PostgreSQL	Affected: 18 , < 18.4 (rpm) Affected: 17 , < 17.10 (rpm) Affected: 16 , < 16.14 (rpm) Affected: 15 , < 15.18 (rpm) Affected: 0 , < 14.23 (rpm)

CERTFR-2026-AVI-1056

Vulnerability from certfr_avis - Published: 2026-08-20 - Updated: 2026-08-20

De multiples vulnérabilités ont été découvertes dans les produits Splunk. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, une élévation de privilèges et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Splunk	N/A	MS Graph pour Active Directory app pour Splunk SOAR versions antérieures à 1.5.2
Splunk	N/A	Venafi app pour Splunk SOAR versions antérieures à 2.1.4
Splunk	Universal Forwarder	Splunk Universal Forwarder versions 10.0.x antérieures à 10.0.9
Splunk	N/A	AWS IAM app pour Splunk SOAR versions antérieures à 2.1.9
Splunk	N/A	Azure AD Graph app pour Splunk SOAR versions antérieures à 2.5.3
Splunk	SOAR	Splunk SOAR versions antérieures à 8.6.0
Splunk	Splunk	Splunk Connect pour Kafka versions antérieures à 2.2.7
Splunk	Splunk Enterprise	Splunk Enterprise versions 9.4.x antérieures à 9.4.14
Splunk	N/A	FireAMP versions 2.1.x antérieures à 2.1.15
Splunk	N/A	Zoom app pour Splunk SOAR versions antérieures à 3.2.2
Splunk	N/A	Phantom app pour Splunk SOAR versions antérieures à 3.8.5
Splunk	Splunk	Splunk On-Call (VictorOps) versions antérieures à 1.0.43
Splunk	Splunk	Splunk Attack Analyzer Connector pour Splunk SOAR versions 2.2.x antérieures à 2.2.1
Splunk	Splunk	Splunk MCP Server app versions antérieures à 1.2.1
Splunk	Splunk Enterprise	Splunk Enterprise versions 10.4.x antérieures à 10.4.2
Splunk	N/A	AD LDAP app pour Splunk SOAR versions antérieures à 2.3.8
Splunk	Splunk Enterprise	Splunk Enterprise versions 10.2.x antérieures à 10.2.6
Splunk	Universal Forwarder	Splunk Universal Forwarder versions 9.4.x antérieures à 9.4.14
Splunk	Splunk AI Toolkit	Splunk AI Toolkit versions antérieures à 6.0.1
Splunk	Universal Forwarder	Splunk Universal Forwarder versions 10.2.x antérieures à 10.2.6
Splunk	N/A	Cisco Talos Intelligence pour Enterprise Security Cloud versions antérieures à 1.0.3
Splunk	Splunk Enterprise	Splunk Enterprise versions 10.0.x antérieures à 10.0.9
Splunk	N/A	CrowdStrike OAuth API app pour Splunk SOAR versions antérieures à 5.1.3
Splunk	Enterprise Security	Splunk Enterprise Security versions antérieures à 8.6.1
Splunk	N/A	Nmap Scanner versions 3.0.x antérieures à 3.0.15
Splunk	N/A	RSA SecurID Authentication Manager app pour Splunk SOAR versions antérieures à 1.0.5
Splunk	N/A	Cisco Secure Malware Analytics app pour Splunk SOAR versions antérieures à 2.4.5
Splunk	N/A	Cisco Webex app pour Splunk SOAR versions antérieures à 2.2.1
Splunk	Universal Forwarder	Splunk Universal Forwarder versions 10.4.x antérieures à 10.4.2

References

Title

Publication Time

Tags

Bulletin de sécurité Splunk SVD-2026-0807	2026-08-19	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0805	2026-08-19	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0803	2026-08-19	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0802	2026-08-19	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0801	2026-08-19	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0808	2026-08-19	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0806	2026-08-19	vendor-advisory
Bulletin de sécurité Splunk SVD-2026-0804	2026-08-19	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "MS Graph pour Active Directory app pour Splunk SOAR versions ant\u00e9rieures \u00e0 1.5.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Venafi app pour Splunk SOAR versions ant\u00e9rieures \u00e0 2.1.4",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Universal Forwarder versions 10.0.x ant\u00e9rieures \u00e0 10.0.9",
      "product": {
        "name": "Universal Forwarder",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "AWS IAM app pour Splunk SOAR versions ant\u00e9rieures \u00e0 2.1.9",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Azure AD Graph app pour Splunk SOAR versions ant\u00e9rieures \u00e0 2.5.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk SOAR versions ant\u00e9rieures \u00e0 8.6.0",
      "product": {
        "name": "SOAR",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Connect pour Kafka versions ant\u00e9rieures \u00e0 2.2.7",
      "product": {
        "name": "Splunk",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Enterprise versions 9.4.x ant\u00e9rieures \u00e0 9.4.14",
      "product": {
        "name": "Splunk Enterprise",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "FireAMP versions 2.1.x ant\u00e9rieures \u00e0 2.1.15",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Zoom app pour Splunk SOAR versions ant\u00e9rieures \u00e0 3.2.2",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Phantom app pour Splunk SOAR versions ant\u00e9rieures \u00e0 3.8.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk On-Call (VictorOps) versions ant\u00e9rieures \u00e0 1.0.43",
      "product": {
        "name": "Splunk",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Attack Analyzer Connector pour Splunk SOAR versions 2.2.x ant\u00e9rieures \u00e0 2.2.1",
      "product": {
        "name": "Splunk",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk MCP Server app versions ant\u00e9rieures \u00e0 1.2.1",
      "product": {
        "name": "Splunk",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Enterprise versions 10.4.x ant\u00e9rieures \u00e0 10.4.2",
      "product": {
        "name": "Splunk Enterprise",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "AD LDAP app pour Splunk SOAR versions ant\u00e9rieures \u00e0 2.3.8",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Enterprise versions 10.2.x ant\u00e9rieures \u00e0 10.2.6",
      "product": {
        "name": "Splunk Enterprise",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Universal Forwarder versions 9.4.x ant\u00e9rieures \u00e0 9.4.14",
      "product": {
        "name": "Universal Forwarder",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk AI Toolkit versions ant\u00e9rieures \u00e0 6.0.1",
      "product": {
        "name": "Splunk AI Toolkit",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Universal Forwarder versions 10.2.x ant\u00e9rieures \u00e0 10.2.6",
      "product": {
        "name": "Universal Forwarder",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Talos Intelligence pour Enterprise Security Cloud versions ant\u00e9rieures \u00e0 1.0.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Enterprise versions 10.0.x ant\u00e9rieures \u00e0 10.0.9",
      "product": {
        "name": "Splunk Enterprise",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "CrowdStrike OAuth API app pour Splunk SOAR versions ant\u00e9rieures \u00e0 5.1.3",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Enterprise Security versions ant\u00e9rieures \u00e0 8.6.1",
      "product": {
        "name": "Enterprise Security",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Nmap Scanner versions 3.0.x ant\u00e9rieures \u00e0 3.0.15",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "RSA SecurID Authentication Manager app pour Splunk SOAR versions ant\u00e9rieures \u00e0 1.0.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Secure Malware Analytics app pour Splunk SOAR versions ant\u00e9rieures \u00e0 2.4.5",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Cisco Webex app pour Splunk SOAR versions ant\u00e9rieures \u00e0 2.2.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    },
    {
      "description": "Splunk Universal Forwarder versions 10.4.x ant\u00e9rieures \u00e0 10.4.2",
      "product": {
        "name": "Universal Forwarder",
        "vendor": {
          "name": "Splunk",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-26007",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-26007"
    },
    {
      "name": "CVE-2025-13473",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-13473"
    },
    {
      "name": "CVE-2026-76349",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76349"
    },
    {
      "name": "CVE-2026-32597",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-32597"
    },
    {
      "name": "CVE-2026-31958",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31958"
    },
    {
      "name": "CVE-2026-76329",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76329"
    },
    {
      "name": "CVE-2026-6474",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6474"
    },
    {
      "name": "CVE-2026-40087",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40087"
    },
    {
      "name": "CVE-2026-6472",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6472"
    },
    {
      "name": "CVE-2026-34180",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34180"
    },
    {
      "name": "CVE-2026-76345",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76345"
    },
    {
      "name": "CVE-2025-67726",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-67726"
    },
    {
      "name": "CVE-2026-76394",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76394"
    },
    {
      "name": "CVE-2026-76383",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76383"
    },
    {
      "name": "CVE-2026-33186",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33186"
    },
    {
      "name": "CVE-2026-76401",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76401"
    },
    {
      "name": "CVE-2026-42766",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42766"
    },
    {
      "name": "CVE-2026-76257",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76257"
    },
    {
      "name": "CVE-2026-32647",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-32647"
    },
    {
      "name": "CVE-2026-76324",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76324"
    },
    {
      "name": "CVE-2026-9076",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9076"
    },
    {
      "name": "CVE-2026-76335",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76335"
    },
    {
      "name": "CVE-2026-76360",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76360"
    },
    {
      "name": "CVE-2026-76393",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76393"
    },
    {
      "name": "CVE-2026-76331",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76331"
    },
    {
      "name": "CVE-2026-76356",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76356"
    },
    {
      "name": "CVE-2026-6479",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6479"
    },
    {
      "name": "CVE-2026-76262",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76262"
    },
    {
      "name": "CVE-2026-1642",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-1642"
    },
    {
      "name": "CVE-2026-27651",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27651"
    },
    {
      "name": "CVE-2026-27654",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27654"
    },
    {
      "name": "CVE-2026-76358",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76358"
    },
    {
      "name": "CVE-2026-1285",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-1285"
    },
    {
      "name": "CVE-2026-76320",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76320"
    },
    {
      "name": "CVE-2026-27959",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27959"
    },
    {
      "name": "CVE-2026-76342",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76342"
    },
    {
      "name": "CVE-2026-6429",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6429"
    },
    {
      "name": "CVE-2026-40701",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40701"
    },
    {
      "name": "CVE-2026-76402",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76402"
    },
    {
      "name": "CVE-2026-2391",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2391"
    },
    {
      "name": "CVE-2026-76395",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76395"
    },
    {
      "name": "CVE-2026-24737",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24737"
    },
    {
      "name": "CVE-2026-27143",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27143"
    },
    {
      "name": "CVE-2026-76369",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76369"
    },
    {
      "name": "CVE-2026-76386",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76386"
    },
    {
      "name": "CVE-2026-76344",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76344"
    },
    {
      "name": "CVE-2026-2006",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2006"
    },
    {
      "name": "CVE-2026-42946",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42946"
    },
    {
      "name": "CVE-2026-6637",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6637"
    },
    {
      "name": "CVE-2026-21226",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21226"
    },
    {
      "name": "CVE-2024-35255",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-35255"
    },
    {
      "name": "CVE-2026-76312",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76312"
    },
    {
      "name": "CVE-2026-35536",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-35536"
    },
    {
      "name": "CVE-2026-76403",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76403"
    },
    {
      "name": "CVE-2026-28755",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28755"
    },
    {
      "name": "CVE-2026-6473",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6473"
    },
    {
      "name": "CVE-2026-76371",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76371"
    },
    {
      "name": "CVE-2026-76313",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76313"
    },
    {
      "name": "CVE-2026-42215",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42215"
    },
    {
      "name": "CVE-2026-2005",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2005"
    },
    {
      "name": "CVE-2026-76327",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76327"
    },
    {
      "name": "CVE-2026-76381",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76381"
    },
    {
      "name": "CVE-2026-7383",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-7383"
    },
    {
      "name": "CVE-2026-25674",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25674"
    },
    {
      "name": "CVE-2026-27144",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27144"
    },
    {
      "name": "CVE-2026-76385",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76385"
    },
    {
      "name": "CVE-2026-32283",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-32283"
    },
    {
      "name": "CVE-2026-76364",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76364"
    },
    {
      "name": "CVE-2026-76388",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76388"
    },
    {
      "name": "CVE-2026-42934",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42934"
    },
    {
      "name": "CVE-2026-24043",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24043"
    },
    {
      "name": "CVE-2026-76261",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76261"
    },
    {
      "name": "CVE-2026-45409",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45409"
    },
    {
      "name": "CVE-2025-53859",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-53859"
    },
    {
      "name": "CVE-2026-76378",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76378"
    },
    {
      "name": "CVE-2026-21860",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-21860"
    },
    {
      "name": "CVE-2026-4800",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-4800"
    },
    {
      "name": "CVE-2026-76354",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76354"
    },
    {
      "name": "CVE-2026-76377",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76377"
    },
    {
      "name": "CVE-2026-39883",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-39883"
    },
    {
      "name": "CVE-2026-76321",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76321"
    },
    {
      "name": "CVE-2026-0540",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-0540"
    },
    {
      "name": "CVE-2026-32281",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-32281"
    },
    {
      "name": "CVE-2025-6545",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-6545"
    },
    {
      "name": "CVE-2026-76390",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76390"
    },
    {
      "name": "CVE-2026-28389",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28389"
    },
    {
      "name": "CVE-2026-76255",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76255"
    },
    {
      "name": "CVE-2026-33671",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33671"
    },
    {
      "name": "CVE-2026-34515",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34515"
    },
    {
      "name": "CVE-2026-33532",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33532"
    },
    {
      "name": "CVE-2026-76380",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76380"
    },
    {
      "name": "CVE-2026-34519",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34519"
    },
    {
      "name": "CVE-2026-76404",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76404"
    },
    {
      "name": "CVE-2026-76343",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76343"
    },
    {
      "name": "CVE-2026-76254",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76254"
    },
    {
      "name": "CVE-2026-30922",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-30922"
    },
    {
      "name": "CVE-2026-76397",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76397"
    },
    {
      "name": "CVE-2026-76337",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76337"
    },
    {
      "name": "CVE-2026-76326",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76326"
    },
    {
      "name": "CVE-2026-33750",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33750"
    },
    {
      "name": "CVE-2026-76328",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76328"
    },
    {
      "name": "CVE-2026-76359",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76359"
    },
    {
      "name": "CVE-2026-76365",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76365"
    },
    {
      "name": "CVE-2026-1207",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-1207"
    },
    {
      "name": "CVE-2026-34986",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34986"
    },
    {
      "name": "CVE-2026-33228",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33228"
    },
    {
      "name": "CVE-2026-76405",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76405"
    },
    {
      "name": "CVE-2026-76253",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76253"
    },
    {
      "name": "CVE-2026-76314",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76314"
    },
    {
      "name": "CVE-2026-76315",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76315"
    },
    {
      "name": "CVE-2026-6638",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6638"
    },
    {
      "name": "CVE-2026-76347",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76347"
    },
    {
      "name": "CVE-2026-34518",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34518"
    },
    {
      "name": "CVE-2026-76382",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76382"
    },
    {
      "name": "CVE-2026-76332",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76332"
    },
    {
      "name": "CVE-2026-76379",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76379"
    },
    {
      "name": "CVE-2026-76376",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76376"
    },
    {
      "name": "CVE-2026-76252",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76252"
    },
    {
      "name": "CVE-2026-27199",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27199"
    },
    {
      "name": "CVE-2026-76336",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76336"
    },
    {
      "name": "CVE-2026-76391",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76391"
    },
    {
      "name": "CVE-2026-22702",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22702"
    },
    {
      "name": "CVE-2026-45447",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-45447"
    },
    {
      "name": "CVE-2026-25679",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25679"
    },
    {
      "name": "CVE-2025-14017",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-14017"
    },
    {
      "name": "CVE-2026-76384",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76384"
    },
    {
      "name": "CVE-2026-34525",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34525"
    },
    {
      "name": "CVE-2026-76351",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76351"
    },
    {
      "name": "CVE-2026-76256",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76256"
    },
    {
      "name": "CVE-2026-28388",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28388"
    },
    {
      "name": "CVE-2026-76309",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76309"
    },
    {
      "name": "CVE-2026-6478",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6478"
    },
    {
      "name": "CVE-2026-34601",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34601"
    },
    {
      "name": "CVE-2026-24133",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24133"
    },
    {
      "name": "CVE-2026-1312",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-1312"
    },
    {
      "name": "CVE-2026-76367",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76367"
    },
    {
      "name": "CVE-2025-14550",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-14550"
    },
    {
      "name": "CVE-2025-66221",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-66221"
    },
    {
      "name": "CVE-2026-76322",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76322"
    },
    {
      "name": "CVE-2026-76319",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76319"
    },
    {
      "name": "CVE-2026-76318",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76318"
    },
    {
      "name": "CVE-2026-2950",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2950"
    },
    {
      "name": "CVE-2026-76258",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76258"
    },
    {
      "name": "CVE-2026-42284",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42284"
    },
    {
      "name": "CVE-2026-6475",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6475"
    },
    {
      "name": "CVE-2026-76370",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76370"
    },
    {
      "name": "CVE-2026-76363",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76363"
    },
    {
      "name": "CVE-2026-32280",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-32280"
    },
    {
      "name": "CVE-2026-76361",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76361"
    },
    {
      "name": "CVE-2026-76316",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76316"
    },
    {
      "name": "CVE-2026-76330",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76330"
    },
    {
      "name": "CVE-2026-76260",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76260"
    },
    {
      "name": "CVE-2025-69873",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-69873"
    },
    {
      "name": "CVE-2026-44244",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44244"
    },
    {
      "name": "CVE-2026-25940",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25940"
    },
    {
      "name": "CVE-2026-24040",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24040"
    },
    {
      "name": "CVE-2026-76346",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76346"
    },
    {
      "name": "CVE-2026-76373",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76373"
    },
    {
      "name": "CVE-2026-76400",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76400"
    },
    {
      "name": "CVE-2026-76372",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76372"
    },
    {
      "name": "CVE-2026-29181",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-29181"
    },
    {
      "name": "CVE-2026-25755",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25755"
    },
    {
      "name": "CVE-2026-76334",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76334"
    },
    {
      "name": "CVE-2025-15599",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-15599"
    },
    {
      "name": "CVE-2026-28390",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28390"
    },
    {
      "name": "CVE-2026-6477",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6477"
    },
    {
      "name": "CVE-2026-76340",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76340"
    },
    {
      "name": "CVE-2026-76341",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76341"
    },
    {
      "name": "CVE-2026-33672",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33672"
    },
    {
      "name": "CVE-2026-76396",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76396"
    },
    {
      "name": "CVE-2026-76323",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76323"
    },
    {
      "name": "CVE-2026-76368",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76368"
    },
    {
      "name": "CVE-2026-76259",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76259"
    },
    {
      "name": "CVE-2026-76355",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76355"
    },
    {
      "name": "CVE-2026-76375",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76375"
    },
    {
      "name": "CVE-2026-76325",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76325"
    },
    {
      "name": "CVE-2026-76399",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76399"
    },
    {
      "name": "CVE-2026-76392",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76392"
    },
    {
      "name": "CVE-2026-34516",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34516"
    },
    {
      "name": "CVE-2026-27140",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27140"
    },
    {
      "name": "CVE-2026-31789",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31789"
    },
    {
      "name": "CVE-2026-34517",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34517"
    },
    {
      "name": "CVE-2026-25535",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25535"
    },
    {
      "name": "CVE-2026-42945",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-42945"
    },
    {
      "name": "CVE-2026-76362",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76362"
    },
    {
      "name": "CVE-2026-76389",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76389"
    },
    {
      "name": "CVE-2026-31938",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31938"
    },
    {
      "name": "CVE-2026-27784",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-27784"
    },
    {
      "name": "CVE-2026-76387",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76387"
    },
    {
      "name": "CVE-2026-6276",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-6276"
    },
    {
      "name": "CVE-2026-76338",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76338"
    },
    {
      "name": "CVE-2026-28753",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28753"
    },
    {
      "name": "CVE-2026-76374",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76374"
    },
    {
      "name": "CVE-2026-33810",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33810"
    },
    {
      "name": "CVE-2026-34513",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34513"
    },
    {
      "name": "CVE-2026-9256",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-9256"
    },
    {
      "name": "CVE-2026-34514",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34514"
    },
    {
      "name": "CVE-2026-28277",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28277"
    },
    {
      "name": "CVE-2026-26996",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-26996"
    },
    {
      "name": "CVE-2026-1287",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-1287"
    },
    {
      "name": "CVE-2026-76339",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76339"
    },
    {
      "name": "CVE-2026-76348",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76348"
    },
    {
      "name": "CVE-2025-14819",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-14819"
    },
    {
      "name": "CVE-2026-76353",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76353"
    },
    {
      "name": "CVE-2025-67724",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-67724"
    },
    {
      "name": "CVE-2026-41066",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-41066"
    },
    {
      "name": "CVE-2026-76350",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76350"
    },
    {
      "name": "CVE-2026-34520",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-34520"
    },
    {
      "name": "CVE-2026-28684",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-28684"
    },
    {
      "name": "CVE-2026-32141",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-32141"
    },
    {
      "name": "CVE-2026-76357",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76357"
    },
    {
      "name": "CVE-2026-2004",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2004"
    },
    {
      "name": "CVE-2026-76317",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76317"
    },
    {
      "name": "CVE-2026-31898",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31898"
    },
    {
      "name": "CVE-2026-24001",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-24001"
    },
    {
      "name": "CVE-2026-76310",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76310"
    },
    {
      "name": "CVE-2026-76352",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76352"
    },
    {
      "name": "CVE-2026-25673",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-25673"
    },
    {
      "name": "CVE-2026-7168",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-7168"
    },
    {
      "name": "CVE-2025-6547",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-6547"
    },
    {
      "name": "CVE-2026-76398",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76398"
    },
    {
      "name": "CVE-2025-67725",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-67725"
    },
    {
      "name": "CVE-2026-29063",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-29063"
    },
    {
      "name": "CVE-2026-76366",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76366"
    },
    {
      "name": "CVE-2025-68428",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-68428"
    },
    {
      "name": "CVE-2026-22815",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-22815"
    },
    {
      "name": "CVE-2026-76311",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76311"
    },
    {
      "name": "CVE-2026-76263",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76263"
    },
    {
      "name": "CVE-2026-76251",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76251"
    },
    {
      "name": "CVE-2025-13465",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-13465"
    },
    {
      "name": "CVE-2026-40460",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-40460"
    },
    {
      "name": "CVE-2026-76333",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-76333"
    },
    {
      "name": "CVE-2026-44243",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-44243"
    },
    {
      "name": "CVE-2026-31790",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-31790"
    },
    {
      "name": "CVE-2026-2739",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-2739"
    }
  ],
  "initial_release_date": "2026-08-20T00:00:00",
  "last_revision_date": "2026-08-20T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-1056",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-08-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Injection SQL (SQLi)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Falsification de requ\u00eates c\u00f4t\u00e9 serveur (SSRF)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    },
    {
      "description": "\u00c9l\u00e9vation de privil\u00e8ges"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Splunk. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Splunk",
  "vendor_advisories": [
    {
      "published_at": "2026-08-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0807",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0807"
    },
    {
      "published_at": "2026-08-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0805",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0805"
    },
    {
      "published_at": "2026-08-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0803",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0803"
    },
    {
      "published_at": "2026-08-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0802",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0802"
    },
    {
      "published_at": "2026-08-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0801",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0801"
    },
    {
      "published_at": "2026-08-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0808",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0808"
    },
    {
      "published_at": "2026-08-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0806",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0806"
    },
    {
      "published_at": "2026-08-19",
      "title": "Bulletin de s\u00e9curit\u00e9 Splunk SVD-2026-0804",
      "url": "https://advisory.splunk.com/advisories/SVD-2026-0804"
    }
  ]
}

FKIE_CVE-2026-6479

Vulnerability from fkie_nvd - Published: 2026-05-14 14:16 - Updated: 2026-06-17 11:00

Severity

7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Summary

Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

References

	URL	Tags
	f86ef6dc-4d3a-42ad-8f28-e6d5547a5007	https://www.postgresql.org/support/security/CVE-2026-6479/	Patch, Vendor Advisory

Impacted products

Vendor	Product	Version
postgresql	postgresql	*
postgresql	postgresql	*
postgresql	postgresql	*
postgresql	postgresql	*
postgresql	postgresql	*

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "defaultStatus": "unaffected",
          "product": "PostgreSQL",
          "vendor": "n/a",
          "versions": [
            {
              "lessThan": "18.4",
              "status": "affected",
              "version": "18",
              "versionType": "rpm"
            },
            {
              "lessThan": "17.10",
              "status": "affected",
              "version": "17",
              "versionType": "rpm"
            },
            {
              "lessThan": "16.14",
              "status": "affected",
              "version": "16",
              "versionType": "rpm"
            },
            {
              "lessThan": "15.18",
              "status": "affected",
              "version": "15",
              "versionType": "rpm"
            },
            {
              "lessThan": "14.23",
              "status": "affected",
              "version": "0",
              "versionType": "rpm"
            }
          ]
        }
      ],
      "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007"
    }
  ],
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "C432AE18-DD50-40EB-B46A-9283F30081DA",
              "versionEndExcluding": "14.23",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "9D8D994F-ABAB-4AC2-992F-320F4868698D",
              "versionEndExcluding": "15.18",
              "versionStartIncluding": "15.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "B58AE3D3-E1C9-45D2-AA92-A3D135B77A8A",
              "versionEndExcluding": "16.14",
              "versionStartIncluding": "16.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "A19538E9-DBB9-4396-AC04-17943E82C411",
              "versionEndExcluding": "17.10",
              "versionStartIncluding": "17.0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:*",
              "matchCriteriaId": "F8DB17ED-67AD-41F2-B272-27AF5B4FA2B0",
              "versionEndExcluding": "18.4",
              "versionStartIncluding": "18.0",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service.  If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected."
    }
  ],
  "id": "CVE-2026-6479",
  "lastModified": "2026-06-17T11:00:51.850",
  "metrics": {
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 7.5,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "NONE",
          "integrityImpact": "NONE",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "NONE",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 3.9,
        "impactScore": 3.6,
        "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-6479",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-05-14T15:26:13.223741Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-05-14T14:16:25.583",
  "references": [
    {
      "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://www.postgresql.org/support/security/CVE-2026-6479/"
    }
  ],
  "sourceIdentifier": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
  "vulnStatus": "Analyzed",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-674"
        }
      ],
      "source": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
      "type": "Secondary"
    }
  ]
}

GHSA-HWFH-MH4F-M67F

Vulnerability from github – Published: 2026-05-14 15:31 – Updated: 2026-05-14 15:31

Details

Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.

Severity

7.5 (High)


                  
                    CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Show details on source website

JSON

To clipboard

{
  "affected": [],
  "aliases": [
    "CVE-2026-6479"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-674"
    ],
    "github_reviewed": false,
    "github_reviewed_at": null,
    "nvd_published_at": "2026-05-14T14:16:25Z",
    "severity": "HIGH"
  },
  "details": "Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service.  If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.",
  "id": "GHSA-hwfh-mh4f-m67f",
  "modified": "2026-05-14T15:31:58Z",
  "published": "2026-05-14T15:31:58Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6479"
    },
    {
      "type": "WEB",
      "url": "https://www.postgresql.org/support/security/CVE-2026-6479"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
      "type": "CVSS_V3"
    }
  ]
}

MSRC_CVE-2026-6479

Vulnerability from csaf_microsoft - Published: 2026-05-02 00:00 - Updated: 2026-05-17 14:40

Summary

PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion

Scope

1 vulnerability in this advisory, including CVE-2026-6479.

CVE-2026-6479

7.5 (High)


                
                  CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Fixed: 1 product Known affected: 1 product

https://learn.microsoft.com/en-us/azure/azure-linux/tutoria…

Open the full advisory

OESA-2026-2381 (CVE-2026-6472)

Vulnerability from osv_openeuler – Published: 2026-05-22 11:11 – Updated: 2026-08-06 11:11 – Source website

Summary

libpq security update

Details

PostgreSQL is a powerful, open source object-relational database system that uses and extends the SQL language combined with many features that safely store and scale the most complicated data workloads. This package provides the essential shared library for any PostgreSQL client program or interface.

Security Fix(es):

Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types. That is to say, the victim will execute arbitrary SQL functions of the attacker's choice. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.(CVE-2026-6472)

Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code as the operating system user running the database. In applications that pass gigabyte-scale user inputs to the relevant database functions, the application input provider may achieve a segmentation fault. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.(CVE-2026-6473)

Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.(CVE-2026-6474)

Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account. It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries. Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.(CVE-2026-6475)

Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response. Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size. Because both the \lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.(CVE-2026-6477)

Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 passwords, the default in all supported releases. However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.(CVE-2026-6478)

Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.(CVE-2026-6479)

Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database. A distinct attack is possible if the application declares a user-controlled column as a "refint" cascade primary key and facilitates user-controlled updates to that column. In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update. Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.(CVE-2026-6637)

Severity

8.8 (High)


                    
                      CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References

URL

Type

	https://www.openeuler.org/zh/security/security-bu…	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-6472	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-6473	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-6474	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-6475	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-6477	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-6478	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-6479	ADVISORY
	https://nvd.nist.gov/vuln/detail/CVE-2026-6637	ADVISORY

JSON

To clipboard

{
  "affected": [
    {
      "ecosystem_specific": {
        "aarch64": [
          "libpq-15.18-1.oe2403sp3.aarch64.rpm",
          "libpq-debuginfo-15.18-1.oe2403sp3.aarch64.rpm",
          "libpq-debugsource-15.18-1.oe2403sp3.aarch64.rpm",
          "libpq-devel-15.18-1.oe2403sp3.aarch64.rpm"
        ],
        "src": [
          "libpq-15.18-1.oe2403sp3.src.rpm"
        ],
        "x86_64": [
          "libpq-15.18-1.oe2403sp3.x86_64.rpm",
          "libpq-debuginfo-15.18-1.oe2403sp3.x86_64.rpm",
          "libpq-debugsource-15.18-1.oe2403sp3.x86_64.rpm",
          "libpq-devel-15.18-1.oe2403sp3.x86_64.rpm"
        ]
      },
      "package": {
        "ecosystem": "openEuler:24.03-LTS-SP3",
        "name": "libpq",
        "purl": "pkg:rpm/openEuler/libpq\u0026distro=openEuler-24.03-LTS-SP3"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "15.18-1.oe2403sp3"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "database_specific": {
    "severity": "High"
  },
  "details": "PostgreSQL is a powerful, open source object-relational database system that uses and extends the SQL language combined with many features that safely store and scale the most complicated data workloads. This package provides the essential shared library for any PostgreSQL client program or interface.\r\n\r\nSecurity Fix(es):\n\nMissing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types.  That is to say, the victim will execute arbitrary SQL functions of the attacker\u0026apos;s choice.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.(CVE-2026-6472)\n\nInteger wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds.  This may execute arbitrary code as the operating system user running the database.  In applications that pass gigabyte-scale user inputs to the relevant database functions, the application input provider may achieve a segmentation fault.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.(CVE-2026-6473)\n\nExternally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.(CVE-2026-6474)\n\nSymlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account.  It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries.  Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.(CVE-2026-6475)\n\nUse of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response.  Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size.  Because both the \\lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.(CVE-2026-6477)\n\nCovert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate.  This does not affect scram-sha-256 passwords, the default in all supported releases.  However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.(CVE-2026-6478)\n\nUncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service.  If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.(CVE-2026-6479)\n\nStack buffer overflow in PostgreSQL module \u0026quot;refint\u0026quot; allows an unprivileged database user to execute arbitrary code as the operating system user running the database.  A distinct attack is possible if the application declares a user-controlled column as a \u0026quot;refint\u0026quot; cascade primary key and facilitates user-controlled updates to that column.  In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.(CVE-2026-6637)",
  "id": "OESA-2026-2381",
  "modified": "2026-08-06T11:11:20Z",
  "published": "2026-05-22T11:11:20Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://www.openeuler.org/zh/security/security-bulletins/detail/?id=openEuler-SA-2026-2381"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6472"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6473"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6474"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6475"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6477"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6478"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6479"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6637"
    }
  ],
  "schema_version": "1.7.2",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
      "type": "CVSS_V3"
    }
  ],
  "summary": "libpq security update",
  "upstream": [
    "CVE-2026-6472",
    "CVE-2026-6473",
    "CVE-2026-6474",
    "CVE-2026-6475",
    "CVE-2026-6477",
    "CVE-2026-6478",
    "CVE-2026-6479",
    "CVE-2026-6637"
  ]
}

OESA-2026-2382 (CVE-2026-6472)