Veille CVE

Lundi 17 août 2026

2 CVE

Critique 1 Élevée 1 Moyenne 0 Faible 0 Non évaluée 0 Exploitées (KEV) Tri : plus récentes « PostgreSQL » ✕
  1. CVE-2026-64657 8.4 Élevée

    budibase

    Budibase is an open-source low-code platform. Prior to 3.39.19, the PostgreSQL datasource connector in packages/server/src/integrations/postgres.ts interpolates the user-controlled schema configuration field into a SET search_path statement without escaping embedded double quotes, allowing an authenticated administrator who saves or tests the datasource to execute arbitrary SQL through the simple query protocol. This issue is fixed in version 3.39.19.

  2. CVE-2026-74891 9.8 Critique

    jahlives openssl_encrypt · Jahlives openssl encrypt

    openssl_encrypt versions before 1.4.0 contain hardcoded database credentials in standalone server configuration files. Attackers on the same network can access PostgreSQL databases using well-known default credentials to retrieve sensitive data.