Mehmet Ince

The DuckDB AWS extension for DuckDB contains a security policy bypass vulnerability that allows any database user with SQL execution permissions to extract plaintext AWS credentials by calling the load aws credentials function with the redact secret parameter set to false, circumventing the database-wide allow unredacted secrets=false policy. Attackers can invoke this single function to retrieve the underlying AWS credential chain including access key id, secret access key, session token, and region in plaintext, which are immediately valid against AWS APIs and particularly impactful in managed environments where pg duckdb is preloaded and an AWS credential chain such as IMDSv2, IRSA, ECS task role, or EC2 instance role is reachable.

When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's default expressions on the subscriber. Because the apply worker runs at a privilege level equivalent to a PostgreSQL superuser in default installations, any function invoked by such a default expression also runs at that privilege. A party acting as the publisher can use this path to cause functions to be executed on the subscriber as superuser, escalating from a role permitted to use pglogical to full superuser. This is a second, independent path to the same superuser escalation tracked under CVE-2026-50736 (the pglogical queue issue). To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles.

The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at the privilege level of the apply worker, which is equivalent to a PostgreSQL superuser in default installations. A party acting as the publisher can send crafted queue messages that cause arbitrary SQL to be executed on the subscriber as superuser, escalating from a role permitted to use pglogical to full superuser and breaking the isolation between tenants in shared deployments. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles.

A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced after the underlying slot has been freed or recycled during normal worker lifecycle events. The condition is reachable during normal replication operation, including by a low-privileged user able to influence worker start, stop, and restart timing through permitted pglogical operations. In the typical case the condition crashes replication workers, causing an availability impact. In the worst case a use-after-free in a PostgreSQL backend can be leveraged as a remote code execution primitive at the privilege of that backend.

pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as the publisher for a subscription, for example a non-PostgreSQL endpoint that speaks the pglogical replication protocol, can return crafted messages that cause the subscriber's apply worker to read beyond the bounds of an allocated buffer, disclosing adjacent process memory or crashing the worker. To exploit the issue an attacker must be able to direct a subscription at an endpoint they control. In default installations this requires privileges normally reserved for a superuser, so the issue is most relevant to managed deployments where the ability to create subscriptions has been delegated to non-superuser roles.

**Name of the Vulnerable Software and Affected Versions** Tiki Wiki CMS Groupware versions 15.1 and earlier **Description** An unauthenticated arbitrary file upload issue exists in the Tiki Wiki CMS Groupware software. The vulnerability is located within the ELFinder component’s default connector (`connector.minimal.php`). It allows remote attackers to upload and execute malicious PHP scripts in the context of the web server due to a lack of file type validation. Attackers can craft a POST request to upload executable PHP payloads through the ELFinder interface exposed at `/vendor extra/elfinder/`. **Recommendations** Versions prior to 15.1 are affected. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions:** CryptoLog (PHP version, affected versions not specified) **Description:** A remote code execution issue exists in CryptoLog (PHP version) due to a combination of SQL injection and command injection vulnerabilities. An unauthenticated attacker can achieve shell access as the web server user. The attack sequence involves exploiting a SQL injection flaw in `login.php` to bypass authentication, followed by command injection in the `/logshares ajax.php` API endpoint. The login bypass is achieved by submitting crafted SQL via the `user` POST parameter. After authentication, the attacker can leverage the `lsid` POST parameter in the `/logshares ajax.php` endpoint to inject and execute a command using $(...) syntax. This exploitation path is not present in the ASP.NET version of CryptoLog released since 2009. **Recommendations:** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PostHog (affected versions not specified) **Description** The issue is related to a Server-Side Request Forgery (SSRF) and Information Disclosure vulnerability in the database schema of PostHog. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PostHog (affected versions not specified) **Description** The issue concerns a SQL injection vulnerability in PostHog's ClickHouse table functions, potentially leading to remote code execution. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** PostHog versions (affected versions not specified) **Description** The issue concerns a Server-Side Request Forgery (SSRF) and Information Disclosure vulnerability. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** mySCADA myPRO (affected versions not specified) **Description** The issue is related to the improper neutralization of POST requests sent to a specific port with version information. This could be exploited by an attacker to execute arbitrary commands on the affected system. The vulnerability is associated with the failure to neutralize special elements used in the operating system command. Exploitation of the vulnerability may allow a remote attacker to execute arbitrary code by sending specially crafted POST requests. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** No specific software or versions are mentioned in the provided descriptions. **Description** A user with administrator privileges is able to retrieve authentication tokens. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Arista Edge Threat Management versions up to 17.1.1 **Description** Multiple SQL Injection vulnerabilities exist in the reporting application, allowing a user with advanced report application access rights to exploit the SQL injection. This enables them to execute commands on the underlying operating system with elevated privileges. **Recommendations** For Arista Edge Threat Management versions up to 17.1.1, consider restricting access to the reporting application to minimize the risk of exploitation until a security fix is applied. As a temporary workaround, limit the privileges of users with advanced report application access rights to prevent elevated command execution on the underlying operating system. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: No specific software or versions are mentioned in the provided descriptions. Description: Expired and unusable administrator authentication tokens can be revealed by units that have timed out from ETM access. This issue concerns the potential disclosure of authentication tokens for administrators that are expired and unusable, which might be exposed by units that have lost ETM access due to a timeout. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** No specific software or versions are mentioned in the provided descriptions. **Description** The issue concerns the ability of administrators to configure an insecure captive portal script. This allows for potential security risks, as an insecure script could be exploited. No information is provided about the estimated number of potentially affected devices or real-world incidents where this issue was exploited. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: ETM (affected versions not specified) Description: The issue concerns a man-in-the-middle vulnerability in ETM backup uploads. This allows an attacker to intercept backup uploads to ETM. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: Report application (affected versions not specified) Description: A user with advanced report application access rights can perform actions for which they are not authorized. This issue allows unauthorized actions to be carried out by users with high-level access to the report application. Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** No specific software or versions are mentioned in the provided descriptions. **Description** A user with administrator privileges can perform command injection. This issue allows an administrator to carry out command injection, potentially leading to elevated privileges. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Arista NG Firewall (affected versions not specified) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Authentication is required to exploit this issue. The specific flaw exists within the ExecManagerImpl class, resulting from the lack of proper validation of a user-supplied string before using it to execute a system call. An attacker can leverage this issue to execute code in the context of root. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.

**Name of the Vulnerable Software and Affected Versions** Arista NG Firewall (affected versions not specified) **Description** This issue allows remote attackers to execute arbitrary code on affected installations of Arista NG Firewall. Authentication is not required to exploit this issue. The specific flaw exists within the implementation of the `custom handler` method. The issue results from the lack of proper validation of a user-supplied path prior to using it in file operations. An attacker can leverage this issue to execute code in the context of the `www-data` user. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this issue.