CVE-2026-19634

MediumCVSS 6.4/10Last modified Sep 9, 2026

Description

PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.import_database_rules() or anon.import_roles_rules(), the malicious code is executed with superuser privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later

Metrics

CVSS 3.1 6.4/10CVSS:3.1/AV:N/AC:H/PR:H/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Sep 6, 2026
Last modified
Sep 9, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-196358.8A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could aCVE-2026-196365.3An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a securiCVE-2026-196394.3An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings oCVE-2026-19645.3A vulnerability was determined in WeKan up to 8.20. This impacts an unknown function of the file models/boards.js of the component REST EndpCVE-2026-196404.2On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive incoCVE-2026-196415.3On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authenticatCVE-2026-196425.9An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a CVE-2026-196435.3An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticatCVE-2026-196445.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipuCVE-2026-196456.5IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computatioCVE-2026-196469.1IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 could allow a remote attacker to redirecCVE-2026-196495.5IBM App Connect Enterprise 13.0.1.0 through 13.0.8.1, and 12.0.1.0 through 12.0.12.28 and IBM Integration Bus for z/OS 10.1.0.0 through 10.1