CVE-2026-105615
PostgreSQL's optimized statistics on a table are visible as long as you have SELECT privilege on said table. A masked role can therefore rea
CVSS
3.5
Bajo
EPSS
—
KEV
—
Exploit Today
—
0-100
Publicado: 28 oct 2026 · Última mod.: 28 oct 2026 · CWE-202
Sin historial EPSS suficiente todavía.
PostgreSQL's optimized statistics on a table are visible as long as you have SELECT privilege on said table. A masked role can therefore read a limited subset of the data through the statistics view's histograms and mcvs. The vulnerability is resolved in PostgreSQL Anonymizer 3.3.0 and later versions.
CVECVSSEPSSKEVRExplotTítuloVis.
CVE-2026-1101834.3 MED—
———PostgreSQL Anonymizer contains a vulnerability related to static masking and statistics persistence. Statistics pertaining to the original data remain visible in pg_stats until an ANALYZE operation is performed on the table, either manually or by autovacuum. This issue is fixed in PostgreSQL Anonymizer 3.3.0 and later versions.8hCVE-2026-100420—4.6%
——1A sensitive information disclosure vulnerability in the cloud-client daemon of Deco BE63 allows authenticated attackers to retrieve the plaintext TP-Link ID account password.
Successful exploitation may allow attackers to compromise the associated cloud account and perform unauthorized actions on behalf of the affected user.6dCVE-2026-79633—7.1%
——2vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
Missing authorization checks allowed authenticated users to perform actions on non-public content they were not permitted to access.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.9dCVE-2026-79620—7.1%
——2Exposure of sensitive information through data queries vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
An improper authorization check in the similar-question search allowed authenticated users to view metadata of non-public questions.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.9dCVE-2026-79613—5.9%
——2vulnerability in Apache Answer.
This issue affects Apache Answer: through 2.0.2.
Unauthenticated attackers could access comments associated with non-public content through public user profiles.
Users are recommended to upgrade to version 2.0.3, which fixes the issue.9dCVE-2026-1065065.3 MED12.2%
——4Backstage is an open framework for building developer portals. Prior to 4.1.0, the @backstage/plugin-scaffolder-backend package is affected by improper input validation in scaffolder task list ordering. An authenticated Backstage user with permission to create and read relevant scaffolder tasks may be able to infer confidential task data under specific conditions. Successful exploitation requires retained task secrets, visibility of a target task, knowledge of the secret structure, and repeated requests. This issue is fixed in version 4.1.0.19d