[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzRHWeWBDt0VCW2RYvdcjt_Bi-0kyMYvDvuJCxWsueYw":3},{"article":4,"iocs":38,"watch_terms":39,"solutions":40,"lesson":125},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":20,"category":21,"article_tags":25},"264c7512-9d3d-488d-8404-036a7be97333","PostgreSQL security update fixes 52 vulnerabilities, ends support for PostgreSQL 14","postgresql-security-update-fixes-52-vulnerabilities-ends-support-for-postgresql-9f6eb7","The PostgreSQL Global Development Group released PostgreSQL 18.7, 17.12, 16.16, 15.20 and 14.25 on November 12, fixing 52 security vulnerabilities and more than 140 other bugs. Most of those code execution bugs are memory errors or type confusion, where PostgreSQL handles a value as the wrong data type. They turn up in PL\u002FPerl and PL\u002FTcl, text search functions such as ts_rank_cd(), parallel query, logical replication, dblink and statistics import. Thirty-two of the 52 CVEs carry … More → The post PostgreSQL security update fixes 52 vulnerabilities, ends support for PostgreSQL 14 appeared first on Help Net Security.","The PostgreSQL Global Development Group has released several updates, including PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25, which collectively address 52 security vulnerabilities and over 140 other bugs. Many of the code execution flaws are memory errors or type confusion issues. Additionally, PostgreSQL 14 has reached its end-of-support, with version 14.25 being its final release.","PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 released with 52 security fixes.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F13\u002Fpostgresql-security-update-november-2026\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2024\u002F08\u002F21142640\u002Fpostgresql-1500.webp","2026-11-12T23:05:33+00:00","2026-11-13T00:00:04.40025+00:00",8,[17],{"name":18,"type":19},"PostgreSQL","product","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":20,"icon":22,"name":23,"slug":24},null,"Vulnerabilities","vulnerabilities",[26,31,33],{"category":27},{"id":28,"icon":22,"name":29,"slug":30},"02371804-cf6d-4449-98de-f1a2d4d9b266","Tools","tools",{"category":32},{"id":20,"icon":22,"name":23,"slug":24},{"category":34},{"id":35,"icon":22,"name":36,"slug":37},"ade75414-7914-4e23-a450-48b64546ee70","Open Source","open-source",[],[18],{"controls":41,"vendors":124},[42,71,99],{"slug":43,"name":44,"problem":45,"products":46},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[47,55,63],{"vendor_slug":48,"vendor_name":49,"vendor_logo":50,"product_slug":51,"product_name":52,"url":53,"description":54},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"vendor_slug":56,"vendor_name":57,"vendor_logo":58,"product_slug":59,"product_name":60,"url":61,"description":62},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":72,"name":73,"problem":74,"products":75},"patch-management","Automated patch management","Known holes get closed in days, not months.",[76,84,92],{"vendor_slug":77,"vendor_name":78,"vendor_logo":79,"product_slug":80,"product_name":81,"url":82,"description":83},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":85,"vendor_name":86,"vendor_logo":87,"product_slug":88,"product_name":89,"url":90,"description":91},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":93,"vendor_name":94,"vendor_logo":95,"product_slug":72,"product_name":96,"url":97,"description":98},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"slug":100,"name":101,"problem":102,"products":103},"asset-inventory","Cyber asset inventory","You cannot patch, monitor or protect the devices, cloud resources and accounts you do not know you have.",[104,111,119],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":106,"url":109,"description":110},"lansweeper","Lansweeper","\u002Fvendor-logos\u002Flansweeper.png","lansweeper-asset-inventory","https:\u002F\u002Fwww.lansweeper.com\u002Fproduct\u002Fasset-inventory\u002F","Discovery with and without agents that keeps one central, always-updated inventory of devices, software and their details.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"runzero","runZero","\u002Fvendor-logos\u002Frunzero.png","runzero-platform","runZero Platform","https:\u002F\u002Fwww.runzero.com\u002Fplatform\u002F","Finds and fingerprints everything on the network and in the cloud, including IoT and OT devices, without agents or credentials, and flags exposures.",{"vendor_slug":48,"vendor_name":49,"vendor_logo":50,"product_slug":120,"product_name":121,"url":122,"description":123},"axonius-cyber-assets","Axonius Cyber Assets","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fcyber-assets","A continuously reconciled view of every asset, who owns it, which security controls cover it and where it drifts from policy.",[],{"slug":126,"title":127,"body":128,"framework_refs":129,"framework_notes":135},"52-postgresql-vulnerabilities-patched-including-end-of-life-for-version-14","52 PostgreSQL Vulnerabilities Patched — Including End-of-Life for Version 14","The PostgreSQL Global Development Group released critical updates addressing 52 vulnerabilities, many of which are memory errors and type confusion issues that could allow code execution. Organizations running unpatched or end-of-life versions of PostgreSQL (particularly version 14, which has now reached end-of-support) are exposed to these risks with no future fixes available. The end-of-life status of PostgreSQL 14 means any newly discovered vulnerabilities in that branch will remain permanently unpatched, making upgrade planning a business-critical priority. Databases are high-value targets because they store sensitive data, and remote code execution flaws in database engines can lead to full system compromise and data breaches.",[130,131,132,133,134],"CIS Control 2: Inventory and Control of Software Assets (v8)","CIS Control 7: Continuous Vulnerability Management (v8)","NIST SP 800-53 SI-2: Flaw Remediation","NIS2 Article 21(2)(e)","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities",{"NIS2 Article 21(2)(e)":136,"NIST SP 800-53 SI-2: Flaw Remediation":137,"CIS Control 7: Continuous Vulnerability Management (v8)":138,"CIS Control 2: Inventory and Control of Software Assets (v8)":139,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":140},"This point explicitly covers vulnerability handling and disclosure in acquisition, development, and maintenance, requiring organizations to have processes for acting on vendor security updates like these PostgreSQL releases.","SI-2 requires organizations to identify, report, and correct information system flaws, which covers both applying these PostgreSQL patches and planning migrations away from the now-unsupported version 14.","This control requires organizations to remediate vulnerabilities in a risk-prioritized, timely manner, directly addressing the need to apply the 52 PostgreSQL patches promptly.","Knowing which PostgreSQL versions are deployed — including their support status — is required by this control, and would have surfaced EOL version 14 instances before they became permanently unpatched.","This control requires timely identification and remediation of technical vulnerabilities, encompassing both the patching of the 52 CVEs and the managed transition away from the end-of-life PostgreSQL 14 branch."]