Topic
Vulnerabilities and hardening in database engines and the accounts, tools and pipelines connected to them.
Progress Software published 31 MarkLogic Server flaws on October 12, five of them critical. The 11.3.6 and 12.0.3 releases that fixed August's 10 flaws are affected. Fixes are in 11.3.7 and 12.1.0.
Reality
ZoomEye's Couchbase fingerprint matched 9,045 services reachable from the public internet on 24 September 2026. The query cannot say which Couchbase surface answered, so each team has to check its own inventory against the result.
Reality
ZoomEye queries run on 27 September counted 4.9 million services answering on Redis's default port 6379, against 142 fingerprinted as Redis. The larger figure counts reachable listeners, a list owners can check against Redis's rule that the server stay on trusted networks.
Reality
AWS published CVE-2026-87911, a CVSS 9.6 command injection in its own postgres-mcp-server, where one COPY ... TO PROGRAM line runs a shell on the host. The read-only promise lives in a regex filter that lets the COPY keyword through.
Reality
CVE-2026-6471 has sat in every PostgreSQL release since 9.4 shipped in 2014. Cyera says the plugin name in a replication slot request reaches dlopen() unvalidated, which makes the fix a privilege audit as much as a patch.
Perspective Coverage
4 publishersReality
Vipin Samar and David Knox showed an indirect prompt pulling salary data past an application's guardrails, then failing once the rule lived in the database, and argued that no agent should be trusted to police its own access.
Reality
Oracle's database chief says AI is turning up hundreds of security issues in code his teams spent decades hardening. His prescription for agents is authorization enforced inside the database, keyed to the end user's identity.
Reality
Deep Data Security declares in SQL who may read which rows, columns and cells, and the Oracle 26ai engine checks it on every query. A dev.to walkthrough shows the first end user failing to log in at all.
Reality
Cyera says an account with the REPLICATION attribute could load arbitrary code inside the PostgreSQL server process and climb to superuser. Fixes shipped on August 13, and the harder work is naming who holds those accounts.
Reality