PostgreSQL and TomEE ship large security releases

PostgreSQL published updates fixing 52 security vulnerabilities across current branches, and Apache TomEE addressed 38 CVEs in a combined release. Smaller advisories covered Ansible SSH host-key handling, Vim CSS completion, local denial of service in dbus, memory corruption in Apache DataSketches, and parser bugs in cabextract and libmspack.

PostgreSQL fixes 52 vulnerabilities and ends support for 14

The PostgreSQL project released 18.7, 17.12, 16.16, 15.20, 14.25, and 19 RC 2, fixing 52 security vulnerabilities. The announcement also records that version 14 has reached end of life. Sites still on 14 need both the security update and a migration plan, while other branches should treat this as a broad security refresh rather than a single-issue patch.

Apache TomEE 10.3.0 and 11.0.0-M2 close 38 CVEs

Apache TomEE announced that 10.3.0 and 11.0.0-M2 together address 38 CVEs: 26 in core and 12 in removed modules. The announcement notes default-behavior changes. Deployments that depend on previous defaults should review those changes along with the vulnerability fixes.

Ansible SSH library accepts a changed host key under AutoAddPolicy

CVE-2026-126641 affects ansible-pylibssh and the libssh integration in ansible.netcommon. When host_key_auto_add is enabled, a changed SSH host key is accepted, which is a host key verification bypass under AutoAddPolicy. Automation that leaves that setting on should not treat a key change as verified.

Vim CSS completion can run commands before 9.2.1342

A vim-security advisory reports command execution via CSS omni-completion in Vim before 9.2.1342. The issue is low severity and involves an unescaped glob() on @import. Users of older Vim builds should move past that version.

dbus 1.16.4 fixes several local denial-of-service bugs

dbus 1.16.4 fixes multiple local denial-of-service issues. One additional case remains unfixed. Systems that expose the bus to local users should still take the release, with that remaining case in mind.

Apache DataSketches C++ sketches corrupt memory on crafted input

Two moderate-severity issues, CVE-2026-123274 and CVE-2026-123338, describe out-of-bounds writes while deserializing KLL and REQ sketches in Apache DataSketches C++. A crafted sketch can corrupt memory. Code that loads untrusted sketches should not treat those paths as safe until updated.

cabextract 1.12 and libmspack 0.12alpha fix parser flaws

A security release of cabextract 1.12 and libmspack 0.12alpha fixes multiple buffer overreads, a use-after-free, and infinite-loop issues in CAB and CHM parsers. Tools and libraries that unpack those formats should pick up the new versions.