CVE-2026-111440: openGauss-connector-jdbc
- Severity
- 7 (HIGH)
- Vendor
- OPENGAUSS-SERVER
- Affected versions
- 1.0.0, 1.0.1, 1.1.0; 2.0.0, 2.1.0; 3.0.0-3.0.5
- Fixed version
- 7.0.0-LTS
- Patch status
- Patched
- Published
- 2026-10-19T04:17:03.657
- Modified
- 2026-10-19T04:17:03.657
Why it matters
High-severity vulnerability requiring prioritized review.
Recommended admin actions
- Review and patch based on exposure, asset criticality, and business impact.
Technical summary
在 openGauss-connector-jdbc 的 pgjdbc/src/main/java/org/postgresql/log/LogFactory.java 中，LogFactory 根据 JDBC 连接参数中的 logger 类名调用 Class.forName 加载类后，直接反射调用以 String 为参数的构造函数，再转换为 Log。缺少 asSubclass(Log.class) 校验，非 Log 实现类也会在类型检查前被实例化。因此，当攻击者可控制 JDBC URL 或连接属性中的 logger 类名，且客户端 classpath 中存在可被加载的类时，可能在客户端触发非预期的类加载与构造副作用。 此漏洞自 JDBC 1.1.0引入，影响 1.1.0 及之后的 2.x、3.x、5.x、6.x 各版本及补丁（含 6.0.0 分支最新 6.0.6），以及 7.0.0-RC1、7.0.0-RC2、7.0.0-RC3，并在 7.0.0-LTS 版本修复。修复在 Class.forName 之后先执行 asSubclass(Log.class)，仅允许 Log 子类进入构造。修复pr见https://gitcode.com/opengauss/openGauss-connector-jdbc/pull/423。
View the official NVD record for CVE-2026-111440
CVE data is sourced from NVD/CNA records and optional enrichment. Validate against the vendor advisory before taking production action.
VULNERABILITY PULSE
587 RECORDS
SECURE FEED ACTIVE
| AFFECTED PRODUCT | ACTION | ||
|---|---|---|---|
| CVE-2026-110372 |
OttoKit PATCH
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-110886 |
Conversational Forms for ChatBot PATCH
Reporter: AUDIT
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-108983 |
GV-ASManager PATCH
Reporter: 0DF08A0E-A200-4957-9BB0-084F562506F9
|
9.8
CRITICAL
|
VIEW RECORD |
| CVE-2026-109894 |
Booktics PATCH
Reporter: AUDIT
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-111998 |
vanus
Reporter: DISCLOSURE
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-102503 |
cmd/sam-node/node.go) in Google OSS Agent Mesh (SAM) PATCH
Reporter: CVE-COORDINATION
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-103091 |
internal/controlplane/server.go) in Google OSS Agent Mesh (SAM) PATCH
Reporter: CVE-COORDINATION
|
9.3
CRITICAL
|
VIEW RECORD |
| CVE-2026-112005 |
WhoDB 0.104.0 PATCH
Reporter: DISCLOSURE
|
9.2
CRITICAL
|
VIEW RECORD |
| CVE-2026-107436 |
Deserialization of Untrusted Data vulnerability in WP Chill Strong Testimonials strong-testimonials
Reporter: AUDIT
|
8.8
HIGH
|
VIEW RECORD |
| CVE-2026-111999 |
Vanus 0.8.0
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-112021 |
snac2 PATCH
Reporter: DISCLOSURE
|
8.7
HIGH
|
VIEW RECORD |
| CVE-2026-112001 |
ProjectSend 2.0.0 PATCH
Reporter: DISCLOSURE
|
8.6
HIGH
|
VIEW RECORD |
| CVE-2026-110895 |
an SQL Command ('SQL Injection') vulnerability in DevItems Support Genix support-genix-lite
Reporter: AUDIT
|
8.5
HIGH
|
VIEW RECORD |
| CVE-2026-112006 |
OpenTelemetry opentelemetry-exporter-otlp-proto-http 1.5.0 PATCH
Reporter: DISCLOSURE
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-112051 |
Xinference
Reporter: DISCLOSURE
|
8.3
HIGH
|
VIEW RECORD |
| CVE-2026-110373 |
Hamid Alinia Login with phone number login-with-phone-number
Reporter: AUDIT
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-111441 |
openGauss-server PATCH
Reporter: A1A479F7-907B-4AE8-A999-9148CADC9224
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-16487 |
REDHAT
Reporter: SECALERT
|
8.1
HIGH
|
VIEW RECORD |
| CVE-2026-112015 |
Omnigent 0.3.0 PATCH
Reporter: DISCLOSURE
|
7.7
HIGH
|
VIEW RECORD |
| CVE-2026-108120 |
SME Server
Reporter: VULNERABILITY
|
7.7
HIGH
|
VIEW RECORD |
| CVE-2026-112082 |
SGLang
Reporter: CNA
|
7.7
HIGH
|
VIEW RECORD |
| CVE-2026-112002 |
ProjectSend 2.5.0 PATCH
Reporter: DISCLOSURE
|
7.6
HIGH
|
VIEW RECORD |
| CVE-2026-110383 |
Authorization Bypass
Reporter: AUDIT
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-108984 |
GV-ASManager PATCH
Reporter: 0DF08A0E-A200-4957-9BB0-084F562506F9
|
7.5
HIGH
|
VIEW RECORD |
| CVE-2026-16460 |
REDHAT
Reporter: SECALERT
|
7.4
HIGH
|
VIEW RECORD |
| CVE-2026-112018 |
cgltf
Reporter: DISCLOSURE
|
7.3
HIGH
|
VIEW RECORD |
| CVE-2026-112000 |
Vanus 0.8.0
Reporter: DISCLOSURE
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-76740 |
HPE
Reporter: SECURITY-ALERT
|
7.2
HIGH
|
VIEW RECORD |
| CVE-2026-108485 |
ThemeGrill eStore estore
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-109895 |
Arraytics Booktics booktics
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-110382 |
NSquared Simply Schedule Appointments simply-schedule-appointments
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-110897 |
IdeaBox Creations PowerPack Lite for Beaver Builder powerpack-addon-for-beaver-builder
Reporter: AUDIT
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-112017 |
JeecgBoot PATCH
Reporter: DISCLOSURE
|
7.1
HIGH
|
VIEW RECORD |
| CVE-2026-111440 |
openGauss-connector-jdbc PATCH
Reporter: A1A479F7-907B-4AE8-A999-9148CADC9224
|
7
HIGH
|
VIEW RECORD |
| CVE-2026-112007 |
Schism Tracker
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112008 |
libmng
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112016 |
Netcore NR256CN
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112019 |
cgltf
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112020 |
LodePNG
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112048 |
libspatialite
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112052 |
libspatialite
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112059 |
libLAS
Reporter: DISCLOSURE
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-108121 |
Brian Mariani from DigitalCanion SA
Reporter: VULNERABILITY
|
6.9
MEDIUM
|
VIEW RECORD |
| CVE-2026-112009 |
smpeg
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112010 |
smpeg
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112013 |
libtta
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112014 |
LobsterAI PATCH
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112046 |
OW2 ASM 9.11 PATCH
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112053 |
Schroedinger libschroedinger
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112054 |
Schroedinger libschroedinger
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112055 |
wvWare wv
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112056 |
wvWare wv
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112057 |
libdvdnav PATCH
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112058 |
VideoLAN libdvdnav
Reporter: DISCLOSURE
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-110024 |
@fastify/jwt is a JWT utility plugin for Fastify. In PATCH
Reporter: CE714D77-ADD3-4F53-AFF5-83D477B104BB
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-74921 |
The Document Gallery WordPress plugin
Reporter: CONTACT
|
6.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-112049 |
Vita3K
Reporter: DISCLOSURE
|
6.7
MEDIUM
|
VIEW RECORD |
| CVE-2026-110365 |
Missing Authorization vulnerability in WPExperts Advanced File Manager file-manager-advanced
Reporter: AUDIT
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-110880 |
Missing Authorization vulnerability in Kit Kit (formerly ConvertKit) convertkit
Reporter: AUDIT
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-110883 |
VideoWhisper.com 2Way VideoCalls and Random Chat webcam-2way-videochat
Reporter: AUDIT
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-110885 |
HivePress HivePress hivepress
Reporter: AUDIT
|
6.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-112077 |
radare2 PATCH
Reporter: CNA
|
6.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-112060 |
librtmp in RTMPDump
Reporter: DISCLOSURE
|
6.1
MEDIUM
|
VIEW RECORD |
| CVE-2026-112003 |
ProjectSend 2.0.0 PATCH
Reporter: DISCLOSURE
|
6
MEDIUM
|
VIEW RECORD |
| CVE-2026-112062 |
lwIP
Reporter: DISCLOSURE
|
6
MEDIUM
|
VIEW RECORD |
| CVE-2026-112063 |
libstrophe
Reporter: DISCLOSURE
|
6
MEDIUM
|
VIEW RECORD |
| CVE-2026-112011 |
libtta
Reporter: DISCLOSURE
|
5.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-111990 |
A weakness
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-112025 |
A weakness
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-112027 |
cms
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-112028 |
A flaw
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-112044 |
A security vulnerability
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-112083 |
A security flaw
Reporter: CNA
|
5.5
MEDIUM
|
VIEW RECORD |
| CVE-2026-112047 |
OneUptime 14.0.2 PATCH
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-112061 |
librtmp (RTMPDump)
Reporter: DISCLOSURE
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-111988 |
A security flaw
Reporter: CNA
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-112043 |
cal.com
Reporter: CNA
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-103311 |
The Coinbase Commerce Payment Gateway for WooCommerce WordPress plugin
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-106010 |
The BDM Digital Payment Gateway WordPress plugin
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-74922 |
The Document Gallery WordPress plugin
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-86791 |
The iPOSpays Payment Gateway for WooCommerce WordPress plugin PATCH
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-94228 |
The TrueBooker WordPress plugin PATCH
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-94229 |
The TrueBooker WordPress plugin PATCH
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-94230 |
The TrueBooker WordPress plugin PATCH
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-94231 |
The TrueBooker WordPress plugin PATCH
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-94272 |
The Snap Finance WordPress plugin PATCH
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-94294 |
The App Builder WordPress plugin PATCH
Reporter: CONTACT
|
5.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-112111 |
The Bootstrap Shortcodes plugin for WordPress PATCH
Reporter: CVE
|
5.1
MEDIUM
|
VIEW RECORD |
| CVE-2026-112012 |
libtta
Reporter: DISCLOSURE
|
4.8
MEDIUM
|
VIEW RECORD |
| CVE-2026-76739 |
HPE
Reporter: SECURITY-ALERT
|
4.3
MEDIUM
|
VIEW RECORD |
| CVE-2026-91831 |
The Subscribe to Comments WordPress plugin PATCH
Reporter: CONTACT
|
3.8
LOW
|
VIEW RECORD |
| CVE-2026-110034 |
The Salon Booking System WordPress plugin PATCH
Reporter: CONTACT
|
3.7
LOW
|
VIEW RECORD |
| CVE-2026-112026 |
A security vulnerability
Reporter: CNA
|
2.9
LOW
|
VIEW RECORD |
| CVE-2026-112037 |
A flaw
Reporter: CNA
|
2.9
LOW
|
VIEW RECORD |
| CVE-2026-112041 |
diem
Reporter: CNA
|
2.9
LOW
|
VIEW RECORD |
| CVE-2026-112076 |
A security vulnerability
Reporter: CNA
|
2.9
LOW
|
VIEW RECORD |
| CVE-2026-112004 |
Teable PATCH
Reporter: DISCLOSURE
|
2.3
LOW
|
VIEW RECORD |
| CVE-2026-112050 |
Gitify PATCH
Reporter: DISCLOSURE
|
2.3
LOW
|
VIEW RECORD |
| CVE-2026-112112 |
An IPv6 FlowSpec validation bypass in the CZ.NIC BIRD Internet Routing Daemon
Reporter: CVE
|
2.3
LOW
|
VIEW RECORD |
| CVE-2026-111984 |
stable-diffusion-webui
Reporter: CNA
|
2.1
LOW
|
VIEW RECORD |
About the Vulnerability Pulse CVE Feed
The Vulnerability Pulse feed tracks live CVE advisories sourced from the National Vulnerability Database and vendor security disclosures. It is designed for SOC analysts, IT administrators, and security teams who need a fast, filterable view of current vulnerabilities without digging through raw NVD data.
How to Use the CVE Advisory Tracker
Use the severity filters to narrow results to Critical or High priority vulnerabilities. Filter by vendor to focus on software and hardware relevant to your environment. Export to CSV for reporting, ticketing, or patch prioritization workflows.
What Is a CVE Advisory?
A CVE (Common Vulnerabilities and Exposures) advisory is a public disclosure of a security vulnerability assigned a unique identifier by MITRE. Advisories include severity scores (CVSS), affected versions, and remediation guidance. Monitoring CVE advisories is a core function of vulnerability management programs and SOC operations.
CVE Analysis & Writeups
For in-depth analysis of specific vulnerabilities, visit the IT Knowledge Bases blog for CVE breakdowns, exploitation analysis, and remediation guidance written for security practitioners.