Postgresql vulnerabilities

Products

• Postgresql 204
• Psqlodbc 12
• Jdbc Driver 11
• Pgadmin 4 3
• Pgadmin 2

Newest

• postgresql psqlodbc psqlODBC stack buffer overflow copying ctid and oid values for updatable cursors CVE-2026-120067 5.9 MediumNovember 2, 2026
• postgresql psqlodbc psqlODBC log files are created with default permissions at a predictable path and follow symbolic links CVE-2026-120066 5.3 MediumNovember 2, 2026
• postgresql psqlodbc psqlODBC does not escape a server-supplied column name in its updatable-cursor queries CVE-2026-120065 7.1 HighNovember 2, 2026
• postgresql psqlodbc psqlODBC does not validate column numbers and row indexes in binding and descriptor functions CVE-2026-120064 7.5 HighNovember 2, 2026
• postgresql psqlodbc psqlODBC stack buffer overflow when quoting long schema and table names CVE-2026-120063 5.9 MediumNovember 2, 2026
• postgresql psqlodbc psqlODBC SQL injection through SQLSpecialColumns table and schema names CVE-2026-120062 7.5 HighNovember 2, 2026
• postgresql psqlodbc psqlODBC ODBC escape parser stack buffer overflow CVE-2026-120061 7.5 HighNovember 2, 2026
• postgresql psqlodbc psqlODBC does not validate server-supplied counts and lengths CVE-2026-120060 5.9 MediumNovember 2, 2026
• postgresql psqlodbc psqlODBC uses a server-supplied column name as a format string CVE-2026-120059 6.8 MediumNovember 2, 2026
• postgresql psqlodbc psqlODBC row cache overflow when a later FETCH changes the column count CVE-2026-120058 7.5 HighNovember 2, 2026
• postgresql psqlodbc psqlODBC large-object read overflows the application buffer CVE-2026-120057 7.5 HighNovember 2, 2026
• postgresql psqlodbc psqlODBC SQLBindParameter heap memory corruption when binding more than 32767 parameters CVE-2026-109448 Fix available 5.9 MediumOctober 12, 2026
• postgresql PostgreSQL logical decoding can dlopen arbitrary file CVE-2026-6471 Public exploitFix available 7.2 HighAugust 13, 2026
• postgresql PostgreSQL refint plan cache type confusion executes arbitrary code CVE-2026-14671 Fix available 8.8 HighAugust 13, 2026
• postgresql PostgreSQL fails to check type USAGE privilege CVE-2026-6470 Fix available 4.3 MediumAugust 13, 2026
• postgresql PostgreSQL ALTER TABLE ALTER TYPE resets extended statistics ownership CVE-2026-6469 Fix available 3.8 LowAugust 13, 2026
• postgresql PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands CVE-2026-6464 Fix available 8.1 HighAugust 13, 2026
• postgresql PostgreSQL pg_dump heap buffer overflow executes arbitrary code CVE-2026-19385 Fix available 8.8 HighAugust 13, 2026
• postgresql PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client CVE-2026-18408 Fix available 8.8 HighAugust 13, 2026
• postgresql PostgreSQL ascii() function reads past end of buffer CVE-2026-18024 Fix available 4.3 MediumAugust 13, 2026
• postgresql PostgreSQL ECPG integer underflow can crash the client CVE-2026-16241 Fix available 3.8 LowAugust 13, 2026
• postgresql PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code CVE-2026-16239 Fix available 8.8 HighAugust 13, 2026
• postgresql PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code CVE-2026-16238 Fix available 8.8 HighAugust 13, 2026
• postgresql PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound CVE-2026-15742 Fix available 8.8 HighAugust 13, 2026
• postgresql PostgreSQL expression deparse allows SQL injection via EXTRACT argument CVE-2026-15741 Fix available 8.8 HighAugust 13, 2026
• postgresql PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL CVE-2026-14681 Fix available 4.2 MediumAugust 13, 2026
• postgresql PostgreSQL type confusion via "internal" arguments CVE-2026-14680 Fix available 8.8 HighAugust 13, 2026
• postgresql PostgreSQL stack buffer overflow in argument match writes 0x0 and 0x1 to server memory CVE-2026-14679 Fix available 8.2 HighAugust 13, 2026
• postgresql PostgreSQL pg_trgm picksplit reads past end of buffer CVE-2026-14678 Fix available 4.3 MediumAugust 13, 2026
• postgresql PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound CVE-2026-14677 Fix available 8.8 HighAugust 13, 2026
• postgresql PostgreSQL pg_stat_statements heap buffer overflow executes arbitrary code CVE-2026-14676 Fix available 8.8 HighAugust 13, 2026
• postgresql PostgreSQL amcheck does not clear untrusted search path CVE-2026-14673 Fix available 3.8 LowAugust 13, 2026
• postgresql PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle CVE-2026-14672 Fix available 5.3 MediumAugust 13, 2026
• postgresql PostgreSQL plperl tied object heap buffer overflow executes arbitrary code CVE-2026-14670 Fix available 8.8 HighAugust 13, 2026
• postgresql PostgreSQL to_char heap buffer overflow executes arbitrary code CVE-2026-14669 Public exploitFix available 8.8 HighAugust 13, 2026
• postgresql PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read CVE-2026-14668 Fix available 8.1 HighAugust 13, 2026
• postgresql PostgreSQL row security caching disregards role modifications CVE-2026-14666 Fix available 4.2 MediumAugust 13, 2026
• postgresql PostgreSQL regexp heap buffer overflow executes arbitrary code CVE-2026-14664 Fix available 8.8 HighAugust 13, 2026
• postgresql PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext CVE-2026-14663 Fix available 6.5 MediumAugust 13, 2026
• postgresql PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound CVE-2026-14662 Public exploitFix available 8.8 HighAugust 13, 2026
• pgjdbc, postgresql jdbc driver +1 more Silent channel-binding authentication downgrade via unsupported certificate algorithms CVE-2026-54291 Fix available 8.2 HighJuly 6, 2026
• postgresql PostgreSQL REFRESH PUBLICATION allows SQL injection via table name CVE-2026-6638 Fix available 3.7 LowMay 14, 2026
• postgresql PostgreSQL refint allows stack buffer overflow and SQL injection CVE-2026-6637 Fix available 8.8 HighMay 14, 2026
• postgresql PostgreSQL pg_restore_attribute_stats accepts values that cause query planning to read past end of stats array CVE-2026-6575 Fix available 4.3 MediumMay 14, 2026
• postgresql PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion CVE-2026-6479 Fix available 7.5 HighMay 14, 2026
• postgresql, red hat enterprise linux 10, enterprise linux 10.0 extended update support +16 more +18 more PostgreSQL discloses MD5-hashed passwords via covert timing channel CVE-2026-6478 Fix available 6.5 MediumMay 14, 2026
• postgresql, red hat discovery 2, enterprise linux 10 +17 more +19 more PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory CVE-2026-6477 Fix available 8.8 HighMay 14, 2026
• postgresql PostgreSQL pg_createsubscriber allows SQL injection via subscription name CVE-2026-6476 Fix available 7.2 HighMay 14, 2026
• postgresql PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice CVE-2026-6475 Public exploitFix available 8.8 HighMay 14, 2026
• postgresql PostgreSQL timeofday() can disclose portions of server memory CVE-2026-6474 Fix available 4.3 MediumMay 14, 2026
• Show olderLoading…