PostgreSQL

Latest CVEs · RSS

• CVE-2026-107350 2026-10-14 · CVSS 8.8
  Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other
• CVE-2026-107349 2026-10-14 · CVSS 7.5
  An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options param
• CVE-2026-107348 2026-10-14 · CVSS 5.9
  Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service wh
• CVE-2026-109448 2026-10-12 · CVSS 5.9
  Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, t
• CVE-2026-107315 2026-10-07 · CVSS 5.3
  pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer ins
• CVE-2026-107314 2026-10-07 · CVSS 5.9
  pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentica
• CVE-2026-107313 2026-10-07 · CVSS 4.2
  pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a
• CVE-2026-103484 2026-10-01 · CVSS 8.8
  IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution.
• CVE-2026-97469 2026-09-25 · CVSS 4.3
  PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed, hash_output
• CVE-2026-19888 2026-09-23 · CVSS 7.5
  Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cr
• CVE-2026-6669 2026-09-23 · CVSS 5.9
  Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a maliciou
• CVE-2026-6668 2026-09-23 · CVSS 7.5
  Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficien
• CVE-2026-86864 2026-09-17 · CVSS 8.8
  pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/<sid>/object request to the pg_dump argument vector as a bare trailin
• CVE-2026-86863 2026-09-17 · CVSS 9.8
  pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through
• CVE-2026-86862 2026-09-17 · CVSS 6.5
  pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pg_restore and psql.
• CVE-2026-86861 2026-09-17 · CVSS 5.9
  pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.check_access_permissi
• CVE-2026-83534 2026-09-06 · CVSS 6.4
  PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows the owner of a table to run arbitrary code with su
• CVE-2026-19634 2026-09-06 · CVSS 6.4
  PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted o
• CVE-2026-19633 2026-09-06 · CVSS 8.8
  PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqu
• CVE-2026-14671 2026-08-13 · CVSS 8.8
  Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for
• CVE-2026-6471 2026-08-13 · CVSS 7.2
  Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system acc
• CVE-2026-6470 2026-08-13 · CVSS 4.3
  Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a depend
• CVE-2026-6469 2026-08-13 · CVSS 3.8
  Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrong
• CVE-2026-6464 2026-08-13 · CVSS 8.1
  Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If t
• CVE-2026-19385 2026-08-13 · CVSS 8.8
  Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user runn