https://vulnogram.org/ Most recent CVEs assigned by EnterpriseDB Corporation (edb). https://vulnogram.org/seaview/icons/edb.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:07 GMT https://vulnogram.org/CVE-2026-93853 https://vulnogram.org/CVE-2026-93853 Unverified ownership in Barman snapshot backup deletion allows a principal who can write the backup catalog to cause Barman to delete unrelated cloud snapshots. When a snapshot backup is deleted, either explicitly or by retention policy enforcement,… High Tue, 29 Sep 2026 20:55:51 GMT https://vulnogram.org/CVE-2026-96538 https://vulnogram.org/CVE-2026-96538 WarehousePG (WHPG) 7.x before 7.6.0-WHPG is affected by a missing authorization vulnerability (CWE-862) in the built-in server-side file functions pg_file_write(text,text,bool), pg_file_rename(text,text,text), pg_file_unlink(text), and pg_logdir_ls()… High Mon, 28 Sep 2026 14:41:15 GMT https://vulnogram.org/CVE-2026-50738 https://vulnogram.org/CVE-2026-50738 A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced after the underlying slot has been freed or recycled during normal worker lifecycle events. The condition is reachable during normal… High Tue, 28 Jul 2026 17:55:58 GMT https://vulnogram.org/CVE-2026-50737 https://vulnogram.org/CVE-2026-50737 When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's default expressions on the subscriber. Because the apply worker runs at a privilege level equivalent to a PostgreSQL superuser in… Critical Tue, 28 Jul 2026 17:55:43 GMT https://vulnogram.org/CVE-2026-50736 https://vulnogram.org/CVE-2026-50736 The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at the privilege level of the apply worker, which is equivalent to a PostgreSQL su… Critical Tue, 28 Jul 2026 17:55:27 GMT https://vulnogram.org/CVE-2026-50735 https://vulnogram.org/CVE-2026-50735 pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting as the publisher for a subscription, for example a… Medium Tue, 28 Jul 2026 17:55:12 GMT https://vulnogram.org/CVE-2026-0949 https://vulnogram.org/CVE-2026-0949 PEM versions prior to 9.8.1 are affected by a stored Cross-site Scripting (XSS) vulnerability that allows users with access to the Manage Charts menu to inject arbitrary JavaScript when creating a new chart, which is then executed by any user accessi… Medium Fri, 16 Jan 2026 16:29:42 GMT https://vulnogram.org/CVE-2025-14038 https://vulnogram.org/CVE-2025-14038 EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. This could allow an attacker to read potentially sensitive data or possibly cause a denial-of-service by writing malformed data to c… High Network Exploitable Mon, 15 Dec 2025 18:02:01 GMT https://vulnogram.org/CVE-2025-2506 https://vulnogram.org/CVE-2025-2506 When pglogical attempts to replicate data, it does not verify it is using a replication connection, which means a user with CONNECT access to a database configured for replication can execute the pglogical command to obtain read access to replicated… Medium Thu, 22 May 2025 15:22:20 GMT https://vulnogram.org/CVE-2024-4545 https://vulnogram.org/CVE-2024-4545 All versions of EnterpriseDB Postgres Advanced Server (EPAS) from 15.0 prior to 15.7.0 and from 16.0 prior to 16.3.0 may allow users using edbldr to bypass role permissions from pg_read_server_files. This could allow low privilege users to read files… High Thu, 09 May 2024 18:12:18 GMT