https://vulnogram.org/ Most recent CVEs assigned by PostgreSQL (postgresql). https://vulnogram.org/seaview/icons/postgresql.png https://vulnogram.org/ Wed, 21 Oct 2026 07:00:06 GMT https://vulnogram.org/CVE-2026-107350 https://vulnogram.org/CVE-2026-107350 Improper authentication in PgBouncer 1.17.0 through 1.26.0 allows a remote attacker who knows the password of a user listed in auth_file to log in as any other user that authenticates using SCRAM, including PgBouncer admin users and backend superuser… High Wed, 14 Oct 2026 17:34:39 GMT https://vulnogram.org/CVE-2026-107349 https://vulnogram.org/CVE-2026-107349 An infinite loop in PgBouncer 1.20.0 through 1.26.0 allows an unauthenticated remote attacker to cause a denial of service. A StartupMessage whose options parameter contains an empty parameter name, such as "-c=", makes the ignore_startup_parameters… High Wed, 14 Oct 2026 17:34:33 GMT https://vulnogram.org/CVE-2026-107348 https://vulnogram.org/CVE-2026-107348 Integer overflow in the message buffer growth logic (mbuf_make_room) in PgBouncer 1.21.0 through 1.26.0 allows a remote attacker to cause a denial of service when max_packet_size is configured above 2147483648. A packet header declaring a length abov… Medium Wed, 14 Oct 2026 17:34:29 GMT https://vulnogram.org/CVE-2026-109448 https://vulnogram.org/CVE-2026-109448 Integer wraparound in psqlODBC SQLBindParameter allows an application, or an attacker who controls how many parameters the application binds on one statement, to corrupt heap memory. psqlODBC stores the binding count in a signed 16-bit field. Binding… Medium Network Exploitable Mon, 12 Oct 2026 17:42:59 GMT https://vulnogram.org/CVE-2026-107315 https://vulnogram.org/CVE-2026-107315 pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. The bytes are messa… Medium Wed, 07 Oct 2026 23:03:18 GMT https://vulnogram.org/CVE-2026-107314 https://vulnogram.org/CVE-2026-107314 pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sh… Medium Network Exploitable Wed, 07 Oct 2026 23:03:01 GMT https://vulnogram.org/CVE-2026-107313 https://vulnogram.org/CVE-2026-107313 pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption (gssEncMode=prefer or require), and the server stores the v… Medium Wed, 07 Oct 2026 18:19:53 GMT https://vulnogram.org/CVE-2026-103484 https://vulnogram.org/CVE-2026-103484 IVFFlat index build in pgvector before 0.8.7 allows a database user to write data out-of-bounds, which can lead to arbitrary code execution. High Thu, 01 Oct 2026 19:49:03 GMT https://vulnogram.org/CVE-2026-97469 https://vulnogram.org/CVE-2026-97469 PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to repeatedly call the anon.hash() function and collects (seed, hash_output) pairs to perform an offline brute-force attack and deduce the salt. A masked role can ru… Medium Fri, 25 Sep 2026 15:40:45 GMT https://vulnogram.org/CVE-2026-19888 https://vulnogram.org/CVE-2026-19888 Missing validation of a mandatory attribute in the SCRAM client-final-message parser in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to crash the process. A malformed message can make the parser report success while leaving a re… High Wed, 23 Sep 2026 16:04:48 GMT https://vulnogram.org/CVE-2026-6669 https://vulnogram.org/CVE-2026-6669 Missing upper bound on the key derivation iteration count accepted during SCRAM authentication to a backend server in PgBouncer through 1.25.2 allows a malicious or compromised PostgreSQL backend to cause uncontrolled CPU consumption in PgBouncer. Th… Medium Wed, 23 Sep 2026 16:04:47 GMT https://vulnogram.org/CVE-2026-6668 https://vulnogram.org/CVE-2026-6668 Integer overflow in the packet buffer growth logic in PgBouncer through 1.25.2 allows an unauthenticated remote attacker to cause a denial of service. Sufficiently large input makes the buffer size computation overflow, leaving the growth loop unable… High Wed, 23 Sep 2026 16:04:47 GMT https://vulnogram.org/CVE-2026-86864 https://vulnogram.org/CVE-2026-86864 pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job/<sid>/object request to the pg_dump argument vector as a bare trailing positional argument, without validation. Because pg_dump parses its options with getopt_… High Thu, 17 Sep 2026 15:31:00 GMT https://vulnogram.org/CVE-2026-86863 https://vulnogram.org/CVE-2026-86863 pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse proxy in front of pgAdmin, delivered through the WSGI/CGI environment. WebserverAuthentication.get_user() read config.WEBSERVER_REMOTE… Critical Network Exploitable Thu, 17 Sep 2026 15:30:58 GMT https://vulnogram.org/CVE-2026-86862 https://vulnogram.org/CVE-2026-86862 pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the --dbname option given to pg_restore and psql. libpq expands a database name containing an equals sign into a full connection string, an… High Thu, 17 Sep 2026 15:30:56 GMT https://vulnogram.org/CVE-2026-86861 https://vulnogram.org/CVE-2026-86861 pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested path with Filemanager.check_access_permission() and then opened the file for writing with a plain open() call. CVE-2026-7819 had prev… Medium Thu, 17 Sep 2026 15:30:51 GMT https://vulnogram.org/CVE-2026-83534 https://vulnogram.org/CVE-2026-83534 PostgreSQL Anonymizer contains a vulnerability in the anon.anonymize_database_parallel() function that allows the owner of a table to run arbitrary code with superuser privilege. The issue is fixed in PostgreSQL Anonymizer 3.2.0 and later versions Medium Sun, 06 Sep 2026 15:25:41 GMT https://vulnogram.org/CVE-2026-19634 https://vulnogram.org/CVE-2026-19634 PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing specially crafted object names. If a superuser subsequently calls anon.import_database_rules() or anon.import… Medium Sun, 06 Sep 2026 15:25:36 GMT https://vulnogram.org/CVE-2026-19633 https://vulnogram.org/CVE-2026-19633 PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context of… High Sun, 06 Sep 2026 15:25:32 GMT https://vulnogram.org/CVE-2026-14671 https://vulnogram.org/CVE-2026-14671 Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with su… High Thu, 13 Aug 2026 13:00:18 GMT https://vulnogram.org/CVE-2026-6471 https://vulnogram.org/CVE-2026-6471 Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account running the server, via the choice of logical decoding plugin. This in turn runs arbi… High Thu, 13 Aug 2026 13:00:18 GMT https://vulnogram.org/CVE-2026-6470 https://vulnogram.org/CVE-2026-6470 Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on the type. Many DDL operations did check the privilege, but assigning a range subty… Medium Thu, 13 Aug 2026 13:00:17 GMT https://vulnogram.org/CVE-2026-6469 https://vulnogram.org/CVE-2026-6469 Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows the table owner to run DROP STATISTICS and ALTER STATISTICS via this improper own… Low Thu, 13 Aug 2026 13:00:16 GMT https://vulnogram.org/CVE-2026-6464 https://vulnogram.org/CVE-2026-6464 Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY FROM STDIN" or "\copy FROM STDIN" command fails before the server indicates that i… High Thu, 13 Aug 2026 13:00:16 GMT https://vulnogram.org/CVE-2026-19385 https://vulnogram.org/CVE-2026-19385 Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_dump, via a crafted transform list. Versions before PostgreSQL 18.6, 17.11, 16.15,… High Thu, 13 Aug 2026 13:00:15 GMT https://vulnogram.org/CVE-2026-18408 https://vulnogram.org/CVE-2026-18408 Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-c… High Thu, 13 Aug 2026 13:00:14 GMT https://vulnogram.org/CVE-2026-18024 https://vulnogram.org/CVE-2026-18024 Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is the same class of defect that CVE-2026-2006 fixed, though this instance has less imp… Medium Thu, 13 Aug 2026 13:00:14 GMT https://vulnogram.org/CVE-2026-16241 https://vulnogram.org/CVE-2026-16241 Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lacking the mandatory prefix. The client overwrites a huge memory region with bytes o… Low Thu, 13 Aug 2026 13:00:13 GMT https://vulnogram.org/CVE-2026-16239 https://vulnogram.org/CVE-2026-16239 Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.6, 17.11… High Thu, 13 Aug 2026 13:00:13 GMT https://vulnogram.org/CVE-2026-16238 https://vulnogram.org/CVE-2026-16238 Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions bef… High Thu, 13 Aug 2026 13:00:12 GMT https://vulnogram.org/CVE-2026-15742 https://vulnogram.org/CVE-2026-15742 Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running the database, via extreme inputs to SQL function levenshtein() or levenshtein_le… High Thu, 13 Aug 2026 13:00:11 GMT https://vulnogram.org/CVE-2026-15741 https://vulnogram.org/CVE-2026-15741 SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression deparse consumers broadly, including pg_dump, psql commands like \sf, and any simi… High Thu, 13 Aug 2026 13:00:11 GMT https://vulnogram.org/CVE-2026-14681 https://vulnogram.org/CVE-2026-14681 Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection. Despite a pg_hba.conf that appears to require GSSAPI, the connection may exchan… Medium Thu, 13 Aug 2026 13:00:10 GMT https://vulnogram.org/CVE-2026-14680 https://vulnogram.org/CVE-2026-14680 Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-… High Thu, 13 Aug 2026 13:00:10 GMT https://vulnogram.org/CVE-2026-14679 https://vulnogram.org/CVE-2026-14679 Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 and 0x1 bytes. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are a… High Thu, 13 Aug 2026 13:00:09 GMT https://vulnogram.org/CVE-2026-14678 https://vulnogram.org/CVE-2026-14678 Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via the lossy signal of index split choices. Versions before PostgreSQL 18.6, 17.11,… Medium Thu, 13 Aug 2026 13:00:08 GMT https://vulnogram.org/CVE-2026-14677 https://vulnogram.org/CVE-2026-14677 Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via crafted function bodies. This may execute arbitrary code as the operating system us… High Thu, 13 Aug 2026 13:00:08 GMT https://vulnogram.org/CVE-2026-14676 https://vulnogram.org/CVE-2026-14676 Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via crafted queries containing array constants. Within major version 18, minor versions before… High Thu, 13 Aug 2026 13:00:07 GMT https://vulnogram.org/CVE-2026-14673 https://vulnogram.org/CVE-2026-14673 Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression indexes that depend on the search path, via setting a hostile search path before calling the… Low Thu, 13 Aug 2026 13:00:06 GMT https://vulnogram.org/CVE-2026-14672 https://vulnogram.org/CVE-2026-14672 Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count. This requires the probed user to have a non-default scram_iterations count, bec… Medium Thu, 13 Aug 2026 13:00:06 GMT https://vulnogram.org/CVE-2026-14670 https://vulnogram.org/CVE-2026-14670 Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, via a crafted function body. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19,… High Thu, 13 Aug 2026 13:00:05 GMT https://vulnogram.org/CVE-2026-14669 https://vulnogram.org/CVE-2026-14669 Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the database, via a long POSIX timezone abbreviation. Versions before PostgreSQL 18.6, 17.11… High Thu, 13 Aug 2026 13:00:04 GMT https://vulnogram.org/CVE-2026-14668 https://vulnogram.org/CVE-2026-14668 Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4-byte span of memory, via a chosen non-ctid input. While the calculation loses pr… High Thu, 13 Aug 2026 13:00:04 GMT https://vulnogram.org/CVE-2026-14666 https://vulnogram.org/CVE-2026-14666 Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security policies after those changes require a different policy, via plan reuse. Stale policie… Medium Thu, 13 Aug 2026 13:00:03 GMT https://vulnogram.org/CVE-2026-14664 https://vulnogram.org/CVE-2026-14664 Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pass encoding validation. This shares heritage with CVE-2026-2006, but this case in… High Thu, 13 Aug 2026 13:00:03 GMT https://vulnogram.org/CVE-2026-14663 https://vulnogram.org/CVE-2026-14663 Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and OpenSSL configuration determine the disabled ciphers. If the application accepts en… Medium Thu, 13 Aug 2026 13:00:02 GMT https://vulnogram.org/CVE-2026-14662 https://vulnogram.org/CVE-2026-14662 Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds, via crafted large inputs. This may execute arbitrary code as the op… High Thu, 13 Aug 2026 13:00:01 GMT https://vulnogram.org/CVE-2026-17566 https://vulnogram.org/CVE-2026-17566 pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command. To stop an attacker from breaking out of the (...) wrappe… Critical Fri, 31 Jul 2026 16:00:22 GMT https://vulnogram.org/CVE-2026-17351 https://vulnogram.org/CVE-2026-17351 The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as exactly one non-transaction-control statement before running it inside a BEGIN TRANSACTION REA… Critical Fri, 31 Jul 2026 16:00:19 GMT https://vulnogram.org/CVE-2026-17350 https://vulnogram.org/CVE-2026-17350 The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3) did not enforce its permission check consistently. In SERVER mode, pgAdmin 4 gates each tool behind a per-tool Flask-Security permission, but the… Medium Fri, 31 Jul 2026 16:00:03 GMT