PO
Database
PostgreSQL
211
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 7High 76Medium 40Low 8
Watch
Add PostgreSQL to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2017-8806 | 5.5 | Nov 13 | The Debian pg_ctlcluster, pg_createcluster, and pg_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181+deb9u1 for PostgreSQL (and other… Affected: All versions, or not specified |
| CVE-2026-6472 | 5.4 | May 14 | PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege Affected: 18 before 18.4; 17 before 17.10; 16 before 16.14; 15 before 15.18; before 14.23 |
| CVE-2024-10976 | 5.4 | Nov 14 | PostgreSQL row security below e.g. subqueries disregards user ID changes Affected: 17 before 17.1; 16 before 16.5; 15 before 15.9; 14 before 14.14; 13 before 13.17; before 12.21 |
| CVE-2023-2455 | 5.4 | Jun 9 | Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific policies are used and… Affected: 11.0 before 11.20; 12.0 before 12.15; 13.0 before 13.11; 14.0 before 14.8; 15.0 before 15.3 |
| CVE-2026-14672 | 5.3 | Aug 13 | PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle Affected: 18 before 18.6; 17 before 17.11; 16 before 16.15 |
| CVE-2023-5870 | 4.4 | Dec 10 | A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the… Affected: 11.0 before 11.22; 12.0 before 12.17; 13.0 before 13.13; 14.0 before 14.10; 15.0 before 15.5; 16.0 |
| CVE-2020-21469 | 4.4 | Aug 22 | An issue was discovered in PostgreSQL 12.2 allows attackers to cause a denial of service via repeatedly sending SIGHUP signals Affected: 12.2 |
| CVE-2026-6470 | 4.3 | Aug 13 | PostgreSQL fails to check type USAGE privilege Affected: 18 before 18.6; 17 before 17.11; 16 before 16.15; 15 before 15.19; before 14.24 |
| CVE-2026-18024 | 4.3 | Aug 13 | PostgreSQL ascii() function reads past end of buffer Affected: 18 before 18.6; 17 before 17.11; 16 before 16.15; 15 before 15.19; before 14.24 |
| CVE-2026-14678 | 4.3 | Aug 13 | PostgreSQL pg_trgm picksplit reads past end of buffer Affected: 18 before 18.6; 17 before 17.11; 16 before 16.15; 15 before 15.19; before 14.24 |
| CVE-2026-6575 | 4.3 | May 14 | PostgreSQL pg_restore_attribute_stats accepts values that cause query planning to read past end of stats array Affected: 18 before 18.4 |
| CVE-2026-6474 | 4.3 | May 14 | PostgreSQL timeofday() can disclose portions of server memory Affected: 18 before 18.4; 17 before 17.10; 16 before 16.14; 15 before 15.18; before 14.23 |
| CVE-2026-2003 | 4.3 | Feb 12 | PostgreSQL oidvector discloses a few bytes of memory Affected: 18 before 18.2; 17 before 17.8; 16 before 16.12; 15 before 15.16; before 14.21 |
| CVE-2024-4317 | 4.3 | May 9 | PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks Affected: 16 before 16.3; 15 before 15.7; 14 before 14.12 |
| CVE-2023-5868 | 4.3 | Dec 10 | A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with… Affected: 11.0 before 11.22; 12.0 before 12.17; 13.0 before 13.13; 14.0 before 14.10; 15.0 before 15.5; 16.0 |
| CVE-2023-39418 | 4.3 | Aug 11 | A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT Affected: 15.0 before 15.4 |
| CVE-2021-3393 | 4.3 | Apr 1 | An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11 Affected: before 11.11; 12.0 before 12.6; 13.0 before 13.2 |
| CVE-2021-20229 | 4.3 | Feb 23 | A flaw was found in PostgreSQL in versions before 13.2 Affected: 13.0 before 13.2 |
| CVE-2014-8161 | 4.3 | Jan 27 | PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values… Affected: before 9.0.19; 9.1.0 before 9.1.15; 9.2.0 before 9.2.10; 9.3.0 before 9.3.6; 9.4.0 before 9.4.1 |
| CVE-2019-10130 | 4.3 | Jul 30 | A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17 Affected: 9.5.0 before 9.5.17; 9.6.0 before 9.6.13; 10.0 before 10.8; 11.0 before 11.3 |
| CVE-2026-14681 | 4.2 | Aug 13 | PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL Affected: 18 before 18.6; 17 before 17.11 |
| CVE-2026-14666 | 4.2 | Aug 13 | PostgreSQL row security caching disregards role modifications Affected: 18 before 18.6; 17 before 17.11; 16 before 16.15; 15 before 15.19; before 14.24 |
| CVE-2024-10978 | 4.2 | Nov 14 | PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID Affected: 17 before 17.1; 16 before 16.5; 15 before 15.9; 14 before 14.14; 13 before 13.17; before 12.21 |
| CVE-2026-6469 | 3.8 | Aug 13 | PostgreSQL ALTER TABLE ALTER TYPE resets extended statistics ownership Affected: 18 before 18.6; 17 before 17.11; 16 before 16.15; 15 before 15.19; before 14.24 |
| CVE-2026-16241 | 3.8 | Aug 13 | PostgreSQL ECPG integer underflow can crash the client Affected: 18 before 18.6; 17 before 17.11; 16 before 16.15; 15 before 15.19; before 14.24 |
| CVE-2026-14673 | 3.8 | Aug 13 | PostgreSQL amcheck does not clear untrusted search path Affected: 18 before 18.6; 16 before 16.15; 15 before 15.19; before 14.24 |
| CVE-2024-10977 | 3.7 | Nov 14 | PostgreSQL libpq retains an error message from man-in-the-middle Affected: 17 before 17.1; 16 before 16.5; 15 before 15.9; 14 before 14.14; 13 before 13.17; before 12.21 |
| CVE-2022-41862 | 3.7 | Mar 3 | In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption Affected: 12.0 before 12.14; 13.0 before 13.10; 14.0 before 14.7; 15.0 before 15.2 |
| CVE-2025-12817 | 3.1 | Nov 13 | PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege Affected: 18 before 18.1; 17 before 17.7; 16 before 16.11; 15 before 15.15; 14 before 14.20; before 13.23 |
| CVE-2025-8713 | 3.1 | Aug 14 | PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table Affected: 17 before 17.6; 16 before 16.10; 15 before 15.14; 14 before 14.19; before 13.22 |
| CVE-2019-10209 | 2.2 | Oct 29 | Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan Affected: 11.0 before 11.5 |
| CVE-2015-5289 | – | Oct 26 | Multiple stack-based buffer overflows in json parsing in PostgreSQL before 9.3.x before 9.3.10 and 9.4.x before 9.4.5 allow attackers to cause a denial of service (server crash)… Affected: 9.3.0 before 9.3.10; 9.4.0 before 9.4.5 |
| CVE-2015-5288 | – | Oct 26 | The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause… Affected: through 9.0.22; 9.1; 9.1.1; 9.1.2; 9.1.3; 9.1.4; +34 more |
| CVE-2015-3165 | – | May 28 | Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a… Affected: through 9.0.19; 9.1; 9.1.1; 9.1.2; 9.1.3; 9.1.4; +31 more |
| CVE-2014-2669 | – | Mar 31 | Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote… Affected: 9.0; 9.0.1; 9.0.2; 9.0.3; 9.0.4; 9.0.5; +31 more |
| CVE-2014-0067 | – | Mar 31 | The "make check" command for the test suites in PostgreSQL 9.3.3 and earlier does not properly invoke initdb to specify the authentication requirements for a database cluster to… Affected: through 8.4.19; 8.4.1; 8.4.2; 8.4.3; 8.4.4; 8.4.5; +34 more |
| CVE-2014-0066 | – | Mar 31 | The chkpass extension in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly check the return value of… Affected: through 8.4.19; 8.4.1; 8.4.2; 8.4.3; 8.4.4; 8.4.5; +34 more |
| CVE-2014-0065 | – | Mar 31 | Multiple buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to… Affected: through 8.4.19; 8.4.1; 8.4.2; 8.4.3; 8.4.4; 8.4.5; +34 more |
| CVE-2014-0064 | – | Mar 31 | Multiple integer overflows in the path_in and other unspecified functions in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x… Affected: through 8.4.19; 8.4.1; 8.4.2; 8.4.3; 8.4.4; 8.4.5; +34 more |
| CVE-2014-0063 | – | Mar 31 | Multiple stack-based buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated… Affected: through 8.4.19; 8.4.1; 8.4.2; 8.4.3; 8.4.4; 8.4.5; +34 more |
| CVE-2014-0062 | – | Mar 31 | Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and… Affected: through 8.4.19; 8.4.1; 8.4.2; 8.4.3; 8.4.4; 8.4.5; +34 more |
| CVE-2014-0061 | – | Mar 31 | The validator functions for the procedural languages (PLs) in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow… Affected: through 8.4.19; 8.4.1; 8.4.2; 8.4.3; 8.4.4; 8.4.5; +34 more |
| CVE-2014-0060 | – | Mar 31 | PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows… Affected: through 8.4.19; 8.4.1; 8.4.2; 8.4.3; 8.4.4; 8.4.5; +34 more |
| CVE-2013-1903 | – | Apr 4 | PostgreSQL, possibly 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 incorrectly provides the superuser password to… Affected: 9.2; 9.2.1; 9.2.2; 9.2.3; 9.1; 9.1.1; +34 more |
| CVE-2013-1902 | – | Apr 4 | PostgreSQL, 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 generates insecure temporary files with predictable… Affected: 9.2; 9.2.1; 9.2.2; 9.2.3; 9.1; 9.1.1; +34 more |
| CVE-2013-1901 | – | Apr 4 | PostgreSQL 9.2.x before 9.2.4 and 9.1.x before 9.1.9 does not properly check REPLICATION privileges, which allows remote authenticated users to bypass intended backup restrictions… Affected: 9.2; 9.2.1; 9.2.2; 9.2.3; 9.1; 9.1.1; +7 more |
| CVE-2013-1900 | – | Apr 4 | PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17, when using OpenSSL, generates insufficiently random numbers, which might allow… Affected: 9.2; 9.2.1; 9.2.2; 9.2.3; 9.1; 9.1.1; +34 more |
| CVE-2013-1899 | – | Apr 4 | Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service (file… Affected: 9.2; 9.2.1; 9.2.2; 9.2.3; 9.1; 9.1.1; +20 more |
| CVE-2013-0255 | – | Feb 13 | PostgreSQL 9.2.x before 9.2.3, 9.1.x before 9.1.8, 9.0.x before 9.0.12, 8.4.x before 8.4.16, and 8.3.x before 8.3.23 does not properly declare the enum_recv function in… Affected: 8.3; 8.3.1; 8.3.2; 8.3.3; 8.3.4; 8.3.5; +34 more |
| CVE-2012-1618 | – | Oct 6 | Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default… Affected: 9.1 |