PO
Vendor
PostgreSQL
224
CVEs
0
On KEV
1
New 30D
Products
PO9.8
PostgreSQL
Database
211 CVEs0 on KEV1 new
PJ9.8
Postgresql Jdbc Driver
Postgresql
11 CVEs0 on KEV0 new
P46.5
Pgadmin 4
Postgresql
1 CVEs0 on KEV0 new
PO7.8
Postgresql-common
Postgresql
1 CVEs0 on KEV0 new
Recent CVEs
| CVE | Product | CVSS | Published | Summary |
|---|---|---|---|---|
| CVE-2026-109448 | PO PostgreSQL PostgreSQL | 5.9 | Oct 12 | psqlODBC SQLBindParameter heap memory corruption when binding more than 32767 parameters |
| CVE-2026-14671 | PO PostgreSQL PostgreSQL | 8.8 | Aug 13 | PostgreSQL refint plan cache type confusion executes arbitrary code |
| CVE-2026-6471 | PO PostgreSQL PostgreSQL | 7.2 | Aug 13 | PostgreSQL logical decoding can dlopen arbitrary file |
| CVE-2026-6470 | PO PostgreSQL PostgreSQL | 4.3 | Aug 13 | PostgreSQL fails to check type USAGE privilege |
| CVE-2026-6469 | PO PostgreSQL PostgreSQL | 3.8 | Aug 13 | PostgreSQL ALTER TABLE ALTER TYPE resets extended statistics ownership |
| CVE-2026-6464 | PO PostgreSQL PostgreSQL | 8.1 | Aug 13 | PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands |
| CVE-2026-19385 | PO PostgreSQL PostgreSQL | 8.8 | Aug 13 | PostgreSQL pg_dump heap buffer overflow executes arbitrary code |
| CVE-2026-18408 | PO PostgreSQL PostgreSQL | 8.8 | Aug 13 | PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client |
| CVE-2026-18024 | PO PostgreSQL PostgreSQL | 4.3 | Aug 13 | PostgreSQL ascii() function reads past end of buffer |
| CVE-2026-16241 | PO PostgreSQL PostgreSQL | 3.8 | Aug 13 | PostgreSQL ECPG integer underflow can crash the client |
| CVE-2026-16239 | PO PostgreSQL PostgreSQL | 8.8 | Aug 13 | PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code |
| CVE-2026-16238 | PO PostgreSQL PostgreSQL | 8.8 | Aug 13 | PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code |
| CVE-2026-15742 | PO PostgreSQL PostgreSQL | 8.8 | Aug 13 | PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound |
| CVE-2026-15741 | PO PostgreSQL PostgreSQL | 8.8 | Aug 13 | PostgreSQL expression deparse allows SQL injection via EXTRACT argument |
| CVE-2026-14681 | PO PostgreSQL PostgreSQL | 4.2 | Aug 13 | PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL |
| CVE-2026-14680 | PO PostgreSQL PostgreSQL | 8.8 | Aug 13 | PostgreSQL type confusion via "internal" arguments |
| CVE-2026-14679 | PO PostgreSQL PostgreSQL | 8.2 | Aug 13 | PostgreSQL stack buffer overflow in argument match writes 0x0 and 0x1 to server memory |
| CVE-2026-14678 | PO PostgreSQL PostgreSQL | 4.3 | Aug 13 | PostgreSQL pg_trgm picksplit reads past end of buffer |
| CVE-2026-14677 | PO PostgreSQL PostgreSQL | 8.8 | Aug 13 | PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound |
| CVE-2026-14676 | PO PostgreSQL PostgreSQL | 8.8 | Aug 13 | PostgreSQL pg_stat_statements heap buffer overflow executes arbitrary code |
| CVE-2026-14673 | PO PostgreSQL PostgreSQL | 3.8 | Aug 13 | PostgreSQL amcheck does not clear untrusted search path |
| CVE-2026-14672 | PO PostgreSQL PostgreSQL | 5.3 | Aug 13 | PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle |
| CVE-2026-14670 | PO PostgreSQL PostgreSQL | 8.8 | Aug 13 | PostgreSQL plperl tied object heap buffer overflow executes arbitrary code |
| CVE-2026-14669 | PO PostgreSQL PostgreSQL | 8.8 | Aug 13 | PostgreSQL to_char heap buffer overflow executes arbitrary code |
| CVE-2026-14668 | PO PostgreSQL PostgreSQL | 8.1 | Aug 13 | PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read |
| CVE-2026-14666 | PO PostgreSQL PostgreSQL | 4.2 | Aug 13 | PostgreSQL row security caching disregards role modifications |
| CVE-2026-14664 | PO PostgreSQL PostgreSQL | 8.8 | Aug 13 | PostgreSQL regexp heap buffer overflow executes arbitrary code |
| CVE-2026-14663 | PO PostgreSQL PostgreSQL | 6.5 | Aug 13 | PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext |
| CVE-2026-14662 | PO PostgreSQL PostgreSQL | 8.8 | Aug 13 | PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound |
| CVE-2026-54291 | PJ Postgresql Jdbc Driver Postgresql | 5.9 | Jul 6 | Silent channel-binding authentication downgrade via unsupported certificate algorithms |
| CVE-2026-6638 | PO PostgreSQL PostgreSQL | 8.8 | May 14 | PostgreSQL REFRESH PUBLICATION allows SQL injection via table name |
| CVE-2026-6637 | PO PostgreSQL PostgreSQL | 8.8 | May 14 | PostgreSQL refint allows stack buffer overflow and SQL injection |
| CVE-2026-6575 | PO PostgreSQL PostgreSQL | 4.3 | May 14 | PostgreSQL pg_restore_attribute_stats accepts values that cause query planning to read past end of stats array |
| CVE-2026-6479 | PO PostgreSQL PostgreSQL | 7.5 | May 14 | PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion |
| CVE-2026-6478 | PO PostgreSQL PostgreSQL | 6.5 | May 14 | PostgreSQL discloses MD5-hashed passwords via covert timing channel |
| CVE-2026-6477 | PO PostgreSQL PostgreSQL | 8.8 | May 14 | PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory |
| CVE-2026-6476 | PO PostgreSQL PostgreSQL | 7.2 | May 14 | PostgreSQL pg_createsubscriber allows SQL injection via subscription name |
| CVE-2026-6475 | PO PostgreSQL PostgreSQL | 8.8 | May 14 | PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice |
| CVE-2026-6474 | PO PostgreSQL PostgreSQL | 4.3 | May 14 | PostgreSQL timeofday() can disclose portions of server memory |
| CVE-2026-6473 | PO PostgreSQL PostgreSQL | 8.8 | May 14 | PostgreSQL server undersizes allocations, via integer wraparound |
| CVE-2026-6472 | PO PostgreSQL PostgreSQL | 5.4 | May 14 | PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege |
| CVE-2026-42198 | PJ Postgresql Jdbc Driver Postgresql | 7.5 | Apr 29 | pgjdbc: Unbounded PBKDF2 iterations in SCRAM authentication allows CPU exhaustion DoS |
| CVE-2026-2007 | PO PostgreSQL PostgreSQL | 8.2 | Feb 12 | PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory |
| CVE-2026-2006 | PO PostgreSQL PostgreSQL | 8.8 | Feb 12 | PostgreSQL missing validation of multibyte character length executes arbitrary code |
| CVE-2026-2005 | PO PostgreSQL PostgreSQL | 8.8 | Feb 12 | PostgreSQL pgcrypto heap buffer overflow executes arbitrary code |
| CVE-2026-2004 | PO PostgreSQL PostgreSQL | 8.8 | Feb 12 | PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code |
| CVE-2026-2003 | PO PostgreSQL PostgreSQL | 4.3 | Feb 12 | PostgreSQL oidvector discloses a few bytes of memory |
| CVE-2025-12818 | PO PostgreSQL PostgreSQL | 5.9 | Nov 13 | PostgreSQL libpq undersizes allocations, via integer wraparound |
| CVE-2025-12817 | PO PostgreSQL PostgreSQL | 3.1 | Nov 13 | PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege |
| CVE-2025-8715 | PO PostgreSQL PostgreSQL | 8.8 | Aug 14 | PostgreSQL pg_dump newline in object name executes arbitrary code in psql client and in restore target server |
| CVE-2025-8714 | PO PostgreSQL PostgreSQL | 8.8 | Aug 14 | PostgreSQL pg_dump lets superuser of origin server execute arbitrary code in psql client |
| CVE-2025-8713 | PO PostgreSQL PostgreSQL | 3.1 | Aug 14 | PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table |
| CVE-2025-49146 | PJ Postgresql Jdbc Driver Postgresql | 5.9 | Jun 11 | pgjdbc Client Allows Fallback to Insecure Authentication Despite channelBinding=require Configuration |
| CVE-2025-4207 | PO PostgreSQL PostgreSQL | 5.9 | May 8 | PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation |
| CVE-2025-1094 | PO PostgreSQL PostgreSQL | 8.1 | Feb 13 | PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation |
| CVE-2024-10979 | PO PostgreSQL PostgreSQL | 8.8 | Nov 14 | PostgreSQL PL/Perl environment variable changes execute arbitrary code |
| CVE-2024-10978 | PO PostgreSQL PostgreSQL | 4.2 | Nov 14 | PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID |
| CVE-2024-10977 | PO PostgreSQL PostgreSQL | 3.7 | Nov 14 | PostgreSQL libpq retains an error message from man-in-the-middle |
| CVE-2024-10976 | PO PostgreSQL PostgreSQL | 5.4 | Nov 14 | PostgreSQL row security below e.g. subqueries disregards user ID changes |
| CVE-2024-9014 | P4 Pgadmin 4 Postgresql | 6.5 | Sep 23 | OAuth2 client id and secret exposed through the web browser in pgAdmin 4 |