CVE-2026-6471 | High | 7.2 | 2026-08-13 | Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system ac… |
CVE-2026-6470 | Medium | 4.3 | 2026-08-13 | Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a depen… |
CVE-2026-6469 | Low | 3.8 | 2026-08-13 | Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wron… |
CVE-2026-6464 | High | 8.1 | 2026-08-13 | Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If… |
CVE-2026-19385 | High | 8.8 | 2026-08-13 | Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user run… |
CVE-2026-18408 | High | 8.8 | 2026-08-13 | Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the… |
CVE-2026-18024 | Medium | 4.3 | 2026-08-13 | Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value… |
CVE-2026-16241 | Low | 3.8 | 2026-08-13 | Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea… |
CVE-2026-16239 | High | 8.8 | 2026-08-13 | Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creati… |
CVE-2026-16238 | High | 8.8 | 2026-08-13 | Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database… |
CVE-2026-15742 | High | 8.8 | 2026-08-13 | Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system us… |
CVE-2026-15741 | High | 8.8 | 2026-08-13 | SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect e… |
CVE-2026-14681 | Medium | 4.2 | 2026-08-13 | Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS… |
CVE-2026-14680 | High | 8.8 | 2026-08-13 | Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via… |
CVE-2026-14679 | High | 8.2 | 2026-08-13 | Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write o… |
CVE-2026-14678 | Medium | 4.3 | 2026-08-13 | Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory v… |
CVE-2026-14677 | High | 8.8 | 2026-08-13 | Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bou… |
CVE-2026-14676 | High | 8.8 | 2026-08-13 | Heap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the operating system user running the database, via… |
CVE-2026-14673 | Low | 3.8 | 2026-08-13 | Untrusted search path in PostgreSQL amcheck allows a grantee of amcheck function EXECUTE privilege to execute arbitrary functions as the owners of expression i… |
CVE-2026-14672 | Medium | 5.3 | 2026-08-13 | Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM itera… |
CVE-2026-14671 | High | 8.8 | 2026-08-13 | Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for… |
CVE-2026-14670 | High | 8.8 | 2026-08-13 | Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the da… |
CVE-2026-14669 | High | 8.8 | 2026-08-13 | Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running t… |
CVE-2026-14668 | High | 8.1 | 2026-08-13 | Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an a… |
CVE-2026-14666 | Medium | 4.2 | 2026-08-13 | Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level secu… |
CVE-2026-14664 | High | 8.8 | 2026-08-13 | Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that wo… |
CVE-2026-14663 | Medium | 6.5 | 2026-08-13 | Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL ver… |
CVE-2026-14662 | High | 8.8 | 2026-08-13 | Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation a… |
CVE-2026-54291 | Medium | 5.9 | 2026-07-06 | pgjdbc is an open source postgresql JDBC Driver. In releases 42.7.4 through 42.7.11, channelBinding=require connections can be silently downgraded from SCRAM-S… |
CVE-2026-6638 | Low | 3.7 | 2026-05-14 | SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the… |
CVE-2026-6637 | High | 8.8 | 2026-05-14 | Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the dat… |
CVE-2026-6575 | Medium | 4.3 | 2026-05-14 | Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of… |
CVE-2026-6479 | High | 7.5 | 2026-05-14 | Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of s… |
CVE-2026-6478 | Medium | 6.5 | 2026-05-14 | Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authentica… |
CVE-2026-6477 | High | 8.8 | 2026-05-14 | Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows… |
CVE-2026-6476 | High | 7.2 | 2026-05-14 | SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The attack take… |
CVE-2026-6475 | High | 8.8 | 2026-05-14 | Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc… |
CVE-2026-6474 | Medium | 4.3 | 2026-05-14 | Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. V… |
CVE-2026-6473 | High | 8.8 | 2026-05-14 | Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-… |
CVE-2026-6472 | Medium | 5.4 | 2026-05-14 | Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including ext… |
CVE-2026-42198 | High | 7.5 | 2026-04-29 | pgjdbc is an open source postgresql JDBC Driver. From version 42.2.0 to before version 42.7.11, pgjdbc is vulnerable to a client-side denial of service during… |
CVE-2026-2007 | High | 8.2 | 2026-02-12 | Heap buffer overflow in PostgreSQL pg_trgm allows a database user to achieve unknown impacts via a crafted input string. The attacker has limited control over… |
CVE-2026-2006 | High | 8.8 | 2026-02-12 | Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun… |
CVE-2026-2005 | High | 8.8 | 2026-02-12 | Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database. Versions… |
CVE-2026-2004 | High | 8.8 | 2026-02-12 | Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the o… |
CVE-2026-2003 | Medium | 4.3 | 2026-02-12 | Improper validation of type "oidvector" in PostgreSQL allows a database user to disclose a few bytes of server memory. We have not ruled out viability of atta… |
CVE-2025-49146 | High | 8.2 | 2025-06-11 | pgjdbc is an open source postgresql JDBC Driver. From 42.7.4 and until 42.7.7, when the PostgreSQL JDBC driver is configured with channel binding set to requir… |
CVE-2024-10979 | High | 8.8 | 2024-11-14 | Incorrect control of environment variables in PostgreSQL PL/Perl allows an unprivileged database user to change sensitive process environment variables (e.g. P… |
CVE-2024-10978 | Medium | 4.2 | 2024-11-14 | Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended. An attack require… |
CVE-2024-10977 | Low | 3.1 | 2024-11-14 | Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq… |
CVE-2024-10976 | Medium | 4.2 | 2024-11-14 | Incomplete tracking in PostgreSQL of tables with row security allows a reused query to view or change different rows from those intended. CVE-2023-2455 and CV… |
CVE-2024-7348 | High | 8.8 | 2024-08-08 | Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_d… |
CVE-2024-4317 | Low | 3.1 | 2024-05-14 | Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and othe… |
CVE-2024-1597 | Critical | 10.0 | 2024-02-19 | pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is n… |
CVE-2024-0985 | High | 8.0 | 2024-02-08 | Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer… |
CVE-2023-5870 | Low | 2.2 | 2023-12-10 | A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum wor… |
CVE-2023-5869 | High | 8.8 | 2023-12-10 | A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modifi… |
CVE-2023-5868 | Medium | 4.3 | 2023-12-10 | A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function cal… |
CVE-2020-21469 | Medium | 4.4 | 2023-08-22 | An issue was discovered in PostgreSQL 12.2 allows attackers to cause a denial of service via repeatedly sending SIGHUP signals. NOTE: this is disputed by the v… |
CVE-2023-39418 | Low | 3.1 | 2023-08-11 | A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SE… |
CVE-2023-39417 | High | 7.5 | 2023-08-11 | IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construc… |
CVE-2023-2455 | Medium | 5.4 | 2023-06-09 | Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases where role-specific p… |
CVE-2023-2454 | High | 7.2 | 2023-06-09 | schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated dat… |
CVE-2023-32305 | High | 8.8 | 2023-05-12 | aiven-extras is a PostgreSQL extension. Versions prior to 1.1.9 contain a privilege escalation vulnerability, allowing elevation to superuser inside PostgreSQL… |
CVE-2022-41862 | Low | 3.7 | 2023-03-03 | In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. In certain conditi… |
CVE-2022-41946 | Medium | 4.7 | 2022-11-23 | pgjdbc is an open source postgresql JDBC Driver. In affected versions a prepared statement using either `PreparedStatement.setText(int, InputStream)` or `Prepa… |
CVE-2022-1552 | High | 8.8 | 2022-08-31 | A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The A… |
CVE-2021-43767 | Medium | 5.9 | 2022-08-25 | Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use the PostgreSQL server using 'trust' authentication… |
CVE-2022-2625 | High | 8.0 | 2022-08-18 | A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait fo… |
CVE-2022-31197 | High | 7.1 | 2022-08-03 | PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC i… |
CVE-2022-24844 | High | 8.1 | 2022-04-13 | Gin-vue-admin is a backstage management system based on vue and gin, which separates the front and rear of the full stack. The problem occurs in the following… |
CVE-2022-26520 | Critical | 9.8 | 2022-03-10 | In pgjdbc before 42.3.3, an attacker (who controls the jdbc URL or properties) can call java.util.logging.FileHandler to write to arbitrary files through the l… |
CVE-2021-23214 | High | 8.1 | 2022-03-04 | When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle attacker can inject… |
CVE-2021-3677 | Medium | 6.5 | 2022-03-02 | A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authenticated database use… |
CVE-2021-23222 | Medium | 5.9 | 2022-03-02 | A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification and encryption. |
CVE-2022-21724 | High | 7.0 | 2022-02-02 | pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system us… |
CVE-2021-32028 | Medium | 6.5 | 2021-10-11 | A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database user could read arb… |
CVE-2021-32029 | Medium | 6.5 | 2021-10-08 | A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an authenticated database user could read arbitrary bytes of… |
CVE-2021-32027 | High | 8.8 | 2021-06-01 | A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain SQL array values, mi… |
CVE-2021-3393 | Medium | 4.3 | 2021-04-01 | An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but not SELECT permissi… |
CVE-2019-10128 | High | 7.8 | 2021-03-19 | A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for EnterpriseDB-supplied PostgreSQL does not lock down the ACL of t… |
CVE-2019-10127 | High | 8.8 | 2021-03-19 | A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for BigSQL-supplied PostgreSQL does not lock down the ACL of the bin… |
CVE-2021-20229 | Medium | 4.3 | 2021-02-23 | A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query that returns all c… |
CVE-2020-25696 | High | 7.5 | 2020-11-23 | A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5… |
CVE-2020-25695 | High | 8.8 | 2020-11-16 | A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker having permission to… |
CVE-2020-25694 | High | 8.1 | 2020-11-16 | A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client application that cre… |
CVE-2020-10733 | High | 7.3 | 2020-09-16 | The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths. Executables in the directory where th… |
CVE-2020-14350 | High | 7.3 | 2020-08-24 | It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privileges could use this… |
CVE-2020-14349 | High | 7.1 | 2020-08-24 | It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication. An authen… |
CVE-2020-13692 | High | 7.7 | 2020-06-04 | PostgreSQL JDBC Driver (aka PgJDBC) before 42.2.13 allows XXE. |
CVE-2020-1720 | Low | 3.1 | 2020-03-17 | A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authorization checks. An authenticated attacker could use… |
CVE-2015-0244 | Critical | 9.8 | 2020-01-27 | PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle errors while reading a… |
CVE-2015-0243 | High | 8.8 | 2020-01-27 | Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1… |
CVE-2015-0242 | High | 8.8 | 2020-01-27 | Stack-based buffer overflow in the *printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6… |
CVE-2015-0241 | High | 8.8 | 2020-01-27 | The to_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authentica… |
CVE-2014-8161 | Medium | 4.3 | 2020-01-27 | PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sens… |
CVE-2015-3167 | High | 7.5 | 2019-11-20 | contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error respons… |
CVE-2015-3166 | Critical | 9.8 | 2019-11-20 | The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 does not properly… |
CVE-2019-3466 | High | 7.8 | 2019-11-20 | The pg_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary directories, which coul… |
CVE-2019-10211 | Critical | 9.8 | 2019-10-29 | Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled OpenSSL executing code from unprotected directory. |