| CVE-2026-19385 | 8.8 | 2026-08-13 | Heap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute arbitrary code as the operating system user running pg_du… |
| CVE-2026-18408 | 8.8 | 2026-08-13 | Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client ope… |
| CVE-2026-16238 | 8.8 | 2026-08-13 | Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via confl… |
| CVE-2026-16239 | 8.8 | 2026-08-13 | Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cu… |
| CVE-2026-15742 | 8.8 | 2026-08-13 | Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, executing arbitrary code as the operating system user running… |
| CVE-2026-14677 | 8.8 | 2026-08-13 | Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to undersize an allocation and write out-of-bounds via cr… |
| CVE-2026-14680 | 8.8 | 2026-08-13 | Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to f… |
| CVE-2026-15741 | 8.8 | 2026-08-13 | SQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a hostile object definition. Attacks affect expression … |
| CVE-2026-14669 | 8.8 | 2026-08-13 | Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrary code as the operating system user running the databas… |
| CVE-2026-14670 | 8.8 | 2026-08-13 | Heap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary code as the operating system user running the database, vi… |
| CVE-2026-14671 | 8.8 | 2026-08-13 | Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emer… |
| CVE-2026-14664 | 8.8 | 2026-08-13 | Heap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating system user running the database, via text that would not pa… |
| CVE-2026-14662 | 8.8 | 2026-08-13 | Integer wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to cause the server to undersize an allocation and write o… |
| CVE-2026-14679 | 8.2 | 2026-08-13 | Stack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via OUT parameter count. The attack can write only 0x0 an… |
| CVE-2026-6464 | 8.1 | 2026-08-13 | Untrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines as psql commands, via error injection. If the "COPY … |
| CVE-2026-14668 | 8.1 | 2026-08-13 | Type confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view a calculation derived from the value of an arbitrary 4… |
| CVE-2026-6471 | 7.2 | 2026-08-13 | Missing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen any file visible to the operating system account runn… |
| CVE-2026-14663 | 6.5 | 2026-08-13 | Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a user to recover cleartext, via direct observation of the faulty ciphertext. The OpenSSL version and O… |
| CVE-2026-14672 | 5.3 | 2026-08-13 | Observable response discrepancy in PostgreSQL SCRAM authentication allows an unauthenticated user to test the existence of a user via observing the SCRAM iteration count… |
| CVE-2026-6470 | 4.3 | 2026-08-13 | Missing authorization in PostgreSQL DDL commands allows an object creator to achieve denial of service against ALTER and DROP of the type, via creating a dependency on t… |
| CVE-2026-18024 | 4.3 | 2026-08-13 | Buffer over-read in PostgreSQL ascii() SQL function allows a user to disclose up to 3 bytes after the end of a specific allocation, via a crafted text value. This is th… |
| CVE-2026-14678 | 4.3 | 2026-08-13 | Buffer over-read in PostgreSQL pg_trgm index picksplit function reads past end of a heap buffer. This might allow a table maintainer to infer limited memory values, via… |
| CVE-2026-14681 | 4.2 | 2026-08-13 | Improper enforcement of message integrity in PostgreSQL GSSAPI support allows a user to negotiate GSSAPI contrary to pg_hba.conf rules, via initial direct TLS connection… |
| CVE-2026-14666 | 4.2 | 2026-08-13 | Incomplete tracking in PostgreSQL of changes to role membership, role attributes, and database ownership allows a query to continue using cached row-level security polic… |
| CVE-2026-6469 | 3.8 | 2026-08-13 | Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE command reassigns ownership of dependent statistics objects to the current user. This wrongly allows… |
| CVE-2026-16241 | 3.8 | 2026-08-13 | Integer underflow in PostgreSQL ECPG allows a database server administrator to achieve temporary denial of service against the ECPG client via sending a bytea value lack… |