{"items":[{"id":"CVE-2026-120067","published":"2026-11-02T19:09:15.519Z","updated":"2026-11-02T19:33:08.506Z","title":"psqlODBC stack buffer overflow copying ctid and oid values for updatable cursors","severity":"MEDIUM","score":5.9,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2026-120066","published":"2026-11-02T19:09:14.964Z","updated":"2026-11-02T19:37:32.927Z","title":"psqlODBC log files are created with default permissions at a predictable path and follow symbolic links","severity":"MEDIUM","score":5.3,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-120065","published":"2026-11-02T19:09:14.045Z","updated":"2026-11-02T19:36:42.876Z","title":"psqlODBC does not escape a server-supplied column name in its updatable-cursor queries","severity":"HIGH","score":7.1,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-120064","published":"2026-11-02T19:09:13.482Z","updated":"2026-11-02T19:36:58.409Z","title":"psqlODBC does not validate column numbers and row indexes in binding and descriptor functions","severity":"HIGH","score":7.5,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-120063","published":"2026-11-02T19:09:12.867Z","updated":"2026-11-02T19:36:16.948Z","title":"psqlODBC stack buffer overflow when quoting long schema and table names","severity":"MEDIUM","score":5.9,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2026-120062","published":"2026-11-02T19:09:12.214Z","updated":"2026-11-02T19:35:38.418Z","title":"psqlODBC SQL injection through SQLSpecialColumns table and schema names","severity":"HIGH","score":7.5,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-120061","published":"2026-11-02T19:09:11.590Z","updated":"2026-11-02T19:35:04.484Z","title":"psqlODBC ODBC escape parser stack buffer overflow","severity":"HIGH","score":7.5,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-120060","published":"2026-11-02T19:09:10.912Z","updated":"2026-11-02T19:43:04.278Z","title":"psqlODBC does not validate server-supplied counts and lengths","severity":"MEDIUM","score":5.9,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-120059","published":"2026-11-02T19:09:10.340Z","updated":"2026-11-02T19:34:22.575Z","title":"psqlODBC uses a server-supplied column name as a format string","severity":"MEDIUM","score":6.8,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-120058","published":"2026-11-02T19:09:09.747Z","updated":"2026-11-02T19:33:49.913Z","title":"psqlODBC row cache overflow when a later FETCH changes the column count","severity":"HIGH","score":7.5,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-120057","published":"2026-11-02T19:09:09.117Z","updated":"2026-11-02T19:43:04.416Z","title":"psqlODBC large-object read overflows the application buffer","severity":"HIGH","score":7.5,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2026-116252","published":"2026-10-30T19:55:20.208Z","updated":"2026-10-30T19:55:20.208Z","title":"pgAdmin 4: Materialized view refresh redirects its connection through a crafted database name","severity":"HIGH","score":7.1,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00258,"kevAdded":null},{"id":"CVE-2026-116251","published":"2026-10-30T19:55:19.613Z","updated":"2026-10-30T19:55:19.613Z","title":"pgAdmin 4: A user's other sessions survive a change of their password","severity":"LOW","score":2.3,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00108,"kevAdded":null},{"id":"CVE-2026-116250","published":"2026-10-30T19:55:18.713Z","updated":"2026-10-30T19:55:18.713Z","title":"pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check","severity":"HIGH","score":7.3,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00096,"kevAdded":null},{"id":"CVE-2026-116249","published":"2026-10-30T19:55:18.121Z","updated":"2026-10-30T19:55:18.121Z","title":"pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory","severity":"HIGH","score":7.2,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-116248","published":"2026-10-30T19:55:17.531Z","updated":"2026-10-30T19:55:17.531Z","title":"pgAdmin 4: Non-administrators can share a server with every user","severity":"MEDIUM","score":6,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-116247","published":"2026-10-30T19:55:16.935Z","updated":"2026-10-30T19:55:16.935Z","title":"pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate","severity":"HIGH","score":7.1,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00127,"kevAdded":null},{"id":"CVE-2026-116246","published":"2026-10-30T19:55:16.276Z","updated":"2026-10-30T19:55:16.276Z","title":"pgAdmin 4: Server passwords are left in pgAdmin's process environment","severity":"HIGH","score":7,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-116245","published":"2026-10-30T19:55:15.679Z","updated":"2026-10-30T19:55:15.679Z","title":"pgAdmin 4: Connection services are not restricted in server mode","severity":"HIGH","score":7.1,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00157,"kevAdded":null},{"id":"CVE-2026-116244","published":"2026-10-30T19:55:15.101Z","updated":"2026-10-30T19:55:15.101Z","title":"pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials","severity":"HIGH","score":7.1,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-116243","published":"2026-10-30T19:55:14.513Z","updated":"2026-10-30T19:55:14.513Z","title":"pgAdmin 4: Utility binary path can point at a shared storage directory","severity":"HIGH","score":7.7,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-116242","published":"2026-10-30T19:55:13.843Z","updated":"2026-10-30T19:55:13.843Z","title":"pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity","severity":"HIGH","score":7.1,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2026-116241","published":"2026-10-30T19:55:13.194Z","updated":"2026-10-30T19:55:13.194Z","title":"pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier","severity":"CRITICAL","score":9.4,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2026-116240","published":"2026-10-30T19:55:12.603Z","updated":"2026-10-30T19:55:12.603Z","title":"pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked","severity":"HIGH","score":7.1,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00264,"kevAdded":null},{"id":"CVE-2026-116239","published":"2026-10-30T19:55:12.002Z","updated":"2026-10-30T19:55:12.002Z","title":"pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username","severity":"HIGH","score":8.9,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00389,"kevAdded":null},{"id":"CVE-2026-116238","published":"2026-10-30T19:55:11.056Z","updated":"2026-10-30T19:55:11.056Z","title":"pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks","severity":"CRITICAL","score":9.2,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00404,"kevAdded":null},{"id":"CVE-2026-110183","published":"2026-10-28T17:31:53.824Z","updated":"2026-10-28T17:31:53.824Z","title":"PostgreSQL Anonymizer: statistics can expose some of the original data after statistic masking","severity":"MEDIUM","score":4.3,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.00162,"kevAdded":null},{"id":"CVE-2026-110182","published":"2026-10-28T17:31:53.230Z","updated":"2026-10-28T17:31:53.230Z","title":"PostgreSQL Anonymizer: anon.partial() and anon.partial_email() can reveal the whole data","severity":"MEDIUM","score":4.3,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.00176,"kevAdded":null},{"id":"CVE-2026-110181","published":"2026-10-28T17:31:52.642Z","updated":"2026-10-28T17:31:52.642Z","title":"PostgreSQL Anonymizer: Function declared with SQL-standard syntax leak anonymized data","severity":"MEDIUM","score":6.5,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.0027,"kevAdded":null},{"id":"CVE-2026-105620","published":"2026-10-28T17:31:52.043Z","updated":"2026-10-28T17:31:52.043Z","title":"PostgreSQL Anonymizer: A masked role reads the authentic data of masked tables through a masking rule with a sub-query","severity":"MEDIUM","score":6.5,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.00201,"kevAdded":null},{"id":"CVE-2026-105619","published":"2026-10-28T17:31:49.949Z","updated":"2026-10-28T17:31:49.949Z","title":"PostgreSQL Anonymizer: Masking rules of the tables are not applied through security_invoker views","severity":"MEDIUM","score":4.8,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.00151,"kevAdded":null},{"id":"CVE-2026-105618","published":"2026-10-28T17:31:49.263Z","updated":"2026-10-28T17:31:49.263Z","title":"PostgreSQL Anonymizer: Masked partitions and child tables are not masked when they are queried through their parent","severity":"MEDIUM","score":5.7,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.00178,"kevAdded":null},{"id":"CVE-2026-105617","published":"2026-10-28T17:31:48.320Z","updated":"2026-10-28T17:31:48.320Z","title":"PostgreSQL Anonymizer: Cached plans bypass transparent dynamic masking after a role change or a new masking rule","severity":"MEDIUM","score":5.7,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-105616","published":"2026-10-28T17:31:47.686Z","updated":"2026-10-28T17:31:47.686Z","title":"PostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg_roles or pg_db_role_setting","severity":"MEDIUM","score":5.7,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.00194,"kevAdded":null},{"id":"CVE-2026-105615","published":"2026-10-28T17:31:46.771Z","updated":"2026-10-28T17:31:46.771Z","title":"PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg_stats","severity":"LOW","score":3.5,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.00143,"kevAdded":null},{"id":"CVE-2026-105614","published":"2026-10-28T17:31:45.821Z","updated":"2026-10-28T17:31:45.821Z","title":"PostgreSQL Anonymizer: Unbounded image-decode memory allocation (DoS) in anon.image_blur()","severity":"MEDIUM","score":4.7,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-105613","published":"2026-10-28T17:31:45.232Z","updated":"2026-10-28T17:31:45.232Z","title":"PostgreSQL Anonymizer: Unbounded memory allocation (DoS) in range-based dummy functions","severity":"MEDIUM","score":4.7,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-105612","published":"2026-10-28T17:31:44.639Z","updated":"2026-10-28T17:31:44.639Z","title":"PostgreSQL Anonymizer: Data-modifying CTEs bypass the read-only restriction of masked roles","severity":"LOW","score":3.5,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.00165,"kevAdded":null},{"id":"CVE-2026-107350","published":"2026-10-14T17:34:39.009Z","updated":"2026-10-16T14:18:50.053Z","title":"Authentication bypass via second StartupMessage during SCRAM authentication in PgBouncer","severity":"HIGH","score":8.8,"vendor":null,"product":"PgBouncer","kev":false,"epss":0.00369,"kevAdded":null},{"id":"CVE-2026-107349","published":"2026-10-14T17:34:33.785Z","updated":"2026-10-16T20:19:16.649Z","title":"Infinite loop on empty option name in startup options parameter in PgBouncer","severity":"HIGH","score":7.5,"vendor":null,"product":"PgBouncer","kev":false,"epss":0.00404,"kevAdded":null},{"id":"CVE-2026-107348","published":"2026-10-14T17:34:29.838Z","updated":"2026-10-16T20:11:22.132Z","title":"Integer overflow causes an infinite loop in message buffer growth in PgBouncer","severity":"MEDIUM","score":5.9,"vendor":null,"product":"PgBouncer","kev":false,"epss":0.00392,"kevAdded":null},{"id":"CVE-2026-109448","published":"2026-10-12T17:42:59.581Z","updated":"2026-10-16T17:48:46.624Z","title":"psqlODBC SQLBindParameter heap memory corruption when binding more than 32767 parameters","severity":"MEDIUM","score":5.9,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2026-107315","published":"2026-10-07T23:03:18.315Z","updated":"2026-10-08T14:41:49.791Z","title":"pgjdbc pads a value shorter than its declared length with bytes of earlier statements (rather than zeros)","severity":"MEDIUM","score":5.3,"vendor":"pgjdbc","product":"pgjdbc","kev":false,"epss":0.00203,"kevAdded":null},{"id":"CVE-2026-107314","published":"2026-10-07T23:03:01.500Z","updated":"2026-10-08T14:47:31.949Z","title":"pgjdbc does not enforce requireAuth when the value excludes every authentication method","severity":"MEDIUM","score":5.9,"vendor":"pgjdbc","product":"pgjdbc","kev":false,"epss":0.00345,"kevAdded":null},{"id":"CVE-2026-107313","published":"2026-10-07T18:19:53.989Z","updated":"2026-10-07T20:35:43.451Z","title":"pgjdbc stores bytes of earlier messages in place of a large value on GSS-encrypted connections","severity":"MEDIUM","score":4.2,"vendor":"pgjdbc","product":"pgjdbc","kev":false,"epss":0.00144,"kevAdded":null},{"id":"CVE-2026-103484","published":"2026-10-01T19:49:03.670Z","updated":"2026-10-01T19:58:48.937Z","title":"pgvector buffer overflow in IVFFlat index build","severity":"HIGH","score":8.8,"vendor":null,"product":"pgvector","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2026-97469","published":"2026-09-25T15:40:45.207Z","updated":"2026-09-25T16:06:42.100Z","title":"PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink","severity":"MEDIUM","score":4.3,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.00118,"kevAdded":null},{"id":"CVE-2026-19888","published":"2026-09-23T16:04:48.392Z","updated":"2026-09-23T16:46:13.585Z","title":"NULL pointer dereference in SCRAM client-final-message parsing in PgBouncer","severity":"HIGH","score":7.5,"vendor":null,"product":"PgBouncer","kev":false,"epss":0.00392,"kevAdded":null},{"id":"CVE-2026-6669","published":"2026-09-23T16:04:47.824Z","updated":"2026-09-23T16:46:13.708Z","title":"Unbounded SCRAM iteration count causes CPU exhaustion in PgBouncer","severity":"MEDIUM","score":5.9,"vendor":null,"product":"PgBouncer","kev":false,"epss":0.0042,"kevAdded":null},{"id":"CVE-2026-6668","published":"2026-09-23T16:04:47.158Z","updated":"2026-09-23T16:46:13.834Z","title":"Integer overflow causes an infinite loop in packet buffer growth in PgBouncer","severity":"HIGH","score":7.5,"vendor":null,"product":"PgBouncer","kev":false,"epss":0.00573,"kevAdded":null},{"id":"CVE-2026-86864","published":"2026-09-17T15:31:00.492Z","updated":"2026-09-17T16:00:02.215Z","title":"pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool","severity":"HIGH","score":8.7,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00579,"kevAdded":null},{"id":"CVE-2026-86863","published":"2026-09-17T15:30:58.077Z","updated":"2026-09-17T16:01:16.146Z","title":"pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode","severity":"CRITICAL","score":9.3,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2026-86862","published":"2026-09-17T15:30:56.175Z","updated":"2026-09-17T16:02:27.894Z","title":"pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools","severity":"HIGH","score":7.1,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2026-86861","published":"2026-09-17T15:30:51.232Z","updated":"2026-09-17T19:18:18.115Z","title":"pgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment check","severity":"MEDIUM","score":6,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2026-83534","published":"2026-09-06T15:25:41.341Z","updated":"2026-09-09T04:26:03.815Z","title":"PostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize_database_parallel()","severity":"MEDIUM","score":6.4,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.00323,"kevAdded":null},{"id":"CVE-2026-19634","published":"2026-09-06T15:25:36.947Z","updated":"2026-09-09T04:26:02.535Z","title":"PostgreSQL Anonymizer: SQL injection in import_database_rules() and import_roles_rules() via crafted object names / JSON","severity":"MEDIUM","score":6.4,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.00312,"kevAdded":null},{"id":"CVE-2026-19633","published":"2026-09-06T15:25:32.533Z","updated":"2026-09-09T04:26:01.195Z","title":"PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueries","severity":"HIGH","score":8.8,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.00692,"kevAdded":null},{"id":"CVE-2026-14671","published":"2026-08-13T13:00:18.697Z","updated":"2026-08-29T23:07:38.626Z","title":"PostgreSQL refint plan cache type confusion executes arbitrary code","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2026-6471","published":"2026-08-13T13:00:18.050Z","updated":"2026-08-29T23:07:37.320Z","title":"PostgreSQL logical decoding can dlopen arbitrary file","severity":"HIGH","score":7.2,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00528,"kevAdded":null},{"id":"CVE-2026-6470","published":"2026-08-13T13:00:17.465Z","updated":"2026-08-29T23:07:36.338Z","title":"PostgreSQL fails to check type USAGE privilege","severity":"MEDIUM","score":4.3,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2026-6469","published":"2026-08-13T13:00:16.796Z","updated":"2026-08-29T23:07:35.319Z","title":"PostgreSQL ALTER TABLE ALTER TYPE resets extended statistics ownership","severity":"LOW","score":3.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00318,"kevAdded":null},{"id":"CVE-2026-6464","published":"2026-08-13T13:00:16.158Z","updated":"2026-08-29T23:07:34.365Z","title":"PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands","severity":"HIGH","score":8.1,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00358,"kevAdded":null},{"id":"CVE-2026-19385","published":"2026-08-13T13:00:15.490Z","updated":"2026-08-29T23:07:33.416Z","title":"PostgreSQL pg_dump heap buffer overflow executes arbitrary code","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00427,"kevAdded":null},{"id":"CVE-2026-18408","published":"2026-08-13T13:00:14.898Z","updated":"2026-08-29T23:07:32.420Z","title":"PostgreSQL psql \\unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00355,"kevAdded":null},{"id":"CVE-2026-18024","published":"2026-08-13T13:00:14.322Z","updated":"2026-08-29T23:07:31.427Z","title":"PostgreSQL ascii() function reads past end of buffer","severity":"MEDIUM","score":4.3,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2026-16241","published":"2026-08-13T13:00:13.697Z","updated":"2026-08-29T23:07:30.439Z","title":"PostgreSQL ECPG integer underflow can crash the client","severity":"LOW","score":3.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00335,"kevAdded":null},{"id":"CVE-2026-16239","published":"2026-08-13T13:00:13.131Z","updated":"2026-08-29T23:07:29.449Z","title":"PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00683,"kevAdded":null},{"id":"CVE-2026-16238","published":"2026-08-13T13:00:12.450Z","updated":"2026-08-29T23:07:28.490Z","title":"PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00414,"kevAdded":null},{"id":"CVE-2026-15742","published":"2026-08-13T13:00:11.796Z","updated":"2026-08-29T23:07:27.420Z","title":"PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00595,"kevAdded":null},{"id":"CVE-2026-15741","published":"2026-08-13T13:00:11.206Z","updated":"2026-08-29T23:07:26.317Z","title":"PostgreSQL expression deparse allows SQL injection via EXTRACT argument","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00435,"kevAdded":null},{"id":"CVE-2026-14681","published":"2026-08-13T13:00:10.613Z","updated":"2026-08-29T23:07:25.105Z","title":"PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL","severity":"MEDIUM","score":4.2,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00081,"kevAdded":null},{"id":"CVE-2026-14680","published":"2026-08-13T13:00:10.037Z","updated":"2026-08-29T23:07:24.073Z","title":"PostgreSQL type confusion via \"internal\" arguments","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00423,"kevAdded":null},{"id":"CVE-2026-14679","published":"2026-08-13T13:00:09.371Z","updated":"2026-08-29T23:07:23.054Z","title":"PostgreSQL stack buffer overflow in argument match writes 0x0 and 0x1 to server memory","severity":"HIGH","score":8.2,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00293,"kevAdded":null},{"id":"CVE-2026-14678","published":"2026-08-13T13:00:08.713Z","updated":"2026-08-29T23:07:21.812Z","title":"PostgreSQL pg_trgm picksplit reads past end of buffer","severity":"MEDIUM","score":4.3,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00301,"kevAdded":null},{"id":"CVE-2026-14677","published":"2026-08-13T13:00:08.067Z","updated":"2026-08-29T23:07:20.774Z","title":"PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00414,"kevAdded":null},{"id":"CVE-2026-14676","published":"2026-08-13T13:00:07.385Z","updated":"2026-08-29T23:07:19.805Z","title":"PostgreSQL pg_stat_statements heap buffer overflow executes arbitrary code","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00436,"kevAdded":null},{"id":"CVE-2026-14673","published":"2026-08-13T13:00:06.799Z","updated":"2026-08-29T23:07:18.622Z","title":"PostgreSQL amcheck does not clear untrusted search path","severity":"LOW","score":3.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00269,"kevAdded":null},{"id":"CVE-2026-14672","published":"2026-08-13T13:00:06.212Z","updated":"2026-08-29T23:07:17.450Z","title":"PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle","severity":"MEDIUM","score":5.3,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00394,"kevAdded":null},{"id":"CVE-2026-14670","published":"2026-08-13T13:00:05.626Z","updated":"2026-08-29T23:07:16.457Z","title":"PostgreSQL plperl tied object heap buffer overflow executes arbitrary code","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00436,"kevAdded":null},{"id":"CVE-2026-14669","published":"2026-08-13T13:00:04.974Z","updated":"2026-08-29T23:07:15.483Z","title":"PostgreSQL to_char heap buffer overflow executes arbitrary code","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00662,"kevAdded":null},{"id":"CVE-2026-14668","published":"2026-08-13T13:00:04.405Z","updated":"2026-08-29T23:07:14.539Z","title":"PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read","severity":"HIGH","score":8.1,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00334,"kevAdded":null},{"id":"CVE-2026-14666","published":"2026-08-13T13:00:03.720Z","updated":"2026-08-29T23:07:13.583Z","title":"PostgreSQL row security caching disregards role modifications","severity":"MEDIUM","score":4.2,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00209,"kevAdded":null},{"id":"CVE-2026-14664","published":"2026-08-13T13:00:03.074Z","updated":"2026-08-29T23:07:12.593Z","title":"PostgreSQL regexp heap buffer overflow executes arbitrary code","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00436,"kevAdded":null},{"id":"CVE-2026-14663","published":"2026-08-13T13:00:02.383Z","updated":"2026-08-29T23:07:11.574Z","title":"PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext","severity":"MEDIUM","score":6.5,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-14662","published":"2026-08-13T13:00:01.726Z","updated":"2026-08-29T23:07:10.439Z","title":"PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.0046,"kevAdded":null},{"id":"CVE-2026-17566","published":"2026-07-31T16:00:22.738Z","updated":"2026-08-01T03:56:13.838Z","title":"pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)","severity":"CRITICAL","score":9.4,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00673,"kevAdded":null},{"id":"CVE-2026-17351","published":"2026-07-31T16:00:19.103Z","updated":"2026-08-01T03:56:14.973Z","title":"pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)","severity":"CRITICAL","score":9.4,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-17350","published":"2026-07-31T16:00:03.744Z","updated":"2026-07-31T17:05:44.535Z","title":"pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers","severity":"MEDIUM","score":5.3,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00376,"kevAdded":null},{"id":"CVE-2026-17349","published":"2026-07-31T15:59:47.841Z","updated":"2026-08-01T03:56:26.176Z","title":"pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner","severity":"CRITICAL","score":9.3,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00395,"kevAdded":null},{"id":"CVE-2026-17348","published":"2026-07-31T15:59:18.714Z","updated":"2026-07-31T17:23:08.497Z","title":"pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046)","severity":"MEDIUM","score":6.9,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00422,"kevAdded":null},{"id":"CVE-2026-17347","published":"2026-07-31T15:59:16.588Z","updated":"2026-08-01T03:56:12.755Z","title":"pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution","severity":"HIGH","score":7.7,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00716,"kevAdded":null},{"id":"CVE-2026-17346","published":"2026-07-31T15:59:13.136Z","updated":"2026-08-01T03:56:11.625Z","title":"pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)","severity":"HIGH","score":8.7,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00615,"kevAdded":null},{"id":"CVE-2026-18022","published":"2026-07-29T18:55:54.658Z","updated":"2026-10-07T02:15:29.825Z","title":"pgvector buffer overflow via integer wraparound in IVFFlat index build on 32-bit systems","severity":"HIGH","score":8.8,"vendor":null,"product":"pgvector","kev":false,"epss":0.00601,"kevAdded":null},{"id":"CVE-2026-13455","published":"2026-06-30T15:19:57.657Z","updated":"2026-06-30T15:57:53.085Z","title":"PostgreSQL Anonymizer: Unrestricted function can leak the secret salt","severity":"MEDIUM","score":4.3,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.00188,"kevAdded":null},{"id":"CVE-2026-12049","published":"2026-06-18T23:37:43.328Z","updated":"2026-06-22T14:39:56.925Z","title":"pgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated 'next' parameter","severity":"MEDIUM","score":5.3,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00382,"kevAdded":null},{"id":"CVE-2026-12048","published":"2026-06-18T23:37:41.541Z","updated":"2026-06-22T19:15:36.006Z","title":"pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parser","severity":"CRITICAL","score":9.3,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2026-12047","published":"2026-06-18T23:37:39.657Z","updated":"2026-06-22T19:14:24.816Z","title":"pgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception text","severity":"MEDIUM","score":4.8,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2026-12046","published":"2026-06-18T23:37:37.430Z","updated":"2026-06-23T03:55:42.384Z","title":"pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code execution","severity":"CRITICAL","score":9.5,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.01037,"kevAdded":null},{"id":"CVE-2026-12045","published":"2026-06-18T23:37:35.182Z","updated":"2026-06-23T03:55:43.509Z","title":"pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution","severity":"CRITICAL","score":9.4,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00658,"kevAdded":null},{"id":"CVE-2026-12050","published":"2026-06-18T23:37:19.384Z","updated":"2026-06-22T19:10:39.879Z","title":"pgAdmin 4: SQL injection in named restore point endpoint","severity":"MEDIUM","score":5.3,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2026-12044","published":"2026-06-18T23:37:16.202Z","updated":"2026-06-22T18:37:05.999Z","title":"pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates","severity":"HIGH","score":8.7,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00709,"kevAdded":null},{"id":"CVE-2026-11945","published":"2026-06-11T15:53:24.223Z","updated":"2026-06-12T03:55:36.254Z","title":"PostgreSQL Anonymizer: SQL injection in the rules import functions","severity":"MEDIUM","score":6.4,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2026-9617","published":"2026-05-27T13:55:10.863Z","updated":"2026-05-28T03:55:32.305Z","title":"PostgreSQL Anonymizer: malicious column name allows SQL injection via anon.k_anonymity() function","severity":"MEDIUM","score":6.8,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.0025,"kevAdded":null},{"id":"CVE-2026-6638","published":"2026-05-14T13:00:15.848Z","updated":"2026-05-14T15:28:30.735Z","title":"PostgreSQL REFRESH PUBLICATION allows SQL injection via table name","severity":"LOW","score":3.7,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.0018,"kevAdded":null},{"id":"CVE-2026-6637","published":"2026-05-14T13:00:15.223Z","updated":"2026-05-15T03:56:19.781Z","title":"PostgreSQL refint allows stack buffer overflow and SQL injection","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.0037,"kevAdded":null},{"id":"CVE-2026-6575","published":"2026-05-14T13:00:14.542Z","updated":"2026-05-14T15:26:40.715Z","title":"PostgreSQL pg_restore_attribute_stats accepts values that cause query planning to read past end of stats array","severity":"MEDIUM","score":4.3,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00208,"kevAdded":null},{"id":"CVE-2026-6479","published":"2026-05-14T13:00:13.859Z","updated":"2026-05-14T15:26:20.166Z","title":"PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion","severity":"HIGH","score":7.5,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00595,"kevAdded":null},{"id":"CVE-2026-6478","published":"2026-05-14T13:00:13.174Z","updated":"2026-08-25T12:05:38.739Z","title":"PostgreSQL discloses MD5-hashed passwords via covert timing channel","severity":"MEDIUM","score":6.5,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00558,"kevAdded":null},{"id":"CVE-2026-6477","published":"2026-05-14T13:00:12.497Z","updated":"2026-08-25T12:05:44.549Z","title":"PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00454,"kevAdded":null},{"id":"CVE-2026-6476","published":"2026-05-14T13:00:11.865Z","updated":"2026-05-15T03:56:17.580Z","title":"PostgreSQL pg_createsubscriber allows SQL injection via subscription name","severity":"HIGH","score":7.2,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-6475","published":"2026-05-14T13:00:11.039Z","updated":"2026-05-15T03:56:16.367Z","title":"PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.0041,"kevAdded":null},{"id":"CVE-2026-6474","published":"2026-05-14T13:00:10.254Z","updated":"2026-05-14T15:30:37.425Z","title":"PostgreSQL timeofday() can disclose portions of server memory","severity":"MEDIUM","score":4.3,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00214,"kevAdded":null},{"id":"CVE-2026-6473","published":"2026-05-14T13:00:09.446Z","updated":"2026-08-25T12:05:44.149Z","title":"PostgreSQL server undersizes allocations, via integer wraparound","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.01006,"kevAdded":null},{"id":"CVE-2026-6472","published":"2026-05-14T13:00:02.086Z","updated":"2026-05-14T13:43:48.103Z","title":"PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege","severity":"MEDIUM","score":5.4,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00159,"kevAdded":null},{"id":"CVE-2026-7820","published":"2026-05-11T14:35:53.492Z","updated":"2026-05-11T16:04:54.699Z","title":"pgAdmin 4: Account-lockout bypass via Flask-Security default /login view","severity":"MEDIUM","score":6.9,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-7819","published":"2026-05-11T14:35:52.747Z","updated":"2026-05-11T16:06:03.147Z","title":"pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file write","severity":"HIGH","score":7.2,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00325,"kevAdded":null},{"id":"CVE-2026-7818","published":"2026-05-11T14:35:52.092Z","updated":"2026-05-11T16:07:11.650Z","title":"pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution","severity":"HIGH","score":7.3,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-7817","published":"2026-05-11T14:35:51.384Z","updated":"2026-05-11T16:07:55.788Z","title":"pgAdmin 4: Local file inclusion and server-side request forgery in LLM API configuration endpoints","severity":"HIGH","score":7.1,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-7816","published":"2026-05-11T14:35:50.827Z","updated":"2026-05-26T13:39:15.001Z","title":"pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout","severity":"HIGH","score":8.7,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.01444,"kevAdded":null},{"id":"CVE-2026-7815","published":"2026-05-11T14:35:50.081Z","updated":"2026-05-11T16:09:33.147Z","title":"pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution","severity":"HIGH","score":8.7,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00456,"kevAdded":null},{"id":"CVE-2026-7814","published":"2026-05-11T14:35:49.411Z","updated":"2026-05-11T17:31:37.625Z","title":"pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizer","severity":"MEDIUM","score":4.8,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-7813","published":"2026-05-11T14:35:48.717Z","updated":"2026-05-11T17:32:49.824Z","title":"pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode","severity":"CRITICAL","score":9.4,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2026-6667","published":"2026-05-09T00:43:53.126Z","updated":"2026-05-11T14:44:43.075Z","title":"PgBouncer missing authorization check in KILL_CLIENT admin command","severity":"MEDIUM","score":4.3,"vendor":null,"product":"PgBouncer","kev":false,"epss":0.00287,"kevAdded":null},{"id":"CVE-2026-6666","published":"2026-05-09T00:43:49.952Z","updated":"2026-05-11T14:44:15.596Z","title":"PgBouncer crash in kill_pool_logins_server_error","severity":"MEDIUM","score":5.9,"vendor":null,"product":"PgBouncer","kev":false,"epss":0.00369,"kevAdded":null},{"id":"CVE-2026-6665","published":"2026-05-09T00:43:46.762Z","updated":"2026-05-12T03:55:19.823Z","title":"PgBouncer buffer overflow in SCRAM","severity":"HIGH","score":8.1,"vendor":null,"product":"PgBouncer","kev":false,"epss":0.00372,"kevAdded":null},{"id":"CVE-2026-6664","published":"2026-05-09T00:43:42.640Z","updated":"2026-05-11T14:28:49.277Z","title":"PgBouncer integer overflow in PgBouncer network packet parsing","severity":"HIGH","score":7.5,"vendor":null,"product":"PgBouncer","kev":false,"epss":0.00698,"kevAdded":null},{"id":"CVE-2026-3172","published":"2026-02-25T20:59:10.051Z","updated":"2026-02-26T15:04:08.481Z","title":"pgvector buffer overflow in parallel HNSW index build","severity":"HIGH","score":8.1,"vendor":null,"product":"pgvector","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2026-2007","published":"2026-02-12T13:00:11.127Z","updated":"2026-07-15T01:20:48.320Z","title":"PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory","severity":"HIGH","score":8.2,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00546,"kevAdded":null},{"id":"CVE-2026-2006","published":"2026-02-12T13:00:10.490Z","updated":"2026-07-15T01:20:50.985Z","title":"PostgreSQL missing validation of multibyte character length executes arbitrary code","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.01162,"kevAdded":null},{"id":"CVE-2026-2005","published":"2026-02-12T13:00:09.784Z","updated":"2026-07-15T01:20:53.978Z","title":"PostgreSQL pgcrypto heap buffer overflow executes arbitrary code","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.01372,"kevAdded":null},{"id":"CVE-2026-2004","published":"2026-02-12T13:00:08.857Z","updated":"2026-07-15T01:20:56.958Z","title":"PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.01342,"kevAdded":null},{"id":"CVE-2026-2003","published":"2026-02-12T13:00:06.108Z","updated":"2026-02-12T14:33:37.255Z","title":"PostgreSQL oidvector discloses a few bytes of memory","severity":"MEDIUM","score":4.3,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00319,"kevAdded":null},{"id":"CVE-2026-2361","published":"2026-02-11T17:48:03.805Z","updated":"2026-02-11T18:24:03.242Z","title":"Improper search_path protection in PostgreSQL Anonymizer 2.5 allows any user with create privilege to gain superuser privileges","severity":"HIGH","score":8,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.00322,"kevAdded":null},{"id":"CVE-2026-2360","published":"2026-02-11T17:47:55.737Z","updated":"2026-02-11T18:29:12.805Z","title":"Improper search_path protection in PostgreSQL Anonymizer 2.5 allows any user to gain superuser privileges in PostgreSQL 14","severity":"HIGH","score":8,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.00484,"kevAdded":null},{"id":"CVE-2026-1707","published":"2026-02-05T17:30:05.089Z","updated":"2026-02-26T21:50:19.579Z","title":"Restore restriction bypass via key disclosure vulnerability (pgAdmin 4)","severity":"HIGH","score":7.4,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00439,"kevAdded":null},{"id":"CVE-2025-13780","published":"2025-12-11T18:30:47.812Z","updated":"2026-11-03T22:02:51.373Z","title":"Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)","severity":"CRITICAL","score":9.1,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00943,"kevAdded":null},{"id":"CVE-2025-12819","published":"2025-12-03T19:00:09.063Z","updated":"2025-12-27T16:04:17.588Z","title":"Untrusted search path in auth_query connection in PgBouncer","severity":"HIGH","score":7.5,"vendor":null,"product":"PgBouncer","kev":false,"epss":0.00387,"kevAdded":null},{"id":"CVE-2025-12818","published":"2025-11-13T13:00:12.911Z","updated":"2025-11-13T13:59:33.436Z","title":"PostgreSQL libpq undersizes allocations, via integer wraparound","severity":"MEDIUM","score":5.9,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00364,"kevAdded":null},{"id":"CVE-2025-12817","published":"2025-11-13T13:00:12.160Z","updated":"2025-11-13T13:59:54.599Z","title":"PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege","severity":"LOW","score":3.1,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00243,"kevAdded":null},{"id":"CVE-2025-12765","published":"2025-11-13T13:00:11.448Z","updated":"2025-11-13T14:00:56.314Z","title":"pgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass.","severity":"HIGH","score":7.5,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2025-12764","published":"2025-11-13T13:00:10.595Z","updated":"2025-11-13T14:02:00.502Z","title":"pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.","severity":"HIGH","score":7.5,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00476,"kevAdded":null},{"id":"CVE-2025-12763","published":"2025-11-13T13:00:08.048Z","updated":"2026-02-26T16:57:06.806Z","title":"Command injection vulnerability allowing arbitrary command execution on Windows","severity":"MEDIUM","score":6.8,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00914,"kevAdded":null},{"id":"CVE-2025-12762","published":"2025-11-13T13:00:02.005Z","updated":"2026-02-26T16:57:07.296Z","title":"Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)","severity":"CRITICAL","score":9.1,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.12705,"kevAdded":null},{"id":"CVE-2025-9636","published":"2025-09-04T16:43:27.710Z","updated":"2026-02-26T17:49:38.292Z","title":"Cross-Origin Opener Policy Vulnerability in pgAdmin 4","severity":"HIGH","score":7.9,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-8715","published":"2025-08-14T13:00:07.753Z","updated":"2026-02-26T17:48:36.521Z","title":"PostgreSQL pg_dump newline in object name executes arbitrary code in psql client and in restore target server","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00474,"kevAdded":null},{"id":"CVE-2025-8714","published":"2025-08-14T13:00:07.046Z","updated":"2026-02-26T17:48:36.907Z","title":"PostgreSQL pg_dump lets superuser of origin server execute arbitrary code in psql client","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00778,"kevAdded":null},{"id":"CVE-2025-8713","published":"2025-08-14T13:00:05.807Z","updated":"2025-08-14T19:51:04.708Z","title":"PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table","severity":"LOW","score":3.1,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00262,"kevAdded":null},{"id":"CVE-2025-5690","published":"2025-06-04T21:34:47.358Z","updated":"2025-06-05T18:10:03.492Z","title":"Cursor allows PostgreSQL Anonymizer masked user to gain unauthorized access to authentic data","severity":"MEDIUM","score":6.5,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.00364,"kevAdded":null},{"id":"CVE-2025-4207","published":"2025-05-08T14:22:45.543Z","updated":"2025-05-09T18:03:35.540Z","title":"PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation","severity":"MEDIUM","score":5.9,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00758,"kevAdded":null},{"id":"CVE-2025-2291","published":"2025-04-16T18:00:05.413Z","updated":"2025-11-03T19:42:15.907Z","title":"PgBouncer default auth_query does not take Postgres password expiry into account","severity":"HIGH","score":8.1,"vendor":null,"product":"PgBouncer","kev":false,"epss":0.00368,"kevAdded":null},{"id":"CVE-2025-2946","published":"2025-04-03T12:23:30.694Z","updated":"2025-04-03T17:57:18.517Z","title":"Cross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data Tool of pgAdmin 4","severity":"CRITICAL","score":9.1,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2025-2945","published":"2025-04-03T12:23:14.792Z","updated":"2026-02-26T18:28:58.124Z","title":"pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment","severity":"CRITICAL","score":9.9,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.563,"kevAdded":null},{"id":"CVE-2025-1094","published":"2025-02-13T13:00:02.061Z","updated":"2026-11-03T21:52:48.556Z","title":"PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation","severity":"HIGH","score":8.1,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.9003,"kevAdded":null},{"id":"CVE-2025-0218","published":"2025-01-07T19:18:02.865Z","updated":"2025-11-03T17:31:33.459Z","title":"pgAgent scheduled batch job scripts are created in a predictable temporary directory potentially allowing a denial of service","severity":"MEDIUM","score":5.5,"vendor":null,"product":"pgAgent","kev":false,"epss":0.00175,"kevAdded":null},{"id":"CVE-2024-10979","published":"2024-11-14T13:00:08.586Z","updated":"2025-11-03T21:51:41.330Z","title":"PostgreSQL PL/Perl environment variable changes execute arbitrary code","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.04393,"kevAdded":null},{"id":"CVE-2024-10978","published":"2024-11-14T13:00:07.398Z","updated":"2025-11-03T21:51:39.867Z","title":"PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID","severity":"MEDIUM","score":4.2,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.0069,"kevAdded":null},{"id":"CVE-2024-10977","published":"2024-11-14T13:00:05.715Z","updated":"2025-11-03T21:51:38.414Z","title":"PostgreSQL libpq retains an error message from man-in-the-middle","severity":"LOW","score":3.1,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00398,"kevAdded":null},{"id":"CVE-2024-10976","published":"2024-11-14T13:00:01.930Z","updated":"2025-11-03T21:51:36.955Z","title":"PostgreSQL row security below e.g. subqueries disregards user ID changes","severity":"MEDIUM","score":4.2,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00769,"kevAdded":null},{"id":"CVE-2024-9014","published":"2024-09-23T17:04:00.264Z","updated":"2024-09-23T19:21:22.348Z","title":"OAuth2 client id and secret exposed through the web browser in pgAdmin 4","severity":"CRITICAL","score":9.9,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.09685,"kevAdded":null},{"id":"CVE-2024-7348","published":"2024-08-08T13:00:02.130Z","updated":"2024-08-22T18:03:18.699Z","title":"PostgreSQL relation replacement during pg_dump executes arbitrary SQL","severity":"HIGH","score":8.8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.01565,"kevAdded":null},{"id":"CVE-2024-6238","published":"2024-06-25T16:12:12.960Z","updated":"2024-10-30T15:35:29.424Z","title":"pgAdmin 4 Installation Directory permission issue","severity":"HIGH","score":7.4,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2024-4317","published":"2024-05-09T13:00:01.285Z","updated":"2025-03-28T15:03:02.067Z","title":"PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks","severity":"LOW","score":3.1,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.00728,"kevAdded":null},{"id":"CVE-2024-4216","published":"2024-05-02T17:42:59.679Z","updated":"2025-02-13T17:53:31.153Z","title":"XSS vulnerability in /settings/store API response json payload in pgAdmin 4","severity":"HIGH","score":7.4,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2024-4215","published":"2024-05-02T17:42:34.880Z","updated":"2025-02-13T17:53:30.480Z","title":"The Multi Factor Authentication bypass vulnerability in pgAdmin 4","severity":"HIGH","score":7.4,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00634,"kevAdded":null},{"id":"CVE-2024-3116","published":"2024-04-04T14:59:37.280Z","updated":"2025-03-14T16:35:25.051Z","title":"Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4","severity":"HIGH","score":7.4,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.65815,"kevAdded":null},{"id":"CVE-2024-2339","published":"2024-03-08T20:07:14.838Z","updated":"2024-08-02T19:53:36.167Z","title":"Improper Input Validation in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rule","severity":"HIGH","score":8,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.00552,"kevAdded":null},{"id":"CVE-2024-2338","published":"2024-03-08T20:07:00.788Z","updated":"2024-08-01T19:11:53.446Z","title":"SQL Injection in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rule","severity":"HIGH","score":8,"vendor":"DALIBO","product":"PostgreSQL Anonymizer","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2024-2044","published":"2024-03-07T20:48:10.066Z","updated":"2025-02-13T17:32:31.782Z","title":"Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4","severity":"CRITICAL","score":9.9,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.79465,"kevAdded":null},{"id":"CVE-2024-1597","published":"2024-02-19T12:58:48.620Z","updated":"2025-11-03T21:52:29.022Z","title":"pgjdbc SQL Injection via line comment generation","severity":"CRITICAL","score":10,"vendor":"pgjdbc","product":"pgjdbc","kev":false,"epss":0.0481,"kevAdded":null},{"id":"CVE-2024-0985","published":"2024-02-08T13:00:02.411Z","updated":"2025-06-13T15:09:30.114Z","title":"PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL","severity":"HIGH","score":8,"vendor":null,"product":"PostgreSQL","kev":false,"epss":0.01808,"kevAdded":null}]}