{"items":[{"id":"CVE-2026-120067","published":"2026-11-02T19:09:15.519Z","updated":"2026-11-02T19:33:08.506Z","title":"psqlODBC stack buffer overflow copying ctid and oid values for updatable cursors","severity":"MEDIUM","score":5.9,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00348,"kevAdded":null},{"id":"CVE-2026-120066","published":"2026-11-02T19:09:14.964Z","updated":"2026-11-02T19:37:32.927Z","title":"psqlODBC log files are created with default permissions at a predictable path and follow symbolic links","severity":"MEDIUM","score":5.3,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00114,"kevAdded":null},{"id":"CVE-2026-120065","published":"2026-11-02T19:09:14.045Z","updated":"2026-11-02T19:36:42.876Z","title":"psqlODBC does not escape a server-supplied column name in its updatable-cursor queries","severity":"HIGH","score":7.1,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00294,"kevAdded":null},{"id":"CVE-2026-120064","published":"2026-11-02T19:09:13.482Z","updated":"2026-11-02T19:36:58.409Z","title":"psqlODBC does not validate column numbers and row indexes in binding and descriptor functions","severity":"HIGH","score":7.5,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-120063","published":"2026-11-02T19:09:12.867Z","updated":"2026-11-02T19:36:16.948Z","title":"psqlODBC stack buffer overflow when quoting long schema and table names","severity":"MEDIUM","score":5.9,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00271,"kevAdded":null},{"id":"CVE-2026-120062","published":"2026-11-02T19:09:12.214Z","updated":"2026-11-02T19:35:38.418Z","title":"psqlODBC SQL injection through SQLSpecialColumns table and schema names","severity":"HIGH","score":7.5,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00357,"kevAdded":null},{"id":"CVE-2026-120061","published":"2026-11-02T19:09:11.590Z","updated":"2026-11-02T19:35:04.484Z","title":"psqlODBC ODBC escape parser stack buffer overflow","severity":"HIGH","score":7.5,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00342,"kevAdded":null},{"id":"CVE-2026-120060","published":"2026-11-02T19:09:10.912Z","updated":"2026-11-02T19:43:04.278Z","title":"psqlODBC does not validate server-supplied counts and lengths","severity":"MEDIUM","score":5.9,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00216,"kevAdded":null},{"id":"CVE-2026-120059","published":"2026-11-02T19:09:10.340Z","updated":"2026-11-02T19:34:22.575Z","title":"psqlODBC uses a server-supplied column name as a format string","severity":"MEDIUM","score":6.8,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00261,"kevAdded":null},{"id":"CVE-2026-120058","published":"2026-11-02T19:09:09.747Z","updated":"2026-11-02T19:33:49.913Z","title":"psqlODBC row cache overflow when a later FETCH changes the column count","severity":"HIGH","score":7.5,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00255,"kevAdded":null},{"id":"CVE-2026-120057","published":"2026-11-02T19:09:09.117Z","updated":"2026-11-02T19:43:04.416Z","title":"psqlODBC large-object read overflows the application buffer","severity":"HIGH","score":7.5,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00244,"kevAdded":null},{"id":"CVE-2026-109448","published":"2026-10-12T17:42:59.581Z","updated":"2026-10-16T17:48:46.624Z","title":"psqlODBC SQLBindParameter heap memory corruption when binding more than 32767 parameters","severity":"MEDIUM","score":5.9,"vendor":"PostgreSQL","product":"psqlODBC","kev":false,"epss":0.00222,"kevAdded":null},{"id":"CVE-2019-10211","published":"2019-10-29T13:15:40.000Z","updated":"2024-08-04T22:17:18.944Z","title":"Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled OpenSSL executing code from unprotected directory.","severity":"HIGH","score":7.8,"vendor":"PostgreSQL","product":"postgresql","kev":false,"epss":0.01815,"kevAdded":null},{"id":"CVE-2019-10208","published":"2019-10-29T13:13:12.000Z","updated":"2024-08-04T22:17:18.925Z","title":"A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x before 11.5 where…","severity":"HIGH","score":7.5,"vendor":"PostgreSQL","product":"postgresql","kev":false,"epss":0.02188,"kevAdded":null},{"id":"CVE-2019-10209","published":"2019-10-29T13:11:45.000Z","updated":"2024-08-04T22:17:20.096Z","title":"Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan.","severity":"LOW","score":3.1,"vendor":"PostgreSQL","product":"postgresql","kev":false,"epss":0.01079,"kevAdded":null},{"id":"CVE-2019-10210","published":"2019-10-29T00:00:00.000Z","updated":"2024-08-04T22:17:19.604Z","title":"Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via superuser writing password to unprotected temporary file.","severity":"MEDIUM","score":6.7,"vendor":"PostgreSQL","product":"postgresql","kev":false,"epss":0.00385,"kevAdded":null},{"id":"CVE-2019-10164","published":"2019-06-26T15:29:13.000Z","updated":"2024-08-04T22:10:10.043Z","title":"PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. Any authenticated user can overflow a…","severity":"HIGH","score":7.5,"vendor":"PostgreSQL","product":"PostgreSQL","kev":false,"epss":0.03643,"kevAdded":null},{"id":"CVE-2017-7548","published":"2017-08-16T18:00:00.000Z","updated":"2024-09-16T16:18:38.892Z","title":"PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large…","severity":"HIGH","score":7.5,"vendor":"PostgreSQL","product":"postgresql","kev":false,"epss":0.03517,"kevAdded":null},{"id":"CVE-2017-7547","published":"2017-08-16T18:00:00.000Z","updated":"2024-09-16T23:41:38.650Z","title":"PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers to retrieve…","severity":"HIGH","score":8.8,"vendor":"PostgreSQL","product":"postgresql","kev":false,"epss":0.05581,"kevAdded":null},{"id":"CVE-2017-7546","published":"2017-08-16T18:00:00.000Z","updated":"2024-09-16T17:18:53.123Z","title":"PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers to gain access to…","severity":"CRITICAL","score":9.8,"vendor":"PostgreSQL","product":"postgresql","kev":false,"epss":0.61566,"kevAdded":null}]}