PO
Database
PostgreSQL
204
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 7High 73Medium 38Low 6
Watch
Add PostgreSQL to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-6479 | 7.5 | May 14 | PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion Affected: 18 before 18.4; 17 before 17.10; 16 before 16.14; 15 before 15.18; before 14.23 |
| CVE-2024-7348 | 7.5 | Aug 8 | Time-of-check Time-of-use (TOCTOU) race condition in pg_dump in PostgreSQL allows an object creator to execute arbitrary SQL functions as the user running pg_dump, which is often… Affected: 12.0 before 12.20; 13.0 before 13.16; 14.0 before 14.13; 15.0 before 15.8; 16.0 before 16.4 |
| CVE-2020-25696 | 7.5 | Nov 23 | A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24 Affected: 9.5.0 before 9.5.24; 9.6.0 before 9.6.20; 10.0 before 10.15; 11.0 before 11.10; 12.0 before 12.5; 13.0 before 13.1 |
| CVE-2015-3167 | 7.5 | Nov 20 | contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses different error responses when an incorrect… Affected: before 9.0.20; 9.1 before 9.1.16; 9.2 before 9.2.11; 9.3 before 9.3.7; 9.4 before 9.4.2 |
| CVE-2018-10915 | 7.5 | Aug 9 | A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between connections Affected: 10.5; 9.6.10; 9.5.14; 9.4.19; 9.3.24 |
| CVE-2017-7548 | 7.5 | Aug 16 | PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no privileges on a large object to overwrite… Affected: 9.4 before 9.4.13; 9.5 before 9.5.8; 9.6 before 9.6.4 |
| CVE-2016-0768 | 7.5 | Jun 6 | PostgreSQL PL/Java after 9.0 does not honor access controls on large objects Affected: through 9.0 |
| CVE-2017-7486 | 7.5 | May 12 | PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg_user_mappings view which discloses foreign server passwords to any user having USAGE privilege on the… Affected: 8.4; 8.4.1; 8.4.2; 8.4.3; 8.4.4; 8.4.5; +34 more |
| CVE-2017-7484 | 7.5 | May 12 | It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3 did not… Affected: through 9.2.20; 9.3; 9.3.1; 9.3.2; 9.3.3; 9.3.4; +34 more |
| CVE-2016-2193 | 7.5 | Apr 11 | PostgreSQL before 9.5.x before 9.5.2 does not properly maintain row-security status in cached plans, which might allow attackers to bypass intended access restrictions by… Affected: 9.5; 9.5.1 |
| CVE-2016-0773 | 7.5 | Feb 17 | PostgreSQL before 9.1.20, 9.2.x before 9.2.15, 9.3.x before 9.3.11, 9.4.x before 9.4.6, and 9.5.x before 9.5.1 allows remote attackers to cause a denial of service (infinite loop… Affected: through 9.1.19; 9.2; 9.2.1; 9.2.2; 9.2.3; 9.2.4; +17 more |
| CVE-2002-1657 | 7.5 | Dec 31 | PostgreSQL uses the username for a salt when generating passwords, which makes it easier for remote attackers to guess passwords via a brute force attack Affected: 7.3.19 |
| CVE-2020-10733 | 7.3 | Sep 16 | The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths Affected: 9.5 before 9.5.22; 9.6 before 9.6.18; 10.0 before 10.13; 11.0 before 11.8; 12.0 before 12.3 |
| CVE-2020-14350 | 7.3 | Aug 24 | It was found that some PostgreSQL extensions did not use search_path safely in their installation script Affected: 9.5 before 9.5.23; 9.6 before 9.6.19; 10.0 before 10.14; 11.0 before 11.9; 12.0 before 12.4 |
| CVE-2026-6471 | 7.2 | Aug 13 | PostgreSQL logical decoding can dlopen arbitrary file Affected: 18 before 18.6; 17 before 17.11; 16 before 16.15; 15 before 15.19; before 14.24 |
| CVE-2026-6476 | 7.2 | May 14 | PostgreSQL pg_createsubscriber allows SQL injection via subscription name Affected: 18 before 18.4; 17 before 17.10 |
| CVE-2023-2454 | 7.2 | Jun 9 | schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level… Affected: 11.0 before 11.20; 12.0 before 12.15; 13.0 before 13.11; 14.0 before 14.8; 15.0 before 15.3 |
| CVE-2019-9193 | 7.2 | Apr 1 | In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_execute_server_program' group to execute arbitrary code in the context… Affected: 9.3 through 11.2 |
| CVE-2020-14349 | 7.1 | Aug 24 | It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical replication Affected: 10.0 before 10.14; 11.0 before 11.9; 12.0 before 12.4 |
| CVE-2016-5424 | 7.1 | Dec 9 | PostgreSQL before 9.1.23, 9.2.x before 9.2.18, 9.3.x before 9.3.14, 9.4.x before 9.4.9, and 9.5.x before 9.5.4 might allow remote authenticated users with the CREATEDB or… Affected: through 9.1.22; 9.2; 9.2.1; 9.2.2; 9.2.3; 9.2.4; +34 more |
| CVE-2019-10210 | 7.0 | Oct 29 | Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via superuser writing password to unprotected temporary file Affected: before 9.4.24; 9.5.0 before 9.5.19; 9.6.0 before 9.6.15; 10.0 before 10.10; 11.0 before 11.5 |
| CVE-2017-14798 | 7.0 | Mar 1 | A race condition in the postgresql init script could be used by attackers able to access the postgresql account to escalate their privileges to root Affected: before 9.4-0.5.3.1 |
| CVE-2018-1053 | 7.0 | Feb 9 | In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg_upgrade creates file in current working directory… Affected: 9.3.0 before 9.3.21; 9.4.0 before 9.4.16; 9.5.0 before 9.5.11; 9.6.0 before 9.6.7; 10.0; 10.1 |