PO
Database
PostgreSQL
204
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 7High 73Medium 38Low 6
Watch
Add PostgreSQL to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-5870 | 4.4 | Dec 10 | A flaw was found in PostgreSQL involving the pg_cancel_backend role that signals background workers, including the logical replication launcher, autovacuum workers, and the… Affected: 11.0 before 11.22; 12.0 before 12.17; 13.0 before 13.13; 14.0 before 14.10; 15.0 before 15.5; 16.0 |
| CVE-2020-21469 | 4.4 | Aug 22 | An issue was discovered in PostgreSQL 12.2 allows attackers to cause a denial of service via repeatedly sending SIGHUP signals Affected: 12.2 |
| CVE-2026-6470 | 4.3 | Aug 13 | PostgreSQL fails to check type USAGE privilege Affected: 18 before 18.6; 17 before 17.11; 16 before 16.15; 15 before 15.19; before 14.24 |
| CVE-2026-18024 | 4.3 | Aug 13 | PostgreSQL ascii() function reads past end of buffer Affected: 18 before 18.6; 17 before 17.11; 16 before 16.15; 15 before 15.19; before 14.24 |
| CVE-2026-14678 | 4.3 | Aug 13 | PostgreSQL pg_trgm picksplit reads past end of buffer Affected: 18 before 18.6; 17 before 17.11; 16 before 16.15; 15 before 15.19; before 14.24 |
| CVE-2026-6575 | 4.3 | May 14 | PostgreSQL pg_restore_attribute_stats accepts values that cause query planning to read past end of stats array Affected: 18 before 18.4 |
| CVE-2026-6474 | 4.3 | May 14 | PostgreSQL timeofday() can disclose portions of server memory Affected: 18 before 18.4; 17 before 17.10; 16 before 16.14; 15 before 15.18; before 14.23 |
| CVE-2026-2003 | 4.3 | Feb 12 | PostgreSQL oidvector discloses a few bytes of memory Affected: 18 before 18.2; 17 before 17.8; 16 before 16.12; 15 before 15.16; before 14.21 |
| CVE-2024-4317 | 4.3 | May 14 | Missing authorization in PostgreSQL built-in views pg_stats_ext and pg_stats_ext_exprs allows an unprivileged database user to read most common values and other statistics from… Affected: 14.0 before 14.12; 15.0 before 15.7; 16.0 before 16.3 |
| CVE-2023-5868 | 4.3 | Dec 10 | A memory disclosure vulnerability was found in PostgreSQL that allows remote users to access sensitive information by exploiting certain aggregate function calls with… Affected: 11.0 before 11.22; 12.0 before 12.17; 13.0 before 13.13; 14.0 before 14.10; 15.0 before 15.5; 16.0 |
| CVE-2023-39418 | 4.3 | Aug 11 | A vulnerability was found in PostgreSQL with the use of the MERGE command, which fails to test new rows against row security policies defined for UPDATE and SELECT Affected: 15.0 before 15.4 |
| CVE-2021-3393 | 4.3 | Apr 1 | An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11 Affected: before 11.11; 12.0 before 12.6; 13.0 before 13.2 |
| CVE-2021-20229 | 4.3 | Feb 23 | A flaw was found in PostgreSQL in versions before 13.2 Affected: 13.0 before 13.2 |
| CVE-2014-8161 | 4.3 | Jan 27 | PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated users to obtain sensitive column values… Affected: before 9.0.19; 9.1.0 before 9.1.15; 9.2.0 before 9.2.10; 9.3.0 before 9.3.6; 9.4.0 before 9.4.1 |
| CVE-2019-10130 | 4.3 | Jul 30 | A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x up to, excluding 9.5.17 Affected: 9.5.0 before 9.5.17; 9.6.0 before 9.6.13; 10.0 before 10.8; 11.0 before 11.3 |
| CVE-2026-14681 | 4.2 | Aug 13 | PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL Affected: 18 before 18.6; 17 before 17.11 |
| CVE-2026-14666 | 4.2 | Aug 13 | PostgreSQL row security caching disregards role modifications Affected: 18 before 18.6; 17 before 17.11; 16 before 16.15; 15 before 15.19; before 14.24 |
| CVE-2024-10978 | 4.2 | Nov 14 | Incorrect privilege assignment in PostgreSQL allows a less-privileged application user to view or change different rows from those intended Affected: 12.0 before 12.21; 13.0 before 13.17; 14.0 before 14.14; 15.0 before 15.9; 16.0 before 16.5; 17.0; +4 more |
| CVE-2026-6469 | 3.8 | Aug 13 | PostgreSQL ALTER TABLE ALTER TYPE resets extended statistics ownership Affected: 18 before 18.6; 17 before 17.11; 16 before 16.15; 15 before 15.19; before 14.24 |
| CVE-2026-16241 | 3.8 | Aug 13 | PostgreSQL ECPG integer underflow can crash the client Affected: 18 before 18.6; 17 before 17.11; 16 before 16.15; 15 before 15.19; before 14.24 |
| CVE-2026-14673 | 3.8 | Aug 13 | PostgreSQL amcheck does not clear untrusted search path Affected: 18 before 18.6; 16 before 16.15; 15 before 15.19; before 14.24 |
| CVE-2024-10977 | 3.7 | Nov 14 | Client use of server error message in PostgreSQL allows a server not trusted under current SSL or GSS settings to furnish arbitrary non-NUL bytes to the libpq application Affected: 12.0 before 12.21; 13.0 before 13.17; 14.0 before 14.14; 15.0 before 15.9; 16.0 before 16.5; 17.0; +4 more |
| CVE-2022-41862 | 3.7 | Mar 3 | In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption Affected: 12.0 before 12.14; 13.0 before 13.10; 14.0 before 14.7; 15.0 before 15.2 |
| CVE-2019-10209 | 2.2 | Oct 29 | Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan Affected: 11.0 before 11.5 |
| CVE-2015-5289 | – | Oct 26 | Multiple stack-based buffer overflows in json parsing in PostgreSQL before 9.3.x before 9.3.10 and 9.4.x before 9.4.5 allow attackers to cause a denial of service (server crash)… Affected: 9.3.0 before 9.3.10; 9.4.0 before 9.4.5 |
| CVE-2015-5288 | – | Oct 26 | The crypt function in contrib/pgcrypto in PostgreSQL before 9.0.23, 9.1.x before 9.1.19, 9.2.x before 9.2.14, 9.3.x before 9.3.10, and 9.4.x before 9.4.5 allows attackers to cause… Affected: through 9.0.22; 9.1; 9.1.1; 9.1.2; 9.1.3; 9.1.4; +34 more |
| CVE-2015-3165 | – | May 28 | Double free vulnerability in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 allows remote attackers to cause a… Affected: through 9.0.19; 9.1; 9.1.1; 9.1.2; 9.1.3; 9.1.4; +31 more |
| CVE-2014-2669 | – | Mar 31 | Multiple integer overflows in contrib/hstore/hstore_io.c in PostgreSQL 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote… Affected: 9.0; 9.0.1; 9.0.2; 9.0.3; 9.0.4; 9.0.5; +31 more |
| CVE-2014-0067 | – | Mar 31 | The "make check" command for the test suites in PostgreSQL 9.3.3 and earlier does not properly invoke initdb to specify the authentication requirements for a database cluster to… Affected: through 8.4.19; 8.4.1; 8.4.2; 8.4.3; 8.4.4; 8.4.5; +34 more |
| CVE-2014-0066 | – | Mar 31 | The chkpass extension in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly check the return value of… Affected: through 8.4.19; 8.4.1; 8.4.2; 8.4.3; 8.4.4; 8.4.5; +34 more |
| CVE-2014-0065 | – | Mar 31 | Multiple buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated users to… Affected: through 8.4.19; 8.4.1; 8.4.2; 8.4.3; 8.4.4; 8.4.5; +34 more |
| CVE-2014-0064 | – | Mar 31 | Multiple integer overflows in the path_in and other unspecified functions in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x… Affected: through 8.4.19; 8.4.1; 8.4.2; 8.4.3; 8.4.4; 8.4.5; +34 more |
| CVE-2014-0063 | – | Mar 31 | Multiple stack-based buffer overflows in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow remote authenticated… Affected: through 8.4.19; 8.4.1; 8.4.2; 8.4.3; 8.4.4; 8.4.5; +34 more |
| CVE-2014-0062 | – | Mar 31 | Race condition in the (1) CREATE INDEX and (2) unspecified ALTER TABLE commands in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and… Affected: through 8.4.19; 8.4.1; 8.4.2; 8.4.3; 8.4.4; 8.4.5; +34 more |
| CVE-2014-0061 | – | Mar 31 | The validator functions for the procedural languages (PLs) in PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 allow… Affected: through 8.4.19; 8.4.1; 8.4.2; 8.4.3; 8.4.4; 8.4.5; +34 more |
| CVE-2014-0060 | – | Mar 31 | PostgreSQL before 8.4.20, 9.0.x before 9.0.16, 9.1.x before 9.1.12, 9.2.x before 9.2.7, and 9.3.x before 9.3.3 does not properly enforce the ADMIN OPTION restriction, which allows… Affected: through 8.4.19; 8.4.1; 8.4.2; 8.4.3; 8.4.4; 8.4.5; +34 more |
| CVE-2013-1903 | – | Apr 4 | PostgreSQL, possibly 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 incorrectly provides the superuser password to… Affected: 9.2; 9.2.1; 9.2.2; 9.2.3; 9.1; 9.1.1; +34 more |
| CVE-2013-1902 | – | Apr 4 | PostgreSQL, 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, 8.4.x before 8.4.17, and 8.3.x before 8.3.23 generates insecure temporary files with predictable… Affected: 9.2; 9.2.1; 9.2.2; 9.2.3; 9.1; 9.1.1; +34 more |
| CVE-2013-1901 | – | Apr 4 | PostgreSQL 9.2.x before 9.2.4 and 9.1.x before 9.1.9 does not properly check REPLICATION privileges, which allows remote authenticated users to bypass intended backup restrictions… Affected: 9.2; 9.2.1; 9.2.2; 9.2.3; 9.1; 9.1.1; +7 more |
| CVE-2013-1900 | – | Apr 4 | PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, 9.0.x before 9.0.13, and 8.4.x before 8.4.17, when using OpenSSL, generates insufficiently random numbers, which might allow… Affected: 9.2; 9.2.1; 9.2.2; 9.2.3; 9.1; 9.1.1; +34 more |
| CVE-2013-1899 | – | Apr 4 | Argument injection vulnerability in PostgreSQL 9.2.x before 9.2.4, 9.1.x before 9.1.9, and 9.0.x before 9.0.13 allows remote attackers to cause a denial of service (file… Affected: 9.2; 9.2.1; 9.2.2; 9.2.3; 9.1; 9.1.1; +20 more |
| CVE-2013-0255 | – | Feb 13 | PostgreSQL 9.2.x before 9.2.3, 9.1.x before 9.1.8, 9.0.x before 9.0.12, 8.4.x before 8.4.16, and 8.3.x before 8.3.23 does not properly declare the enum_recv function in… Affected: 8.3; 8.3.1; 8.3.2; 8.3.3; 8.3.4; 8.3.5; +34 more |
| CVE-2012-1618 | – | Oct 6 | Interaction error in the PostgreSQL JDBC driver before 8.2, when used with a PostgreSQL server with the "standard_conforming_strings" option enabled, such as the default… Affected: 9.1 |
| CVE-2012-3488 | – | Oct 3 | The libxslt support in contrib/xml2 in PostgreSQL 8.3 before 8.3.20, 8.4 before 8.4.13, 9.0 before 9.0.9, and 9.1 before 9.1.5 does not properly restrict access to files and URLs,… Affected: 9.1; 9.1.1; 9.1.2; 9.1.3; 9.1.4; 8.4; +34 more |
| CVE-2012-2655 | – | Jul 18 | PostgreSQL 8.3.x before 8.3.19, 8.4.x before 8.4.12, 9.0.x before 9.0.8, and 9.1.x before 9.1.4 allows remote authenticated users to cause a denial of service (server crash) by… Affected: 8.3; 8.3.1; 8.3.2; 8.3.3; 8.3.4; 8.3.5; +34 more |
| CVE-2012-0868 | – | Jul 18 | CRLF injection vulnerability in pg_dump in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 allows user-assisted remote attackers to… Affected: 8.3; 8.3.1; 8.3.2; 8.3.3; 8.3.4; 8.3.5; +33 more |
| CVE-2012-0867 | – | Jul 18 | PostgreSQL 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 truncates the common name to only 32 characters when verifying SSL certificates, which allows remote… Affected: 8.4; 8.4.1; 8.4.2; 8.4.3; 8.4.4; 8.4.5; +15 more |
| CVE-2012-0866 | – | Jul 18 | CREATE TRIGGER in PostgreSQL 8.3.x before 8.3.18, 8.4.x before 8.4.11, 9.0.x before 9.0.7, and 9.1.x before 9.1.3 does not properly check the execute permission for trigger… Affected: 8.3; 8.3.1; 8.3.2; 8.3.3; 8.3.4; 8.3.5; +33 more |
| CVE-2012-2143 | – | Jul 5 | The crypt_des (aka DES-based crypt) function in FreeBSD before 9.0-RELEASE-p2, as used in PHP, PostgreSQL, and other products, does not process the complete cleartext password if… Affected: 8.3 before 8.3.19; 8.4 before 8.4.12; 9.0 before 9.0.8; 9.1 before 9.1.4 |
| CVE-2011-2483 | – | Aug 25 | crypt_blowfish before 1.1, as used in PHP before 5.3.7 on certain platforms, PostgreSQL before 8.4.9, and other products, does not properly handle 8-bit characters, which makes it… Affected: 8.2.0 before 8.2.22; 8.3.0 before 8.3.16; 8.4.0 before 8.4.9; 9.0.0 before 9.0.5 |