| Bug | Description |
|---|
| CVE-2026-120154 | Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an att ... |
| CVE-2026-120153 | SQL injection in PostgreSQL extension-script substitutions allows an a ... |
| CVE-2026-120152 | Use after free in PostgreSQL pg_show_all_settings() allows a database ... |
| CVE-2026-120151 | Type confusion in PostgreSQL plpgsql record-field assignment allows an ... |
| CVE-2026-120150 | Use after free in PostgreSQL expanded-record domain checks allows an o ... |
| CVE-2026-120149 | Heap-based buffer overflow in PostgreSQL foreign batch inserts allows ... |
| CVE-2026-120148 | Type confusion in PostgreSQL extended statistics allows an object crea ... |
| CVE-2026-120147 | Use after free in the PostgreSQL dblink extension allows an object cre ... |
| CVE-2026-120146 | Missing authorization in PostgreSQL REASSIGN OWNED allows a role grant ... |
| CVE-2026-120145 | Missing authorization in PostgreSQL logical replication allows a compr ... |
| CVE-2026-120143 | Use after free in PostgreSQL trigger functions allows an object creato ... |
| CVE-2026-120142 | Type confusion in PostgreSQL anonymous RECORD types allows an object c ... |
| CVE-2026-120141 | Type confusion in PostgreSQL materialized set-returning functions allo ... |
| CVE-2026-120139 | Integer wraparound in PostgreSQL in-memory tuple-size calculations all ... |
| CVE-2026-116336 | Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows ... |
| CVE-2026-116335 | Type confusion in PostgreSQL operator commutator and negator links all ... |
| CVE-2026-116333 | Buffer over-read in PostgreSQL parallel B-tree scans allows an object ... |
| CVE-2026-116332 | Use after free in PostgreSQL portal setup allows an object creator to ... |
| CVE-2026-116331 | Type confusion in PostgreSQL min/max aggregate optimization allows an ... |
| CVE-2026-116330 | Untrusted data inclusion in PostgreSQL pg_dump tar-format restore.sql ... |
| CVE-2026-116328 | Integer wraparound in PostgreSQL generation memory contexts allows a d ... |
| CVE-2026-116327 | Exposure of sensitive information in PostgreSQL security_barrier proce ... |
| CVE-2026-116326 | Uncaught exceptions in PostgreSQL plperl allow an object creator to ca ... |
| CVE-2026-116325 | SQL injection in PostgreSQL reindexdb allows an object creator to exec ... |
| CVE-2026-116323 | Use after free in PostgreSQL pltcl allows an object creator to execute ... |
| CVE-2026-116321 | Improper null termination in PostgreSQL array element assignment allow ... |
| CVE-2026-116320 | Use after free in PostgreSQL plperl allows an object creator to execut ... |
| CVE-2026-116319 | Use after free in PostgreSQL plperl allows an object creator to execut ... |
| CVE-2026-116317 | Heap-based buffer overflow in PostgreSQL ts_rank_cd() may allow a data ... |
| CVE-2026-116316 | Improper protection of alternate path in PostgreSQL security-restricte ... |
| CVE-2026-116315 | Heap-based buffer overflow in PostgreSQL tsvector_delete() allows a da ... |
| CVE-2026-116314 | Improper input validation in PostgreSQL pg_restore allows a non-plain ... |
| CVE-2026-116312 | Inconsistent transition-capture state in PostgreSQL MERGE allows a tab ... |
| CVE-2026-116311 | Missing authorization in PostgreSQL DROP OWNED allows a role to remove ... |
| CVE-2026-116310 | Use after free in PostgreSQL COPY FROM error reporting allows a databa ... |
| CVE-2026-116309 | Type confusion in PostgreSQL plperl may allow an object creator to exe ... |
| CVE-2026-116308 | Buffer over-read in PostgreSQL dict_int allows a database user to disc ... |
| CVE-2026-116307 | Use after free in PostgreSQL plperl allows an object creator to execut ... |
| CVE-2026-116306 | Type confusion in PostgreSQL composite-value field assignment allows a ... |
| CVE-2026-116304 | Use after free in PostgreSQL coordination of anonymous RECORD type ide ... |
| CVE-2026-116303 | Missing authorization in PostgreSQL type conversion allows a database ... |
| CVE-2026-19385 | Heap buffer overflow in PostgreSQL pg_dump of long function transform ... |
| CVE-2026-18447 | Type confusion in PostgreSQL SQL-language functions allows an object c ... |
| CVE-2026-18408 | Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious s ... |
| CVE-2026-18024 | Buffer over-read in PostgreSQL ascii() SQL function allows a user to d ... |
| CVE-2026-16241 | Integer underflow in PostgreSQL ECPG allows a database server administ ... |
| CVE-2026-16240 | Use of externally-controlled format string in PostgreSQL pg_basebackup ... |
| CVE-2026-16239 | Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user t ... |
| CVE-2026-16238 | Type confusion in PostgreSQL pg_restore_attribute_stats() allows an ob ... |
| CVE-2026-16237 | Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updat ... |
| CVE-2026-15742 | Integer wraparound in PostgreSQL fuzzystrmatch allows a user to direct ... |
| CVE-2026-15741 | SQL injection in PostgreSQL EXTRACT() deparse allows an object owner t ... |
| CVE-2026-14681 | Improper enforcement of message integrity in PostgreSQL GSSAPI support ... |
| CVE-2026-14680 | Type confusion with PostgreSQL "internal" data type arguments allows a ... |
| CVE-2026-14679 | Stack buffer overflow in PostgreSQL argument name matching allows an o ... |
| CVE-2026-14678 | Buffer over-read in PostgreSQL pg_trgm index picksplit function reads ... |
| CVE-2026-14677 | Integer wraparound in PostgreSQL 32-bit builds of pltcl and plperl all ... |
| CVE-2026-14676 | Heap buffer overflow in PostgreSQL pg_stat_statements allows the query ... |
| CVE-2026-14673 | Untrusted search path in PostgreSQL amcheck allows a grantee of amchec ... |
| CVE-2026-14672 | Observable response discrepancy in PostgreSQL SCRAM authentication all ... |
| CVE-2026-14671 | Type confusion in PostgreSQL module "refint" allows an object creator ... |
| CVE-2026-14670 | Heap buffer overflow in PostgreSQL plperl return of a tied hash allows ... |
| CVE-2026-14669 | Heap buffer overflow in PostgreSQL to_char(timestamptz) allows the par ... |
| CVE-2026-14668 | Type confusion regarding input of PostgreSQL ctid data type selectivit ... |
| CVE-2026-14666 | Incomplete tracking in PostgreSQL of changes to role membership, role ... |
| CVE-2026-14664 | Heap buffer overflow in PostgreSQL regexp allows the query author to e ... |
| CVE-2026-14663 | Cleartext storage in PostgreSQL pgcrypto disabled ciphers allows a use ... |
| CVE-2026-14662 | Integer wraparound in PostgreSQL tsvector and tsquery data type functi ... |
| CVE-2026-14661 | External control of file name in PostgreSQL dblink and CREATE/ALTER SU ... |
| CVE-2026-6638 | SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... ... |
| CVE-2026-6637 | Stack buffer overflow in PostgreSQL module "refint" allows an unprivil ... |
| CVE-2026-6479 | Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an ... |
| CVE-2026-6478 | Covert timing channel in comparison of MD5-hashed password in PostgreS ... |
| CVE-2026-6477 | Use of inherently dangerous function PQfn(..., result_is_int=0, ...) i ... |
| CVE-2026-6476 | SQL injection in PostgreSQL pg_createsubscriber allows an attacker wit ... |
| CVE-2026-6475 | Symlink following in PostgreSQL pg_basebackup plain format and in pg_r ... |
| CVE-2026-6474 | Externally-controlled format string in PostgreSQL timeofday() function ... |
| CVE-2026-6473 | Integer wraparound in multiple PostgreSQL server features allows an un ... |
| CVE-2026-6472 | Missing authorization in PostgreSQL CREATE TYPE allows an object creat ... |
| CVE-2026-6471 | Missing authorization in PostgreSQL logical decoding allows a non-supe ... |
| CVE-2026-6470 | Missing authorization in PostgreSQL DDL commands allows an object crea ... |
| CVE-2026-6469 | Incorrect ownership assignment in PostgreSQL ALTER TABLE ALTER TYPE co ... |
| CVE-2026-6467 | Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows ... |
| CVE-2026-6464 | Untrusted data inclusion in PostgreSQL psql COPY may allow a server ad ... |
| CVE-2026-6460 | Type confusion in PostgreSQL allows an object creator to execute arbit ... |
| CVE-2026-2007 | Heap buffer overflow in PostgreSQL pg_trgm allows a database user to a ... |
| CVE-2026-2006 | Missing validation of multibyte character length in PostgreSQL text ma ... |
| CVE-2026-2005 | Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provid ... |
| CVE-2026-2004 | Missing validation of type of input in PostgreSQL intarray extension s ... |
| CVE-2026-2003 | Improper validation of type "oidvector" in PostgreSQL allows a databas ... |
| CVE-2025-12818 | Integer wraparound in multiple PostgreSQL libpq client library functio ... |
| CVE-2025-12817 | Missing authorization in PostgreSQL CREATE STATISTICS command allows a ... |
| CVE-2025-8715 | Improper neutralization of newlines in pg_dump in PostgreSQL allows a ... |
| CVE-2025-8714 | Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious s ... |
| CVE-2025-8713 | PostgreSQL optimizer statistics allow a user to read sampled data with ... |
| CVE-2025-4207 | Buffer over-read in PostgreSQL GB18030 encoding validation allows a da ... |
| CVE-2025-1094 | Improper neutralization of quoting syntax in PostgreSQL libpq function ... |
| CVE-2024-10979 | Incorrect control of environment variables in PostgreSQL PL/Perl allow ... |
| CVE-2024-10978 | Incorrect privilege assignment in PostgreSQL allows a less-privileged ... |
| CVE-2024-10977 | Client use of server error message in PostgreSQL allows a server not t ... |
| CVE-2024-10976 | Incomplete tracking in PostgreSQL of tables with row security allows a ... |