# cve.now: PostgreSQL

The newest entries affecting PostgreSQL (up to 200). Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-110183](https://cve.now/CVE-2026-110183.md): PostgreSQL Anonymizer: statistics can expose some of the original data after statistic masking (CVSS 4.3, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-110182](https://cve.now/CVE-2026-110182.md): PostgreSQL Anonymizer: anon.partial() and anon.partial\_email() can reveal the whole data (CVSS 4.3, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-110181](https://cve.now/CVE-2026-110181.md): PostgreSQL Anonymizer: Function declared with SQL-standard syntax leak anonymized data (CVSS 6.5, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-105620](https://cve.now/CVE-2026-105620.md): PostgreSQL Anonymizer: A masked role reads the authentic data of masked tables through a masking rule with a sub-query (CVSS 6.5, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-105619](https://cve.now/CVE-2026-105619.md): PostgreSQL Anonymizer: Masking rules of the tables are not applied through security\_invoker views (CVSS 4.8, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-105618](https://cve.now/CVE-2026-105618.md): PostgreSQL Anonymizer: Masked partitions and child tables are not masked when they are queried through their parent (CVSS 5.7, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-105617](https://cve.now/CVE-2026-105617.md): PostgreSQL Anonymizer: Cached plans bypass transparent dynamic masking after a role change or a new masking rule (CVSS 5.7, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-105616](https://cve.now/CVE-2026-105616.md): PostgreSQL Anonymizer: The secret salt and shift of anon are readable by any role in pg\_roles or pg\_db\_role\_setting (CVSS 5.7, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-105615](https://cve.now/CVE-2026-105615.md): PostgreSQL Anonymizer: Masked roles can read the statistics of masked columns in pg\_stats (CVSS 3.5, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-105614](https://cve.now/CVE-2026-105614.md): PostgreSQL Anonymizer: Unbounded image-decode memory allocation (DoS) in anon.image\_blur() (CVSS 4.7, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-105613](https://cve.now/CVE-2026-105613.md): PostgreSQL Anonymizer: Unbounded memory allocation (DoS) in range-based dummy functions (CVSS 4.7, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-105612](https://cve.now/CVE-2026-105612.md): PostgreSQL Anonymizer: Data-modifying CTEs bypass the read-only restriction of masked roles (CVSS 3.5, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-109448](https://cve.now/CVE-2026-109448.md): psqlODBC SQLBindParameter heap memory corruption when binding more than 32767 parameters (CVSS 5.9, PostgreSQL psqlODBC)
- [CVE-2026-104055](https://cve.now/CVE-2026-104055.md): Monitoring-user password logged in cleartext by postgres\_exporter in postgresql VM charm (CVSS 5.3, Canonical postgresql-operator)
- [CVE-2026-97469](https://cve.now/CVE-2026-97469.md): PostgreSQL Anonymizer: RESTRICTED functions are reachable through a subLink (CVSS 4.3, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-83534](https://cve.now/CVE-2026-83534.md): PostgreSQL Anonymizer: Privilege escalation to superuser via anon.anonymize\_database\_parallel() (CVSS 6.4, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-19634](https://cve.now/CVE-2026-19634.md): PostgreSQL Anonymizer: SQL injection in import\_database\_rules() and import\_roles\_rules() via crafted object names / JSON (CVSS 6.4, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-19633](https://cve.now/CVE-2026-19633.md): PostgreSQL Anonymizer: unprivileged masked users can execute code via operators, domain casts and view subqueries (CVSS 8.8, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-85787](https://cve.now/CVE-2026-85787.md): An incomplete list of disallowed inputs in the SQL validation component of Amazon awslabs postgres-mcp-server (CVSS 7.1, Amazon postgres-mcp-server)
- [CVE-2026-85620](https://cve.now/CVE-2026-85620.md): Postgres MCP Pro 0.3.0 Restricted-Mode Bypass via FROM-Clause Function (CVSS 9.2, crystaldba postgres-mcp)
- [CVE-2026-19475](https://cve.now/CVE-2026-19475.md): SQL Data Source Plugin: OOM DoS via $\_\_timeGroup macro (CVSS 6.5, Grafana PostgreSQL Datasource · Grafana MySQL Datasource +2)
- [CVE-2026-14671](https://cve.now/CVE-2026-14671.md): PostgreSQL refint plan cache type confusion executes arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2026-6471](https://cve.now/CVE-2026-6471.md): PostgreSQL logical decoding can dlopen arbitrary file (CVSS 7.2, PostgreSQL)
- [CVE-2026-6470](https://cve.now/CVE-2026-6470.md): PostgreSQL fails to check type USAGE privilege (CVSS 4.3, PostgreSQL)
- [CVE-2026-6469](https://cve.now/CVE-2026-6469.md): PostgreSQL ALTER TABLE ALTER TYPE resets extended statistics ownership (CVSS 3.8, PostgreSQL)
- [CVE-2026-6464](https://cve.now/CVE-2026-6464.md): PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands (CVSS 8.1, PostgreSQL)
- [CVE-2026-19385](https://cve.now/CVE-2026-19385.md): PostgreSQL pg\_dump heap buffer overflow executes arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2026-18408](https://cve.now/CVE-2026-18408.md): PostgreSQL psql \\unrestrict lets superuser of pg\_dump origin server execute arbitrary code in psql client (CVSS 8.8, PostgreSQL)
- [CVE-2026-18024](https://cve.now/CVE-2026-18024.md): PostgreSQL ascii() function reads past end of buffer (CVSS 4.3, PostgreSQL)
- [CVE-2026-16241](https://cve.now/CVE-2026-16241.md): PostgreSQL ECPG integer underflow can crash the client (CVSS 3.8, PostgreSQL)
- [CVE-2026-16239](https://cve.now/CVE-2026-16239.md): PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2026-16238](https://cve.now/CVE-2026-16238.md): PostgreSQL type confusion in pg\_restore\_attribute\_stats() executes arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2026-15742](https://cve.now/CVE-2026-15742.md): PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound (CVSS 8.8, PostgreSQL)
- [CVE-2026-15741](https://cve.now/CVE-2026-15741.md): PostgreSQL expression deparse allows SQL injection via EXTRACT argument (CVSS 8.8, PostgreSQL)
- [CVE-2026-14681](https://cve.now/CVE-2026-14681.md): PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL (CVSS 4.2, PostgreSQL)
- [CVE-2026-14680](https://cve.now/CVE-2026-14680.md): PostgreSQL type confusion via "internal" arguments (CVSS 8.8, PostgreSQL)
- [CVE-2026-14679](https://cve.now/CVE-2026-14679.md): PostgreSQL stack buffer overflow in argument match writes 0x0 and 0x1 to server memory (CVSS 8.2, PostgreSQL)
- [CVE-2026-14678](https://cve.now/CVE-2026-14678.md): PostgreSQL pg\_trgm picksplit reads past end of buffer (CVSS 4.3, PostgreSQL)
- [CVE-2026-14677](https://cve.now/CVE-2026-14677.md): PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound (CVSS 8.8, PostgreSQL)
- [CVE-2026-14676](https://cve.now/CVE-2026-14676.md): PostgreSQL pg\_stat\_statements heap buffer overflow executes arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2026-14673](https://cve.now/CVE-2026-14673.md): PostgreSQL amcheck does not clear untrusted search path (CVSS 3.8, PostgreSQL)
- [CVE-2026-14672](https://cve.now/CVE-2026-14672.md): PostgreSQL observable response discrepancy with non-default scram\_iterations provides user existence oracle (CVSS 5.3, PostgreSQL)
- [CVE-2026-14670](https://cve.now/CVE-2026-14670.md): PostgreSQL plperl tied object heap buffer overflow executes arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2026-14669](https://cve.now/CVE-2026-14669.md): PostgreSQL to\_char heap buffer overflow executes arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2026-14668](https://cve.now/CVE-2026-14668.md): PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read (CVSS 8.1, PostgreSQL)
- [CVE-2026-14666](https://cve.now/CVE-2026-14666.md): PostgreSQL row security caching disregards role modifications (CVSS 4.2, PostgreSQL)
- [CVE-2026-14664](https://cve.now/CVE-2026-14664.md): PostgreSQL regexp heap buffer overflow executes arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2026-14663](https://cve.now/CVE-2026-14663.md): PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext (CVSS 6.5, PostgreSQL)
- [CVE-2026-14662](https://cve.now/CVE-2026-14662.md): PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound (CVSS 8.8, PostgreSQL)
- [CVE-2026-13455](https://cve.now/CVE-2026-13455.md): PostgreSQL Anonymizer: Unrestricted function can leak the secret salt (CVSS 4.3, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-11945](https://cve.now/CVE-2026-11945.md): PostgreSQL Anonymizer: SQL injection in the rules import functions (CVSS 6.4, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-9617](https://cve.now/CVE-2026-9617.md): PostgreSQL Anonymizer: malicious column name allows SQL injection via anon.k\_anonymity() function (CVSS 6.8, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-8654](https://cve.now/CVE-2026-8654.md): Improper input validation in Delphix Continuous Data connectors allows an authenticated user to execute arbitrary operating system commands (CVSS 8.7, Delphix Continuous data IBM Db2 Connector · Delphix Con… +10)
- [CVE-2026-6638](https://cve.now/CVE-2026-6638.md): PostgreSQL REFRESH PUBLICATION allows SQL injection via table name (CVSS 3.7, PostgreSQL)
- [CVE-2026-6637](https://cve.now/CVE-2026-6637.md): PostgreSQL refint allows stack buffer overflow and SQL injection (CVSS 8.8, PostgreSQL)
- [CVE-2026-6575](https://cve.now/CVE-2026-6575.md): PostgreSQL pg\_restore\_attribute\_stats accepts values that cause query planning to read past end of stats array (CVSS 4.3, PostgreSQL)
- [CVE-2026-6479](https://cve.now/CVE-2026-6479.md): PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion (CVSS 7.5, PostgreSQL)
- [CVE-2026-6478](https://cve.now/CVE-2026-6478.md): PostgreSQL discloses MD5-hashed passwords via covert timing channel (CVSS 6.5, PostgreSQL)
- [CVE-2026-6477](https://cve.now/CVE-2026-6477.md): PostgreSQL libpq lo\_\* functions let server superuser overwrite client stack memory (CVSS 8.8, PostgreSQL)
- [CVE-2026-6476](https://cve.now/CVE-2026-6476.md): PostgreSQL pg\_createsubscriber allows SQL injection via subscription name (CVSS 7.2, PostgreSQL)
- [CVE-2026-6475](https://cve.now/CVE-2026-6475.md): PostgreSQL pg\_basebackup and pg\_rewind can overwrite unrelated files of origin superuser choice (CVSS 8.8, PostgreSQL)
- [CVE-2026-6474](https://cve.now/CVE-2026-6474.md): PostgreSQL timeofday() can disclose portions of server memory (CVSS 4.3, PostgreSQL)
- [CVE-2026-6473](https://cve.now/CVE-2026-6473.md): PostgreSQL server undersizes allocations, via integer wraparound (CVSS 8.8, PostgreSQL)
- [CVE-2026-6472](https://cve.now/CVE-2026-6472.md): PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege (CVSS 5.4, PostgreSQL)
- [CVE-2026-2007](https://cve.now/CVE-2026-2007.md): PostgreSQL pg\_trgm heap buffer overflow writes pattern onto server memory (CVSS 8.2, PostgreSQL)
- [CVE-2026-2006](https://cve.now/CVE-2026-2006.md): PostgreSQL missing validation of multibyte character length executes arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2026-2005](https://cve.now/CVE-2026-2005.md): PostgreSQL pgcrypto heap buffer overflow executes arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2026-2004](https://cve.now/CVE-2026-2004.md): PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2026-2003](https://cve.now/CVE-2026-2003.md): PostgreSQL oidvector discloses a few bytes of memory (CVSS 4.3, PostgreSQL)
- [CVE-2026-2361](https://cve.now/CVE-2026-2361.md): Improper search\_path protection in PostgreSQL Anonymizer 2.5 allows any user with create privilege to gain superuser privileges (CVSS 8.0, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-2360](https://cve.now/CVE-2026-2360.md): Improper search\_path protection in PostgreSQL Anonymizer 2.5 allows any user to gain superuser privileges in PostgreSQL 14 (CVSS 8.0, DALIBO PostgreSQL Anonymizer)
- [CVE-2026-0949](https://cve.now/CVE-2026-0949.md): PEM versions prior to 9.8.1 are affected by a stored Cross-site Scripting (XSS) vulnerability that allows users with access to the Manage Ch (CVSS 6.5, EnterpriseDB Postgres Enterprise Manager)
- [CVE-2025-12818](https://cve.now/CVE-2025-12818.md): PostgreSQL libpq undersizes allocations, via integer wraparound (CVSS 5.9, PostgreSQL)
- [CVE-2025-12817](https://cve.now/CVE-2025-12817.md): PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege (CVSS 3.1, PostgreSQL)
- [CVE-2025-8715](https://cve.now/CVE-2025-8715.md): PostgreSQL pg\_dump newline in object name executes arbitrary code in psql client and in restore target server (CVSS 8.8, PostgreSQL)
- [CVE-2025-8714](https://cve.now/CVE-2025-8714.md): PostgreSQL pg\_dump lets superuser of origin server execute arbitrary code in psql client (CVSS 8.8, PostgreSQL)
- [CVE-2025-8713](https://cve.now/CVE-2025-8713.md): PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table (CVSS 3.1, PostgreSQL)
- [CVE-2025-5690](https://cve.now/CVE-2025-5690.md): Cursor allows PostgreSQL Anonymizer masked user to gain unauthorized access to authentic data (CVSS 6.5, DALIBO PostgreSQL Anonymizer)
- [CVE-2025-4207](https://cve.now/CVE-2025-4207.md): PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation (CVSS 5.9, PostgreSQL)
- [CVE-2025-1094](https://cve.now/CVE-2025-1094.md): PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation (CVSS 8.1, PostgreSQL)
- [CVE-2024-10979](https://cve.now/CVE-2024-10979.md): PostgreSQL PL/Perl environment variable changes execute arbitrary code (CVSS 8.8, PostgreSQL)
- [CVE-2024-10978](https://cve.now/CVE-2024-10978.md): PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID (CVSS 4.2, PostgreSQL)
- [CVE-2024-10977](https://cve.now/CVE-2024-10977.md): PostgreSQL libpq retains an error message from man-in-the-middle (CVSS 3.1, PostgreSQL)
- [CVE-2024-10976](https://cve.now/CVE-2024-10976.md): PostgreSQL row security below e.g. subqueries disregards user ID changes (CVSS 4.2, PostgreSQL)
- [CVE-2024-7348](https://cve.now/CVE-2024-7348.md): PostgreSQL relation replacement during pg\_dump executes arbitrary SQL (CVSS 8.8, PostgreSQL)
- [CVE-2024-4317](https://cve.now/CVE-2024-4317.md): PostgreSQL pg\_stats\_ext and pg\_stats\_ext\_exprs lack authorization checks (CVSS 3.1, PostgreSQL)
- [CVE-2024-2339](https://cve.now/CVE-2024-2339.md): Improper Input Validation in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rule (CVSS 8.0, DALIBO PostgreSQL Anonymizer)
- [CVE-2024-2338](https://cve.now/CVE-2024-2338.md): SQL Injection in PostgreSQL Anonymizer 1.2 allows table owner to gain superuser privileges via masking rule (CVSS 8.0, DALIBO PostgreSQL Anonymizer)
- [CVE-2024-0985](https://cve.now/CVE-2024-0985.md): PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL (CVSS 8.0, PostgreSQL)
- [CVE-2023-2454](https://cve.now/CVE-2023-2454.md): schema\_element defeats protective search\_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacke (CVSS 7.2, postgresql)
- [CVE-2023-2455](https://cve.now/CVE-2023-2455.md): Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases wh (CVSS 5.4, postgresql)
- [CVE-2023-31136](https://cve.now/CVE-2023-31136.md): PostgresNIO processes unencrypted bytes from man-in-the-middle (CVSS 3.7, vapor postgres-nio)
- [CVE-2022-41862](https://cve.now/CVE-2022-41862.md): In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. (CVSS 3.7, postgresql)
- [CVE-2022-1552](https://cve.now/CVE-2022-1552.md): A flaw was found in PostgreSQL. (no CVSS, postgresql)
- [CVE-2022-2625](https://cve.now/CVE-2022-2625.md): A vulnerability was found in PostgreSQL. (no CVSS, postgresql)
- [CVE-2021-23214](https://cve.now/CVE-2021-23214.md): When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle a (no CVSS, postgresql)
- [CVE-2021-23222](https://cve.now/CVE-2021-23222.md): A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification a (no CVSS, postgresql)
- [CVE-2021-3677](https://cve.now/CVE-2021-3677.md): A flaw was found in postgresql. (no CVSS, postgresql)
- [CVE-2021-32028](https://cve.now/CVE-2021-32028.md): A flaw was found in postgresql. (no CVSS, postgresql)
- [CVE-2021-32029](https://cve.now/CVE-2021-32029.md): A flaw was found in postgresql. (no CVSS, postgresql)
- [CVE-2021-32027](https://cve.now/CVE-2021-32027.md): A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. (no CVSS, postgresql)
- [CVE-2021-3393](https://cve.now/CVE-2021-3393.md): An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. (no CVSS, postgresql)
- [CVE-2019-10128](https://cve.now/CVE-2019-10128.md): A vulnerability was found in postgresql versions 11.x prior to 11.3. (no CVSS, postgresql)
- [CVE-2019-10127](https://cve.now/CVE-2019-10127.md): A vulnerability was found in postgresql versions 11.x prior to 11.3. (no CVSS, postgresql)
- [CVE-2021-20229](https://cve.now/CVE-2021-20229.md): A flaw was found in PostgreSQL in versions before 13.2. (no CVSS, PostgreSQL)
- [CVE-2020-25696](https://cve.now/CVE-2020-25696.md): A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6 (no CVSS, PostgreSQL)
- [CVE-2020-25695](https://cve.now/CVE-2020-25695.md): A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. (no CVSS, postgresql)
- [CVE-2020-25694](https://cve.now/CVE-2020-25694.md): A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. (no CVSS, postgresql)
- [CVE-2020-10733](https://cve.now/CVE-2020-10733.md): The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths. (no CVSS, PostgreSQL)
- [CVE-2020-14350](https://cve.now/CVE-2020-14350.md): It was found that some PostgreSQL extensions did not use search\_path safely in their installation script. (no CVSS, PostgreSQL)
- [CVE-2020-14349](https://cve.now/CVE-2020-14349.md): It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search\_path during logical rep (no CVSS, PostgreSQL)
- [CVE-2020-1720](https://cve.now/CVE-2020-1720.md): A flaw was found in PostgreSQL's "ALTER ... (CVSS 3.1, Red Hat postgresql)
- [CVE-2015-0241](https://cve.now/CVE-2015-0241.md): The to\_char function in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allow (no CVSS, PostgreSQL Global Development Group PostgreSQL)
- [CVE-2015-0242](https://cve.now/CVE-2015-0242.md): Stack-based buffer overflow in the \*printf function implementations in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9 (no CVSS, PostgreSQL Global Development Group PostgreSQL)
- [CVE-2015-0243](https://cve.now/CVE-2015-0243.md): Multiple buffer overflows in contrib/pgcrypto in PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and (no CVSS, PostgreSQL Global Development Group PostgreSQL)
- [CVE-2015-0244](https://cve.now/CVE-2015-0244.md): PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 does not properly handle erro (no CVSS, PostgreSQL Global Development Group PostgreSQL)
- [CVE-2014-8161](https://cve.now/CVE-2014-8161.md): PostgreSQL before 9.0.19, 9.1.x before 9.1.15, 9.2.x before 9.2.10, 9.3.x before 9.3.6, and 9.4.x before 9.4.1 allows remote authenticated u (no CVSS, PostgreSQL Global Development Group PostgreSQL)
- [CVE-2015-3166](https://cve.now/CVE-2015-3166.md): The snprintf implementation in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4. (no CVSS, PostgreSQL Global Development Group PostgreSQL)
- [CVE-2015-3167](https://cve.now/CVE-2015-3167.md): contrib/pgcrypto in PostgreSQL before 9.0.20, 9.1.x before 9.1.16, 9.2.x before 9.2.11, 9.3.x before 9.3.7, and 9.4.x before 9.4.2 uses diff (no CVSS, PostgreSQL Global Development Group PostgreSQL)
- [CVE-2019-3466](https://cve.now/CVE-2019-3466.md): The pg\_ctlcluster script in postgresql-common in versions prior to 210 didn't drop privileges when creating socket/statistics temporary dire (no CVSS, postgresql-common)
- [CVE-2019-10211](https://cve.now/CVE-2019-10211.md): Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled OpenSSL executing code from unpro (CVSS 7.8, postgresql)
- [CVE-2019-10208](https://cve.now/CVE-2019-10208.md): A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10.x before 10.10 and 11.x befor (CVSS 7.5, postgresql)
- [CVE-2019-10209](https://cve.now/CVE-2019-10209.md): Postgresql, versions 11.x before 11.5, is vulnerable to a memory disclosure in cross-type comparison for hashed subplan. (CVSS 3.1, postgresql)
- [CVE-2019-10210](https://cve.now/CVE-2019-10210.md): Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via superuser writing password to unprotected (CVSS 6.7, postgresql)
- [CVE-2019-10130](https://cve.now/CVE-2019-10130.md): A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x up to, excluding 9.6.13, 9.5.x (CVSS 3.1, PostgreSQL Project postgresql)
- [CVE-2019-10129](https://cve.now/CVE-2019-10129.md): A vulnerability was found in postgresql versions 11.x prior to 11.3. (CVSS 6.5, PostgreSQL Project postgresql)
- [CVE-2019-10164](https://cve.now/CVE-2019-10164.md): PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer overflow. (CVSS 7.5, PostgreSQL)
- [CVE-2018-16850](https://cve.now/CVE-2018-16850.md): postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg\_upgrade and pg\_dump via CREATE TRIGGER ... (CVSS 8.0, The PostgreSQL Project postgresql)
- [CVE-2018-10936](https://cve.now/CVE-2018-10936.md): A weakness was found in postgresql-jdbc before version 42.2.5. (CVSS 8.1, \[UNKNOWN\] PostgreSQL · org.postgresql:pgjdbc-aggregate)
- [CVE-2018-10925](https://cve.now/CVE-2018-10925.md): It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly check authorization on certain (CVSS 7.1, PostgreSQL Global Development Group postgresql)
- [CVE-2018-10915](https://cve.now/CVE-2018-10915.md): A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset its internal state between co (CVSS 8.5, PostgreSQL Global Development Group postgresql)
- [CVE-2017-15097](https://cve.now/CVE-2017-15097.md): Privilege escalation flaws were found in the Red Hat initialization scripts of PostgreSQL. (CVSS 6.5, Red Hat postgresql init script)
- [CVE-2018-1115](https://cve.now/CVE-2018-1115.md): postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg\_catalog.pg\_logfile\_rotate() function doesn't follow (CVSS 4.2, postgresql)
- [CVE-2018-1058](https://cve.now/CVE-2018-1058.md): A flaw was found in the way Postgresql allowed a user to modify the behavior of a query for other users. (no CVSS, The PostgreSQL Global Development Group postgresql)
- [CVE-2017-14798](https://cve.now/CVE-2017-14798.md): local privilege escalation in SUSE postgresql init script (CVSS 7.3, suse postgresql-init)
- [CVE-2018-1052](https://cve.now/CVE-2018-1052.md): Memory disclosure vulnerability in table partitioning was found in postgresql 10.x before 10.2, allowing an authenticated attacker to read a (no CVSS, The PostgreSQL Global Development Group postgresql)
- [CVE-2018-1053](https://cve.now/CVE-2018-1053.md): In postgresql 9.3.x before 9.3.21, 9.4.x before 9.4.16, 9.5.x before 9.5.11, 9.6.x before 9.6.7 and 10.x before 10.2, pg\_upgrade creates fil (no CVSS, The PostgreSQL Global Development Group postgresql)
- [CVE-2017-12172](https://cve.now/CVE-2017-12172.md): PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before 9.5.10, 9.4.x before 9.4.15, 9.3.x before 9.3.20, and 9.2.x before 9.2.24 runs (no CVSS, Red Hat postgresql)
- [CVE-2017-15099](https://cve.now/CVE-2017-15099.md): INSERT ... (no CVSS, Red Hat postgresql)
- [CVE-2017-15098](https://cve.now/CVE-2017-15098.md): Invalid json\_populate\_recordset or jsonb\_populate\_recordset function calls in PostgreSQL 10.x before 10.1, 9.6.x before 9.6.6, 9.5.x before (no CVSS, Red Hat postgresql)
- [CVE-2017-8806](https://cve.now/CVE-2017-8806.md): The Debian pg\_ctlcluster, pg\_createcluster, and pg\_upgradecluster scripts, as distributed in the Debian postgresql-common package before 181 (no CVSS, PostgreSQL-related scripts that are specific to Debian and…)
- [CVE-2017-7546](https://cve.now/CVE-2017-7546.md): PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to incorrect authentication flaw allowing remote attackers (no CVSS, postgresql)
- [CVE-2017-7547](https://cve.now/CVE-2017-7547.md): PostgreSQL versions before 9.2.22, 9.3.18, 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attack (no CVSS, postgresql)
- [CVE-2017-7548](https://cve.now/CVE-2017-7548.md): PostgreSQL versions before 9.4.13, 9.5.8 and 9.6.4 are vulnerable to authorization flaw allowing remote authenticated attackers with no priv (no CVSS, postgresql)
- [CVE-2017-7484](https://cve.now/CVE-2017-7484.md): It was found that some selectivity estimation functions in PostgreSQL before 9.2.21, 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before (no CVSS, The PostgreSQL Global Development Group PostgreSQL)
- [CVE-2017-7485](https://cve.now/CVE-2017-7485.md): In PostgreSQL 9.3.x before 9.3.17, 9.4.x before 9.4.12, 9.5.x before 9.5.7, and 9.6.x before 9.6.3, it was found that the PGREQUIRESSL envir (no CVSS, The PostgreSQL Global Development Group PostgreSQL)
- [CVE-2017-7486](https://cve.now/CVE-2017-7486.md): PostgreSQL versions 8.4 - 9.6 are vulnerable to information leak in pg\_user\_mappings view which discloses foreign server passwords to any us (no CVSS, The PostgreSQL Global Development Group PostgreSQL)

---

Source: cve.now, built and run by Sazabi (AI-native observability and security)
Page: https://cve.now/tech/postgresql
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.