CSIRTS // UNIFIED SECURITY ADVISORY FEEDSYS ● ONLINE · POWERED BY INTELFUSIONS.COM

CSIRTSSecurity advisory fusion

← All products & vendors

PostgreSQL — security advisories

39 advisorieslatest 2026-08-25⚡ RSS feed

Tracked PostgreSQL products:

PostgreSQL JDBC Driver PostgreSQL JDBC pgextwlist postgresql-17 psql pg_dump

⚡ Watch PostgreSQL

Get an email when a new PostgreSQL advisory drops — max one per day, one-click unsubscribe.

[NEW] [high] PostgreSQL: Multiple vulnerabilities

highCVE-2026-14662 CVE-2026-14663 CVE-2026-14664 CVE-2026-14666cert-bund2026-08-25

[UPDATE] [medium] PostgreSQL JDBC Driver: Vulnerability allows Denial of Service

mediumCVE-2026-42198cert-bund2026-08-25

[UPDATE] [high] PostgreSQL: Multiple vulnerabilities

highCVE-2026-6472 CVE-2026-6473 CVE-2026-6474 CVE-2026-6475cert-bund2026-08-21

[UPDATE] [high] PostgreSQL: Multiple vulnerabilities

highCVE-2025-8713 CVE-2025-8714 CVE-2025-8715cert-bund2026-08-21

USN-8653-1: PostgreSQL vulnerabilities

unknownCVE-2026-6464 CVE-2026-6469 CVE-2026-6470 CVE-2026-6471ubuntu2026-08-20

[UPDATE] [high] PostgreSQL: Multiple vulnerabilities

highCVE-2026-2003 CVE-2026-2004 CVE-2026-2005 CVE-2026-2006cert-bund2026-08-17

[UPDATE] [medium] PostgreSQL: Multiple vulnerabilities enable denial of service

mediumCVE-2025-12817 CVE-2025-12818cert-bund2026-08-17

[UPDATE] [medium] PostgreSQL: Vulnerability enables denial of service

mediumCVE-2025-4207cert-bund2026-08-17

[UPDATE] [high] PostgreSQL: Vulnerability enables SQL injection and code execution

highCVE-2025-1094cert-bund2026-08-17

[NEW] [medium] PostgreSQL JDBC Driver: Vulnerability allows bypassing security measures

mediumCVE-2026-54291cert-bund2026-08-14

Multiple vulnerabilities in PostgreSQL (August 14, 2026)

unknownCVE-2026-14671 CVE-2026-16239 CVE-2026-15742 CVE-2026-6469cert-fr-avis2026-08-14

DSA-6438-1 postgresql-17 - security update

unknownCVE-2026-6471debian2026-08-13

CVE-2026-14673: PostgreSQL amcheck does not clear untrusted search path

lowCVSS 3.8CVE-2026-14673msrc2026-08-11

CVE-2026-6470: PostgreSQL fails to check type USAGE privilege

mediumCVSS 4.3CVE-2026-6470msrc2026-08-11

CVE-2026-6471: PostgreSQL logical decoding can dlopen arbitrary file

highCVSS 7.2CVE-2026-6471msrc2026-08-11

CVE-2026-16238: PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code

highCVSS 8.8CVE-2026-16238msrc2026-08-11

CVE-2026-6469: PostgreSQL ALTER TABLE ALTER TYPE resets extended statistics ownership

lowCVSS 3.8CVE-2026-6469msrc2026-08-11

CVE-2026-18408: PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client

highCVSS 8.8CVE-2026-18408msrc2026-08-11

CVE-2026-19385: PostgreSQL pg_dump heap buffer overflow executes arbitrary code

highCVSS 8.8CVE-2026-19385msrc2026-08-11

CVE-2026-14662: PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound

highCVSS 8.8CVE-2026-14662msrc2026-08-11

CVE-2026-14663: PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext

mediumCVSS 6.5CVE-2026-14663msrc2026-08-11

CVE-2026-14664: PostgreSQL regexp heap buffer overflow executes arbitrary code

highCVSS 8.8CVE-2026-14664msrc2026-08-11

CVE-2026-14666: PostgreSQL row security caching disregards role modifications

mediumCVSS 4.2CVE-2026-14666msrc2026-08-11

CVE-2026-14668: PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read

highCVSS 8.1CVE-2026-14668msrc2026-08-11

CVE-2026-14670: PostgreSQL plperl tied object heap buffer overflow executes arbitrary code

highCVSS 8.8CVE-2026-14670msrc2026-08-11

CVE-2026-14671: PostgreSQL refint plan cache type confusion executes arbitrary code

highCVSS 8.8CVE-2026-14671msrc2026-08-11

CVE-2026-14672: PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle

mediumCVSS 5.3CVE-2026-14672msrc2026-08-11

CVE-2026-14677: PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound

highCVSS 8.8CVE-2026-14677msrc2026-08-11

CVE-2026-14678: PostgreSQL pg_trgm picksplit reads past end of buffer

mediumCVSS 4.3CVE-2026-14678msrc2026-08-11

CVE-2026-14680: PostgreSQL type confusion via "internal" arguments

highCVSS 8.8CVE-2026-14680msrc2026-08-11

CVE-2026-15741: PostgreSQL expression deparse allows SQL injection via EXTRACT argument

highCVSS 8.8CVE-2026-15741msrc2026-08-11

CVE-2026-15742: PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound

highCVSS 8.8CVE-2026-15742msrc2026-08-11

CVE-2026-16239: PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code

highCVSS 8.8CVE-2026-16239msrc2026-08-11

CVE-2026-18024: PostgreSQL ascii() function reads past end of buffer

mediumCVSS 4.3CVE-2026-18024msrc2026-08-11

CVE-2026-6464: PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands

highCVSS 8.1CVE-2026-6464msrc2026-08-11

PostgreSQL Multiple Vulnerabilities

unknownCVE-2026-6472 CVE-2026-6473 CVE-2026-6474 CVE-2026-6475hkcert2026-08-10

[UPDATE] [medium] PostgreSQL: Multiple vulnerabilities

mediumCVE-2023-39417 CVE-2023-39418cert-bund2026-07-09

DSA-6385-1 pgextwlist - security update

unknownCVE-2023-39417debian2026-07-08

Vulnerability in PostgreSQL JDBC (July 6, 2026)

unknownCVE-2026-54291cert-fr-avis2026-07-06