Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%

postgresql — Vulnerabilities & Security Advisories 163

All 163 CVE vulnerabilities found in postgresql, with AI-generated Chinese analysis, references, and POCs.

This page documents known software vulnerabilities within the PostgreSQL database management system, categorized by Common Weakness Enumeration tags. It aggregates security issues affecting the vendor’s open-source relational database product, covering a historical time range from initial public disclosures to the most recent patch releases. Here, users can track vendor advisories issued by the PostgreSQL Global Development Group, understand specific weakness classes such as injection flaws or improper access controls, and look up the product's comprehensive vulnerability history. The data is organized to facilitate efficient risk assessment for database administrators, security engineers, and compliance officers who need to evaluate the impact of known defects on their infrastructure. By centralizing these reports, the resource allows stakeholders to correlate specific CVE identifiers with affected versions and available fixes. This systematic approach supports proactive vulnerability management by highlighting trends in security defects over time. Readers can compare the severity ratings assigned by different tracking authorities and review the timeline of remediation efforts. The information aids in prioritizing patches and configuration changes to mitigate risks associated with legacy versions. Maintaining an accurate record of these issues is essential for ensuring the integrity and availability of applications relying on this database engine. The content strictly adheres to factual reporting standards to support technical decision-making processes without speculation.

Vendor: n/a

CVE ID Title CVSS Severity Published
CVE-2026-6467 PostgreSQL extension script schema mishandling executes arbitrary SQL CWE-427 7.2 High 2026-11-12
CVE-2026-18447 PostgreSQL output parameter type confusion executes arbitrary code CWE-843 8.8 High 2026-11-12
CVE-2026-6460 PostgreSQL type confusion after ALTER ... SET DATA TYPE executes arbitrary code CWE-843 8.8 High 2026-11-12
CVE-2026-16237 PostgreSQL INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition CWE-424 5.4 Medium 2026-11-12
CVE-2026-16240 PostgreSQL pg_basebackup can use backup manifest content as a format string CWE-134 3.7 Low 2026-11-12
CVE-2026-120154 PostgreSQL INSERT ... ON CONFLICT can read rows despite row security policies CWE-424 4.3 Medium 2026-11-12
CVE-2026-14661 PostgreSQL dblink and subscriptions can append to arbitrary files CWE-73 8.1 High 2026-11-12
CVE-2026-120153 PostgreSQL extension-script substitutions allow SQL injection through object names CWE-89 7.2 High 2026-11-12
CVE-2026-120152 PostgreSQL pg_show_all_settings() use-after-free discloses memory CWE-416 4.3 Medium 2026-11-12
CVE-2026-120151 PostgreSQL plpgsql record-field type confusion executes arbitrary code CWE-843 8.8 High 2026-11-12
CVE-2026-120149 PostgreSQL FDW batch-insert mismatch executes arbitrary code CWE-122 8.8 High 2026-11-12
CVE-2026-120150 PostgreSQL expanded-record domain-check use-after-free executes arbitrary code CWE-416 8.8 High 2026-11-12
CVE-2026-120148 PostgreSQL extended-statistics pseudo-type confusion executes arbitrary code CWE-843 8.1 High 2026-11-12
CVE-2026-120146 PostgreSQL REASSIGN OWNED bypasses role SET and CREATEDB checks CWE-862 4.3 Medium 2026-11-12
CVE-2026-120147 PostgreSQL dblink reentrant disconnect use-after-free executes arbitrary code CWE-416 8.8 High 2026-11-12
CVE-2026-120145 PostgreSQL logical replication can write to subscriber system catalogs, executing arbitrary code CWE-862 8.8 High 2026-11-12
CVE-2026-120144 PostgreSQL type-cache invalidation gap executes arbitrary code CWE-843 8.8 High 2026-11-12
CVE-2026-120143 PostgreSQL transition-table cursor use-after-free executes arbitrary code CWE-416 8.8 High 2026-11-12
CVE-2026-120141 PostgreSQL materialized set-returning function type confusion executes arbitrary code CWE-843 8.8 High 2026-11-12
CVE-2026-120142 PostgreSQL dropped-column type confusion executes arbitrary code CWE-843 8.8 High 2026-11-12
CVE-2026-120139 PostgreSQL tuple-size integer wraparound executes arbitrary code CWE-190 8.8 High 2026-11-12
CVE-2026-116336 PostgreSQL REINDEX CONCURRENTLY does not block DROP INDEX during index functions CWE-843 8.8 High 2026-11-12
CVE-2026-116335 PostgreSQL commutator or negator result-type confusion executes arbitrary code CWE-843 8.8 High 2026-11-12
CVE-2026-116332 PostgreSQL portal setup use-after-free executes arbitrary code CWE-416 8.8 High 2026-11-12
CVE-2026-116333 PostgreSQL parallel B-tree array scan reads beyond array bounds CWE-126 6.5 Medium 2026-11-12
CVE-2026-116331 PostgreSQL min/max aggregate type confusion executes arbitrary code CWE-843 8.8 High 2026-11-12
CVE-2026-116330 PostgreSQL pg_dump tar restore.sql fails to block psql command injection CWE-829 8.8 High 2026-11-12
CVE-2026-116329 PostgreSQL statistics import type confusion executes arbitrary code CWE-843 8.8 High 2026-11-12
CVE-2026-116327 PostgreSQL security_barrier analysis can expose hidden values through indirect expressions CWE-862 4.3 Medium 2026-11-12
CVE-2026-116328 PostgreSQL generation memory context integer wraparound executes arbitrary code CWE-190 8.8 High 2026-11-12

All 163 known CVE vulnerabilities affecting postgresql with full Chinese analysis, references, and POCs where available.