PostgreSQL
80 vulnérabilités publiées citent ce produit.
Tel que les CNA l’écrivent dans leurs fiches CVE (éditeur et produit) ; les versions sont les leurs.
| CVE | Versions vulnérables | Titre | Sévérité | Publiée | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-6471 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL logical decoding can dlopen arbitrary file | HIGH 7.2 | 0.5 % | ||
| CVE-2026-14671 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL refint plan cache type confusion executes arbitrary code | HIGH 8.8 | 0.4 % | ||
| CVE-2026-6470 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL fails to check type USAGE privilege | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-6469 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL ALTER TABLE ALTER TYPE resets extended statistics ownership | LOW 3.8 | 0.3 % | ||
| CVE-2026-6464 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands | HIGH 8.1 | 0.4 % | ||
| CVE-2026-19385 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL pg_dump heap buffer overflow executes arbitrary code | HIGH 8.8 | 0.4 % | ||
| CVE-2026-18408 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client | HIGH 8.8 | 0.4 % | ||
| CVE-2026-18024 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL ascii() function reads past end of buffer | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-16241 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL ECPG integer underflow can crash the client | LOW 3.8 | 0.3 % | ||
| CVE-2026-16239 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code | HIGH 8.8 | 0.7 % | ||
| CVE-2026-16238 | 18 – < 18.6 | PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code | HIGH 8.8 | 0.4 % | ||
| CVE-2026-15742 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound | HIGH 8.8 | 0.6 % | ||
| CVE-2026-15741 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL expression deparse allows SQL injection via EXTRACT argument | HIGH 8.8 | 0.4 % | ||
| CVE-2026-14681 | 18 – < 18.6 ; 17 – < 17.11 | PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL | MEDIUM 4.2 | 0.1 % | ||
| CVE-2026-14680 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL type confusion via "internal" arguments | HIGH 8.8 | 0.4 % | ||
| CVE-2026-14679 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL stack buffer overflow in argument match writes 0x0 and 0x1 to server memory | HIGH 8.2 | 0.3 % | ||
| CVE-2026-14678 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL pg_trgm picksplit reads past end of buffer | MEDIUM 4.3 | 0.3 % | ||
| CVE-2026-14677 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound | HIGH 8.8 | 0.4 % | ||
| CVE-2026-14676 | 18 – < 18.6 | PostgreSQL pg_stat_statements heap buffer overflow executes arbitrary code | HIGH 8.8 | 0.4 % | ||
| CVE-2026-14673 | 18 – < 18.6 ; 16 – < 16.15 ; 15 – < 15.19 ; … | PostgreSQL amcheck does not clear untrusted search path | LOW 3.8 | 0.3 % | ||
| CVE-2026-14672 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 | PostgreSQL observable response discrepancy with non-default scram_iterations provides user existence oracle | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-14670 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL plperl tied object heap buffer overflow executes arbitrary code | HIGH 8.8 | 0.4 % | ||
| CVE-2026-14669 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL to_char heap buffer overflow executes arbitrary code | HIGH 8.8 | 0.7 % | ||
| CVE-2026-14668 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read | HIGH 8.1 | 0.3 % | ||
| CVE-2026-14666 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL row security caching disregards role modifications | MEDIUM 4.2 | 0.2 % | ||
| CVE-2026-14664 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL regexp heap buffer overflow executes arbitrary code | HIGH 8.8 | 0.4 % | ||
| CVE-2026-14663 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL pgcrypto, for OpenSSL-disabled ciphers, silently encrypts to and decrypts from cleartext | MEDIUM 6.5 | 0.1 % | ||
| CVE-2026-14662 | 18 – < 18.6 ; 17 – < 17.11 ; 16 – < 16.15 ; … | PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound | HIGH 8.8 | 0.5 % | ||
| CVE-2026-6638 | 18 – < 18.4 ; 17 – < 17.10 ; 16 – < 16.14 | PostgreSQL REFRESH PUBLICATION allows SQL injection via table name | HIGH 8.8 | 0.2 % | ||
| CVE-2026-6637 | 18 – < 18.4 ; 17 – < 17.10 ; 16 – < 16.14 ; … | PostgreSQL refint allows stack buffer overflow and SQL injection | HIGH 8.8 | 0.4 % | ||
| CVE-2026-6575 | 18 – < 18.4 | PostgreSQL pg_restore_attribute_stats accepts values that cause query planning to read past end of stats array | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-6479 | 18 – < 18.4 ; 17 – < 17.10 ; 16 – < 16.14 ; … | PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion | HIGH 7.5 | 0.6 % | ||
| CVE-2026-6478 | 18 – < 18.4 ; 17 – < 17.10 ; 16 – < 16.14 ; … | PostgreSQL discloses MD5-hashed passwords via covert timing channel | HIGH 8.2 | 0.6 % | ||
| CVE-2026-6477 | 18 – < 18.4 ; 17 – < 17.10 ; 16 – < 16.14 ; … | PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory | HIGH 8.8 | 0.5 % | ||
| CVE-2026-6476 | 18 – < 18.4 ; 17 – < 17.10 | PostgreSQL pg_createsubscriber allows SQL injection via subscription name | HIGH 7.2 | 0.3 % | ||
| CVE-2026-6475 | 18 – < 18.4 ; 17 – < 17.10 ; 16 – < 16.14 ; … | PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice | HIGH 8.8 | 0.4 % | ||
| CVE-2026-6474 | 18 – < 18.4 ; 17 – < 17.10 ; 16 – < 16.14 ; … | PostgreSQL timeofday() can disclose portions of server memory | MEDIUM 4.3 | 0.2 % | ||
| CVE-2026-6473 | 18 – < 18.4 ; 17 – < 17.10 ; 16 – < 16.14 ; … | PostgreSQL server undersizes allocations, via integer wraparound | HIGH 8.8 | 1.0 % | ||
| CVE-2026-6472 | 18 – < 18.4 ; 17 – < 17.10 ; 16 – < 16.14 ; … | PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege | MEDIUM 5.4 | 0.2 % | ||
| CVE-2026-2007 | 18 – < 18.2 | PostgreSQL pg_trgm heap buffer overflow writes pattern onto server memory | HIGH 8.2 | 0.5 % | ||
| CVE-2026-2006 | 18 – < 18.2 ; 17 – < 17.8 ; 16 – < 16.12 ; … | PostgreSQL missing validation of multibyte character length executes arbitrary code | HIGH 8.8 | 1.2 % | ||
| CVE-2026-2005 | 18 – < 18.2 ; 17 – < 17.8 ; 16 – < 16.12 ; … | PostgreSQL pgcrypto heap buffer overflow executes arbitrary code | HIGH 8.8 | 1.4 % | ||
| CVE-2026-2004 | 18 – < 18.2 ; 17 – < 17.8 ; 16 – < 16.12 ; … | PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code | HIGH 8.8 | 1.3 % | ||
| CVE-2026-2003 | 18 – < 18.2 ; 17 – < 17.8 ; 16 – < 16.12 ; … | PostgreSQL oidvector discloses a few bytes of memory | MEDIUM 4.3 | 0.3 % | ||
| CVE-2025-12818 | 18 – < 18.1 ; 17 – < 17.7 ; 16 – < 16.11 ; … | PostgreSQL libpq undersizes allocations, via integer wraparound | MEDIUM 5.9 | 0.4 % | ||
| CVE-2025-12817 | 18 – < 18.1 ; 17 – < 17.7 ; 16 – < 16.11 ; … | PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege | LOW 3.1 | 0.2 % | ||
| CVE-2025-8715 | 17 – < 17.6 ; 16 – < 16.10 ; 15 – < 15.14 ; … | PostgreSQL pg_dump newline in object name executes arbitrary code in psql client and in restore target server | HIGH 8.8 | 0.4 % | ||
| CVE-2025-8714 | 17 – < 17.6 ; 16 – < 16.10 ; 15 – < 15.14 ; … | PostgreSQL pg_dump lets superuser of origin server execute arbitrary code in psql client | HIGH 8.8 | 0.8 % | ||
| CVE-2025-8713 | 17 – < 17.6 ; 16 – < 16.10 ; 15 – < 15.14 ; … | PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table | LOW 3.1 | 0.2 % | ||
| CVE-2025-4207 | 17 – < 17.5 ; 16 – < 16.9 ; 15 – < 15.13 ; … | PostgreSQL GB18030 encoding validation can read one byte past end of allocation for text that fails validation | MEDIUM 5.9 | 0.8 % | ||
| CVE-2025-1094 | 17 – < 17.3 ; 16 – < 16.7 ; 15 – < 15.11 ; … | PostgreSQL quoting APIs miss neutralizing quoting syntax in text that fails encoding validation | HIGH 8.1 | 90 % | ||
| CVE-2024-10979 | 17 – < 17.1 ; 16 – < 16.5 ; 15 – < 15.9 ; … | PostgreSQL PL/Perl environment variable changes execute arbitrary code | HIGH 8.8 | 4.4 % | ||
| CVE-2024-10978 | 17 – < 17.1 ; 16 – < 16.5 ; 15 – < 15.9 ; … | PostgreSQL SET ROLE, SET SESSION AUTHORIZATION reset to wrong user ID | MEDIUM 4.2 | 0.7 % | ||
| CVE-2024-10977 | 17 – < 17.1 ; 16 – < 16.5 ; 15 – < 15.9 ; … | PostgreSQL libpq retains an error message from man-in-the-middle | LOW 3.7 | 0.4 % | ||
| CVE-2024-10976 | 17 – < 17.1 ; 16 – < 16.5 ; 15 – < 15.9 ; … | PostgreSQL row security below e.g. subqueries disregards user ID changes | MEDIUM 5.4 | 0.8 % | ||
| CVE-2024-7348 | 16 – < 16.4 ; 15 – < 15.8 ; 14 – < 14.13 ; … | PostgreSQL relation replacement during pg_dump executes arbitrary SQL | HIGH 8.8 | 1.6 % | ||
| CVE-2024-4317 | 16 – < 16.3 ; 15 – < 15.7 ; 14 – < 14.12 | PostgreSQL pg_stats_ext and pg_stats_ext_exprs lack authorization checks | MEDIUM 4.3 | 0.7 % | ||
| CVE-2024-0985 | 16 – < 16.2 ; 15 – < 15.6 ; 14 – < 14.11 ; … | PostgreSQL non-owner REFRESH MATERIALIZED VIEW CONCURRENTLY executes arbitrary SQL | HIGH 8.0 | 1.8 % | ||
| CVE-2023-2455 | PostgreSQL 15.3, PostgreSQL 14.8, PostgreSQL 13.11, PostgreSQL 12.15, PostgreSQL 11.20 | Row security policies disregard user ID changes after inlining; PostgreSQL could permit incorrect policies to be applied in certain cases wh | MEDIUM 5.4 | 0.7 % | ||
| CVE-2023-2454 | PostgreSQL 15.3, PostgreSQL 14.8, PostgreSQL 13.11, PostgreSQL 12.15, PostgreSQL 11.20 | schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacke | HIGH 7.2 | 1.2 % | ||
| CVE-2022-41862 | postgresql 5.2, postgresql 14.7, postgresql 13.10, postgresql 12.14, postgresql 11.19 | In PostgreSQL, a modified, unauthenticated server can send an unterminated string during the establishment of Kerberos transport encryption. | LOW 3.7 | 0.6 % | ||
| CVE-2022-1552 | Fixed in postgresql 14.3, postgresql 13.7, postgresql 12.11, postgresql 11.16, postgresql 10.21. | A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another us | HIGH 8.8 | 17 % | ||
| CVE-2022-2625 | postgresql 14.5, postgresql 13.8, postgresql 12.12, postgresql 11.17, postgresql 10.22 | A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability | HIGH 8.0 | 2.0 % | ||
| CVE-2021-23214 | Affects v9.6 to v14 | When the server is configured to use trust authentication with a clientcert requirement or to use cert authentication, a man-in-the-middle a | HIGH 8.1 | 1.9 % | ||
| CVE-2021-3677 | Fixedin v13.4, v12.8, v11.13 | A flaw was found in postgresql. A purpose-crafted query can read arbitrary bytes of server memory. In the default configuration, any authent | MEDIUM 6.5 | 1.4 % | ||
| CVE-2021-23222 | Affects v9.6 to v14 | A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of SSL certificate verification a | MEDIUM 5.9 | 1.5 % | ||
| CVE-2021-32028 | postgresql 13.3, postgresql 12.7, postgresql 11.12, postgresql 10.17, postgresql 9.6.22 | A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted table, an authenticated database | MEDIUM 6.5 | 1.6 % | ||
| CVE-2021-32029 | postgresql 13.3, postgresql 12.7, postgresql 11.12 | A flaw was found in postgresql. Using an UPDATE ... RETURNING command on a purpose-crafted table, an authenticated database user could read | MEDIUM 6.5 | 1.5 % | ||
| CVE-2021-32027 | postgresql 13.3, postgresql 12.7, postgresql 11.12, postgresql 10.17, postgresql 9.6.22 | A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6.22. While modifying certain S | HIGH 8.8 | 2.0 % | ||
| CVE-2021-3393 | postgresql 13.2, postgresql 12.6, postgresql 11.11 | An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user having UPDATE permission but | MEDIUM 4.3 | 1.2 % | ||
| CVE-2019-10128 | 11.x prior to 11.3 | A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for EnterpriseDB-supplied PostgreSQL does not loc | HIGH 7.8 | 0.4 % | ||
| CVE-2019-10127 | 11.x prior to 11.3 | A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for BigSQL-supplied PostgreSQL does not lock down | HIGH 8.8 | 0.3 % | ||
| CVE-2021-20229 | postgresql 13.2, postgresql 12.6, postgresql 11.11, postgresql 10.16, postgresql 9.6.21, postgresql 9.5.25 | A flaw was found in PostgreSQL in versions before 13.2. This flaw allows a user with SELECT privilege on one column to craft a special query | MEDIUM 4.3 | 1.5 % | ||
| CVE-2020-25696 | All PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24 | A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6 | HIGH 7.5 | 2.7 % | ||
| CVE-2020-25695 | All PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24 | A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. An attacker h | HIGH 8.8 | 46 % | ||
| CVE-2020-25694 | All PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24 | A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 and before 9.5.24. If a client a | HIGH 8.1 | 1.6 % | ||
| CVE-2020-10733 | 9.5, 9.6, 10, 11, 12 | The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-qualified paths. Executables in the | HIGH 7.3 | 0.5 % | ||
| CVE-2020-14350 | PostgreSQL versions before 12.4, before 11.9, before 10.14, before 9.6.19, and before 9.5.23 | It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An attacker with sufficient privil | HIGH 7.3 | 0.5 % | ||
| CVE-2020-14349 | PostgreSQL versions before 12.4, before 11.9 and before 10.14 | It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the search_path during logical rep | HIGH 7.1 | 2.2 % | ||
| CVE-2018-1115 | postegresql 10.4 ; postegresql 9.6.9 | postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rotate() function doesn't follow | CRITICAL 9.1 | 3.8 % |