LIVE · cybersecurity feed
Live wire
ASOS Breach Reveals the Risks in Customer-Facing SaaSUnpatched AhsayCBS flaws exploited to deploy webshells, mine cryptoAI Training Critical as Governance Challenges GrowUS Disrupts Chinese State-Sponsored Hacking ToolsCitrix warns admins to patch new NetScaler RCE flaw immediatelyCisco Patches a Dozen Critical VulnerabilitiesCisco warns of critical flaws allowing Nexus switch takeoverCVE-2026-21589 · Exploitation attempts against critical Atlassian flaw have begun (CVE-2026-21589)Cyber experts call on CISA to create mandatory federal OT rulesGremlin Foresight AI finds system weaknesses and verifies the fixes
vendor

Postgresql

24 CVEs published in the last four months and 2 stories. Exploited flaws first.

Critical0
High24
Medium0
Exploited (KEV)0

All recent CVEs

CVECVSSSeverityProductSummaryPublished
CVE-2026-184088.8highpostgresqlUntrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbi71d ago
CVE-2026-66378.8highpostgresqlStack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code 162d ago
CVE-2026-64738.8highpostgresqlInteger wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server 162d ago
CVE-2026-64758.8highpostgresqlSymlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite162d ago
CVE-2026-162388.8highpostgresqlType confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as th71d ago
CVE-2026-162398.8highpostgresqlType confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating sy71d ago
CVE-2026-193858.8highpostgresqlHeap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute ar71d ago
CVE-2026-64778.8highpostgresqlUse of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo162d ago
CVE-2026-146628.8highpostgresqlInteger wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to 71d ago
CVE-2026-146648.8highpostgresqlHeap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating syste71d ago
CVE-2026-146698.8highpostgresqlHeap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrar71d ago
CVE-2026-146708.8highpostgresqlHeap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary cod71d ago
CVE-2026-146718.8highpostgresqlType confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating s71d ago
CVE-2026-146768.8highpostgresqlHeap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the ope71d ago
CVE-2026-146778.8highpostgresqlInteger wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to71d ago
CVE-2026-146808.8highpostgresqlType confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the ope71d ago
CVE-2026-157418.8highpostgresqlSQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a71d ago
CVE-2026-157428.8highpostgresqlInteger wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, execut71d ago
CVE-2026-146798.2highpostgresqlStack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via71d ago
CVE-2026-64648.1highpostgresqlUntrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines71d ago
CVE-2026-146688.1highpostgresqlType confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view71d ago
CVE-2026-64797.5highpostgresqlUncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_162d ago
CVE-2026-64767.2highpostgresqlSQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute ar162d ago
CVE-2026-64717.2highpostgresqlMissing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen71d ago

Filter the full tracker by Postgresql →

Our coverage of Postgresql

CVE-2026-6471high

PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution

PostgreSQL has released updates to address a critical security vulnerability, identified as CVE-2026-6471, which has reportedly been present in the database system for 12 years. The flaw allows a user who possesses replication privileges to execute arbitrary code on the database server. This is achieved by loading a specially crafted malicious library, leveraging a mechanism within the logical…

CVE-2026-6471

PostgreSQL Hit by 12-Year-Old Vulnerability Allowing Server Takeover

A critical vulnerability, dubbed "PostGREShell" and tracked as CVE-2026-6471, has been discovered in PostgreSQL, allowing low-privileged attackers to execute arbitrary code and potentially take over database servers. The flaw, which has a CVSS score of 7.2, has been present in all PostgreSQL versions since 9.4, released in 2014, and remained unpatched for 12 years until recent updates.