LIVE · cybersecurity feed
Live wire
OpenAI Announced $1B in Defensive Tools for Water UtilitiesAttackers Breached JetBrains Cadence via Unpatched TeamCity, Extracting AWS CredentialsCVE-2026-59346 · Critical VMware Workstation and Fusion Flaw Lets VM Admins Execute Host CodeCVE-2026-32475 · Elementor Pro WordPress Plugin Vulnerability Exploited to Hack SitesBroadcom Patches Critical VMware Workstation and Fusion VM-Escape VulnerabilitiesHackers Leak Millions of Airport Passenger Records After Ransom RefusalUsing a VM to Contain an AI AgentCVE-2026-73749 · HPE Patches Critical RCE Vulnerabilities in AOS-CXCompanies Have Six Months to Prepare for Automated AttacksPhishing Campaign Sends Millions of Emails Using Invisible Unicode to Evade Filters
vendor

Postgresql

24 CVEs published in the last four months and 2 stories. Exploited flaws first.

Critical0
High24
Medium0
Exploited (KEV)0

All recent CVEs

CVECVSSSeverityProductSummaryPublished
CVE-2026-184088.8highpostgresqlUntrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbi23d ago
CVE-2026-66378.8highpostgresqlStack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code 114d ago
CVE-2026-64738.8highpostgresqlInteger wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server 114d ago
CVE-2026-64758.8highpostgresqlSymlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite114d ago
CVE-2026-162388.8highpostgresqlType confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as th23d ago
CVE-2026-162398.8highpostgresqlType confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating sy23d ago
CVE-2026-193858.8highpostgresqlHeap buffer overflow in PostgreSQL pg_dump of long function transform lists allows an object creator to execute ar23d ago
CVE-2026-64778.8highpostgresqlUse of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo114d ago
CVE-2026-146628.8highpostgresqlInteger wraparound in PostgreSQL tsvector and tsquery data type functions allows an unprivileged database user to 23d ago
CVE-2026-146648.8highpostgresqlHeap buffer overflow in PostgreSQL regexp allows the query author to execute arbitrary code as the operating syste23d ago
CVE-2026-146698.8highpostgresqlHeap buffer overflow in PostgreSQL to_char(timestamptz) allows the party choosing the timezone to execute arbitrar23d ago
CVE-2026-146708.8highpostgresqlHeap buffer overflow in PostgreSQL plperl return of a tied hash allows the function owner to execute arbitrary cod23d ago
CVE-2026-146718.8highpostgresqlType confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating s23d ago
CVE-2026-146768.8highpostgresqlHeap buffer overflow in PostgreSQL pg_stat_statements allows the query author to execute arbitrary code as the ope23d ago
CVE-2026-146778.8highpostgresqlInteger wraparound in PostgreSQL 32-bit builds of pltcl and plperl allows an object creator to cause the server to23d ago
CVE-2026-146808.8highpostgresqlType confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the ope23d ago
CVE-2026-157418.8highpostgresqlSQL injection in PostgreSQL EXTRACT() deparse allows an object owner to execute arbitrary SQL as a superuser via a23d ago
CVE-2026-157428.8highpostgresqlInteger wraparound in PostgreSQL fuzzystrmatch allows a user to direct writes to a huge range of addresses, execut23d ago
CVE-2026-146798.2highpostgresqlStack buffer overflow in PostgreSQL argument name matching allows an object creator to achieve unknown impacts via23d ago
CVE-2026-64648.1highpostgresqlUntrusted data inclusion in PostgreSQL psql COPY may allow a server administrator to elicit execution of data lines23d ago
CVE-2026-146688.1highpostgresqlType confusion regarding input of PostgreSQL ctid data type selectivity estimator allows an object creator to view23d ago
CVE-2026-64797.5highpostgresqlUncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_114d ago
CVE-2026-64767.2highpostgresqlSQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute ar114d ago
CVE-2026-64717.2highpostgresqlMissing authorization in PostgreSQL logical decoding allows a non-superuser holding REPLICATION privilege to dlopen23d ago

Filter the full tracker by Postgresql →

Our coverage of Postgresql

CVE-2026-6471high

PostgreSQL Fixes 12-Year-Old Logical Decoding Flaw Enabling Replication-Role Code Execution

PostgreSQL has released updates to address a critical security vulnerability, CVE-2026-6471, that existed for 12 years. The flaw allows a user with replication privileges to execute arbitrary code on the database server by loading a malicious library. The fix introduces a new parameter, output_plugin_libraries, which acts as a whitelist for allowed logical decoding plugins.

CVE-2026-6471

PostgreSQL Hit by 12-Year-Old Vulnerability Allowing Server Takeover

PostGREShell (CVE-2026-6471) is a 12-year-old PostgreSQL flaw that lets low-privileged attackers execute code and take over servers. Cyera researchers found a severe PostgreSQL vulnerability, dubbed PostGREShell and tracked as CVE-2026-6471 (CVSS score of 7.2). Present in releases dating back to 2014, the flaw can be exploited by attackers with low-level replication access to execute code, […]