{"kind": "product", "path": "vulns/ubuntu-25.10/postgresql-17", "name": "postgresql-17", "product": "postgresql-17", "ecosystem": "Ubuntu:25.10", "items": [{"id": "CVE-2026-6638", "noindex": false, "published": "2026-05-14T13:00:15.848Z", "modified": "2026-05-14T15:28:30.735Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:L/A:N", "severity": "low", "epss": 0.0018, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-6638", "title": "PostgreSQL REFRESH PUBLICATION allows SQL injection via table name", "description": "SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ... REFRESH PUBLICATION allows a subscriber table creator to execute arbitrary SQL with the subscription's publication-side credentials.  The attack takes effect at the next REFRESH PUBLICATION.  Within major versions 16, 17, and 18, minor versions before PostgreSQL 18.4, 17.10, and 16.14 are affected.  Versions before PostgreSQL 16 are unaffected.", "references": ["https://www.postgresql.org/support/security/CVE-2026-6638/", "https://nvd.nist.gov/vuln/detail/CVE-2026-6638"], "fixes": ["17.10-0ubuntu0.25.10.1"], "products": [{"name": "postgresql-17", "path": "vulns/ubuntu-25.10/postgresql-17", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-6637", "noindex": false, "published": "2026-05-14T13:00:15.223Z", "modified": "2026-05-15T03:56:19.781Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.0037, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-6637", "title": "PostgreSQL refint allows stack buffer overflow and SQL injection", "description": "Stack buffer overflow in PostgreSQL module \"refint\" allows an unprivileged database user to execute arbitrary code as the operating system user running the database.  A distinct attack is possible if the application declares a user-controlled column as a \"refint\" cascade primary key and facilitates user-controlled updates to that column.  In that case, a SQL injection allows a primary key update value provider to execute arbitrary SQL as the database user performing the primary key update.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.", "references": ["https://www.postgresql.org/support/security/CVE-2026-6637/", "https://nvd.nist.gov/vuln/detail/CVE-2026-6637"], "fixes": ["17.10-0ubuntu0.25.10.1"], "products": [{"name": "postgresql-17", "path": "vulns/ubuntu-25.10/postgresql-17", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-6575", "noindex": false, "published": "2026-05-14T13:00:14.542Z", "modified": "2026-05-14T15:26:40.715Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00208, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-6575", "title": "PostgreSQL pg_restore_attribute_stats accepts values that cause query planning to read past end of stats array", "description": "Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array.  This allows a table maintainer to infer memory values past that array end.  Within major version 18, minor versions before PostgreSQL 18.4 are affected.  Versions before PostgreSQL 18 are unaffected.", "references": ["https://www.postgresql.org/support/security/CVE-2026-6575/", "https://nvd.nist.gov/vuln/detail/CVE-2026-6575"], "fixes": ["17.10-0ubuntu0.25.10.1"], "products": [{"name": "postgresql-17", "path": "vulns/ubuntu-25.10/postgresql-17", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-6479", "noindex": false, "published": "2026-05-14T13:00:13.859Z", "modified": "2026-05-14T15:26:20.166Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00595, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-6479", "title": "PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion", "description": "Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service.  If SSL and GSS are both disabled, an attacker can do the same via access to a PostgreSQL TCP socket.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.", "references": ["https://www.postgresql.org/support/security/CVE-2026-6479/", "https://nvd.nist.gov/vuln/detail/CVE-2026-6479"], "fixes": ["17.10-0ubuntu0.25.10.1"], "products": [{"name": "postgresql-17", "path": "vulns/ubuntu-25.10/postgresql-17", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-6478", "noindex": false, "published": "2026-05-14T13:00:13.174Z", "modified": "2026-08-25T12:05:38.739Z", "cvss": 6.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00558, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-6478", "title": "PostgreSQL discloses MD5-hashed passwords via covert timing channel", "description": "Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate.  This does not affect scram-sha-256 passwords, the default in all supported releases.  However, current databases may have MD5-hashed passwords originating in upgrades from PostgreSQL 13 or earlier.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.", "references": ["https://www.postgresql.org/support/security/CVE-2026-6478/", "https://access.redhat.com/security/cve/CVE-2026-6478", "https://bugzilla.redhat.com/show_bug.cgi?id=2477447"], "fixes": ["17.10-0ubuntu0.25.10.1"], "products": [{"name": "postgresql-17", "path": "vulns/ubuntu-25.10/postgresql-17", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-6477", "noindex": false, "published": "2026-05-14T13:00:12.497Z", "modified": "2026-08-25T12:05:44.549Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00454, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-6477", "title": "PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory", "description": "Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a client stack buffer with an arbitrarily-large response.  Like gets(), PQfn(..., result_is_int=0, ...) stores arbitrary-length, server-determined data into a buffer of unspecified size.  Because both the \\lo_export command in psql and pg_dump call lo_read(), the server superuser can overwrite pg_dump or psql stack memory.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.", "references": ["https://www.postgresql.org/support/security/CVE-2026-6477/", "https://access.redhat.com/security/cve/CVE-2026-6477", "https://bugzilla.redhat.com/show_bug.cgi?id=2477442"], "fixes": ["17.10-0ubuntu0.25.10.1"], "products": [{"name": "postgresql-17", "path": "vulns/ubuntu-25.10/postgresql-17", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-6476", "noindex": false, "published": "2026-05-14T13:00:11.865Z", "modified": "2026-05-15T03:56:17.580Z", "cvss": 7.2, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00287, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-6476", "title": "PostgreSQL pg_createsubscriber allows SQL injection via subscription name", "description": "SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser.  The attack takes effect when pg_createsubscriber next runs.  Within major versions 17 and 18, minor versions before PostgreSQL 18.4 and 17.10 are affected.  Versions before PostgreSQL 17 are unaffected.", "references": ["https://www.postgresql.org/support/security/CVE-2026-6476/", "https://nvd.nist.gov/vuln/detail/CVE-2026-6476"], "fixes": ["17.10-0ubuntu0.25.10.1"], "products": [{"name": "postgresql-17", "path": "vulns/ubuntu-25.10/postgresql-17", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-6475", "noindex": false, "published": "2026-05-14T13:00:11.039Z", "modified": "2026-05-15T03:56:16.367Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.0041, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-6475", "title": "PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice", "description": "Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system account.  It will remain the case that starting the server after these commands implicitly trusts the origin superuser, due to features like shared_preload_libraries.  Hence, the attack has practical implications only if one takes relevant action between these commands and server start, like moving the files to a different VM or snapshotting the VM.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.", "references": ["https://www.postgresql.org/support/security/CVE-2026-6475/", "https://nvd.nist.gov/vuln/detail/CVE-2026-6475"], "fixes": ["17.10-0ubuntu0.25.10.1"], "products": [{"name": "postgresql-17", "path": "vulns/ubuntu-25.10/postgresql-17", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-6474", "noindex": false, "published": "2026-05-14T13:00:10.254Z", "modified": "2026-05-14T15:30:37.425Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00214, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-6474", "title": "PostgreSQL timeofday() can disclose portions of server memory", "description": "Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.", "references": ["https://www.postgresql.org/support/security/CVE-2026-6474/", "https://nvd.nist.gov/vuln/detail/CVE-2026-6474"], "fixes": ["17.10-0ubuntu0.25.10.1"], "products": [{"name": "postgresql-17", "path": "vulns/ubuntu-25.10/postgresql-17", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-6473", "noindex": false, "published": "2026-05-14T13:00:09.446Z", "modified": "2026-08-25T12:05:44.149Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.01006, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-6473", "title": "PostgreSQL server undersizes allocations, via integer wraparound", "description": "Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds.  This may execute arbitrary code as the operating system user running the database.  In applications that pass gigabyte-scale user inputs to the relevant database functions, the application input provider may achieve a segmentation fault.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.", "references": ["https://www.postgresql.org/support/security/CVE-2026-6473/", "https://access.redhat.com/security/cve/CVE-2026-6473", "https://bugzilla.redhat.com/show_bug.cgi?id=2477448"], "fixes": ["17.10-0ubuntu0.25.10.1"], "products": [{"name": "postgresql-17", "path": "vulns/ubuntu-25.10/postgresql-17", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-6472", "noindex": false, "published": "2026-05-14T13:00:02.086Z", "modified": "2026-05-14T13:43:48.103Z", "cvss": 5.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N", "severity": "medium", "epss": 0.00159, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-6472", "title": "PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege", "description": "Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types.  That is to say, the victim will execute arbitrary SQL functions of the attacker's choice.  Versions before PostgreSQL 18.4, 17.10, 16.14, 15.18, and 14.23 are affected.", "references": ["https://www.postgresql.org/support/security/CVE-2026-6472/", "https://nvd.nist.gov/vuln/detail/CVE-2026-6472"], "fixes": ["17.10-0ubuntu0.25.10.1"], "products": [{"name": "postgresql-17", "path": "vulns/ubuntu-25.10/postgresql-17", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-2006", "noindex": false, "published": "2026-02-12T13:00:10.490Z", "modified": "2026-07-15T01:20:50.985Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.01162, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-2006", "title": "PostgreSQL missing validation of multibyte character length executes arbitrary code", "description": "Missing validation of multibyte character length in PostgreSQL text manipulation allows a database user to issue crafted queries that achieve a buffer overrun.  That suffices to execute arbitrary code as the operating system user running the database.  Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.", "references": ["https://www.postgresql.org/support/security/CVE-2026-2006/", "https://access.redhat.com/security/cve/CVE-2026-2006", "https://bugzilla.redhat.com/show_bug.cgi?id=2439324"], "fixes": ["17.9-0ubuntu0.25.10.1"], "products": [{"name": "postgresql-17", "path": "vulns/ubuntu-25.10/postgresql-17", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-2005", "noindex": false, "published": "2026-02-12T13:00:09.784Z", "modified": "2026-07-15T01:20:53.978Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.01372, "kev": false, "exploits": ["public-poc"], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-2005", "title": "PostgreSQL pgcrypto heap buffer overflow executes arbitrary code", "description": "Heap buffer overflow in PostgreSQL pgcrypto allows a ciphertext provider to execute arbitrary code as the operating system user running the database.  Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.", "references": ["https://www.postgresql.org/support/security/CVE-2026-2005/", "https://access.redhat.com/security/cve/CVE-2026-2005", "https://bugzilla.redhat.com/show_bug.cgi?id=2439326"], "fixes": ["17.9-0ubuntu0.25.10.1"], "products": [{"name": "postgresql-17", "path": "vulns/ubuntu-25.10/postgresql-17", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-2004", "noindex": false, "published": "2026-02-12T13:00:08.857Z", "modified": "2026-07-15T01:20:56.958Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.01342, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-2004", "title": "PostgreSQL intarray missing validation of type of input to selectivity estimator executes arbitrary code", "description": "Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database.  Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.", "references": ["https://www.postgresql.org/support/security/CVE-2026-2004/", "https://access.redhat.com/security/cve/CVE-2026-2004", "https://bugzilla.redhat.com/show_bug.cgi?id=2439325"], "fixes": ["17.9-0ubuntu0.25.10.1"], "products": [{"name": "postgresql-17", "path": "vulns/ubuntu-25.10/postgresql-17", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2026-2003", "noindex": false, "published": "2026-02-12T13:00:06.108Z", "modified": "2026-02-12T14:33:37.255Z", "cvss": 4.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "medium", "epss": 0.00319, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-2003", "title": "PostgreSQL oidvector discloses a few bytes of memory", "description": "Improper validation of type \"oidvector\" in PostgreSQL allows a database user to disclose a few bytes of server memory.  We have not ruled out viability of attacks that arrange for presence of confidential information in disclosed bytes, but they seem unlikely.  Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.", "references": ["https://www.postgresql.org/support/security/CVE-2026-2003/", "https://nvd.nist.gov/vuln/detail/CVE-2026-2003"], "fixes": ["17.9-0ubuntu0.25.10.1"], "products": [{"name": "postgresql-17", "path": "vulns/ubuntu-25.10/postgresql-17", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-12818", "noindex": false, "published": "2025-11-13T13:00:12.911Z", "modified": "2025-11-13T13:59:33.436Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.00364, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-12818", "title": "PostgreSQL libpq undersizes allocations, via integer wraparound", "description": "Integer wraparound in multiple PostgreSQL libpq client library functions allows an application input provider or network peer to cause libpq to undersize an allocation and write out-of-bounds by hundreds of megabytes.  This results in a segmentation fault for the application using libpq.  Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.", "references": ["https://www.postgresql.org/support/security/CVE-2025-12818/", "https://nvd.nist.gov/vuln/detail/CVE-2025-12818"], "fixes": ["17.7-0ubuntu0.25.10.1"], "products": [{"name": "postgresql-17", "path": "vulns/ubuntu-25.10/postgresql-17", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-12817", "noindex": false, "published": "2025-11-13T13:00:12.160Z", "modified": "2025-11-13T13:59:54.599Z", "cvss": 3.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "severity": "low", "epss": 0.00243, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-12817", "title": "PostgreSQL CREATE STATISTICS does not check for schema CREATE privilege", "description": "Missing authorization in PostgreSQL CREATE STATISTICS command allows a table owner to achieve denial of service against other CREATE STATISTICS users by creating in any schema.  A later CREATE STATISTICS for the same name, from a user having the CREATE privilege, would then fail.  Versions before PostgreSQL 18.1, 17.7, 16.11, 15.15, 14.20, and 13.23 are affected.", "references": ["https://www.postgresql.org/support/security/CVE-2025-12817/", "https://nvd.nist.gov/vuln/detail/CVE-2025-12817"], "fixes": ["17.7-0ubuntu0.25.10.1"], "products": [{"name": "postgresql-17", "path": "vulns/ubuntu-25.10/postgresql-17", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-8715", "noindex": false, "published": "2025-08-14T13:00:07.753Z", "modified": "2026-02-26T17:48:36.521Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00427, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-8715", "title": "PostgreSQL pg_dump newline in object name executes arbitrary code in psql client and in restore target server", "description": "Improper neutralization of newlines in pg_dump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name.  The same attacks can achieve SQL injection as a superuser of the restore target server.  pg_dumpall, pg_restore, and pg_upgrade are also affected.  Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.  Versions before 11.20 are unaffected.  CVE-2012-0868 had fixed this class of problem, but version 11.20 reintroduced it.", "references": ["https://www.postgresql.org/support/security/CVE-2025-8715/", "https://nvd.nist.gov/vuln/detail/CVE-2025-8715"], "fixes": ["17.6-1"], "products": [{"name": "postgresql-17", "path": "vulns/ubuntu-25.10/postgresql-17", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-8714", "noindex": false, "published": "2025-08-14T13:00:07.046Z", "modified": "2026-02-26T17:48:36.907Z", "cvss": 8.8, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "severity": "high", "epss": 0.00762, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-8714", "title": "PostgreSQL pg_dump lets superuser of origin server execute arbitrary code in psql client", "description": "Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands.  pg_dumpall is also affected.  pg_restore is affected when used to generate a plain-format dump.  This is similar to MySQL CVE-2024-21096.  Versions before PostgreSQL 17.6, 16.10, 15.14, 14.19, and 13.22 are affected.", "references": ["https://www.postgresql.org/support/security/CVE-2025-8714/", "https://nvd.nist.gov/vuln/detail/CVE-2025-8714"], "fixes": ["17.6-1"], "products": [{"name": "postgresql-17", "path": "vulns/ubuntu-25.10/postgresql-17", "ecosystem": "Ubuntu:25.10"}]}, {"id": "CVE-2025-8713", "noindex": false, "published": "2025-08-14T13:00:05.807Z", "modified": "2025-08-14T19:51:04.708Z", "cvss": 3.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.00236, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-8713", "title": "PostgreSQL optimizer statistics can expose sampled data within a view, partition, or child table", "description": "PostgreSQL optimizer statistics allow a user to read sampled data within a view that the user cannot access.  Separately, statistics allow a user to read sampled data that a row security policy intended to hide.  PostgreSQL maintains statistics for tables by sampling data available in columns; this data is consulted during the query planning process.  Prior to this release, a user could craft a leaky operator that bypassed view access control lists (ACLs) and bypassed row security policies in partitioning or table inheritance hierarchies.  Reachable statistics data notably included histograms and most-common-values lists.  CVE-2017-7484 and C", "references": ["https://www.postgresql.org/support/security/CVE-2025-8713/", "https://nvd.nist.gov/vuln/detail/CVE-2025-8713"], "fixes": ["17.6-1"], "products": [{"name": "postgresql-17", "path": "vulns/ubuntu-25.10/postgresql-17", "ecosystem": "Ubuntu:25.10"}]}], "total": 20, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 1, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "postgresql-17", "path": "vulns/ubuntu-25.10/postgresql-17", "ecosystem": "Ubuntu:25.10"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-08-25T12:05:44.549Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}