|
851
|
4.3 |
MEDIUM
Network
|
postgresql
|
postgresql
|
Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array. This allows a table maintain…
Update
|
CWE-126
Buffer Over-read
|
CVE-2026-6575
|
2026-05-19 00:04 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
852
|
7.5 |
HIGH
Network
|
postgresql
|
postgresql
|
Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service. If SSL and GSS are both disable…
Update
|
CWE-674
Uncontrolled Recursion
|
CVE-2026-6479
|
2026-05-19 00:04 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
853
|
6.5 |
MEDIUM
Network
|
postgresql
|
postgresql
|
Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate. This does not affect scram-sha-256 …
Update
|
CWE-385
Covert Timing Channel
|
CVE-2026-6478
|
2026-05-19 00:03 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
854
|
8.8 |
HIGH
Network
|
postgresql
|
postgresql
|
Use of inherently dangerous function PQfn(..., result_is_int=0, ...) in PostgreSQL libpq lo_export(), lo_read(), lo_lseek64(), and lo_tell64() functions allows the server superuser to overwrite a cli…
Update
|
CWE-242
Use of Inherently Dangerous Function
|
CVE-2026-6477
|
2026-05-19 00:03 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
855
|
7.2 |
HIGH
Network
|
postgresql
|
postgresql
|
SQL injection in PostgreSQL pg_createsubscriber allows an attacker with pg_create_subscription rights to execute arbitrary SQL as a superuser. The attack takes effect when pg_createsubscriber next r…
Update
|
CWE-89
SQL Injection
|
CVE-2026-6476
|
2026-05-19 00:02 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
856
|
8.8 |
HIGH
Network
|
postgresql
|
postgresql
|
Symlink following in PostgreSQL pg_basebackup plain format and in pg_rewind allows an origin superuser to overwrite local files, e.g. /var/lib/postgres/.bashrc, that hijack the operating system accou…
Update
|
CWE-61
UNIX Symbolic Link (Symlink) Following
|
CVE-2026-6475
|
2026-05-19 00:02 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
857
|
4.3 |
MEDIUM
Network
|
postgresql
|
postgresql
|
Externally-controlled format string in PostgreSQL timeofday() function allows an attacker to retrieve portions of server memory, via crafted timezone zones. Versions before PostgreSQL 18.4, 17.10, 1…
Update
|
CWE-134
Use of Externally-Controlled Format String
|
CVE-2026-6474
|
2026-05-19 00:00 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
858
|
8.8 |
HIGH
Network
|
postgresql
|
postgresql
|
Integer wraparound in multiple PostgreSQL server features allows an unprivileged database user to cause the server to undersize an allocation and write out-of-bounds. This may execute arbitrary code…
Update
|
CWE-190
Integer Overflow or Wraparound
|
CVE-2026-6473
|
2026-05-18 23:59 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
859
|
5.4 |
MEDIUM
Network
|
postgresql
|
postgresql
|
Missing authorization in PostgreSQL CREATE TYPE allows an object creator to hijack other queries that use search_path to find user-defined types, including extension-defined types. That is to say, t…
Update
|
CWE-862
Missing Authorization
|
CVE-2026-6472
|
2026-05-18 23:59 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
|
860
|
6.5 |
MEDIUM
Network
|
grafana
|
grafana
|
The Grafana Live push endpoint can be exploited to cause unbounded memory allocation by sending a large or streaming request body, potentially leading to out-of-memory conditions. An authenticated us…
Update
|
CWE-770
Allocation of Resources Without Limits or Throttling
|
CVE-2026-28376
|
2026-05-18 23:57 |
2026-05-14 |
Show
|
GitHub
Exploit DB
Packet Storm
|
|
|
