Product by Debian
Postgresql-17
40 known vulnerabilities in Postgresql-17 (Debian), 0 of them actively exploited (CISA KEV).
Key figures
40
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-2005 | PostgreSQL pgcrypto heap buffer overflow executes arbitrary code | 8.8 | |
| High | CVE-2026-2004 | PostgreSQL: Improper Validation of Specified Type of Input | 8.8 | |
| High | CVE-2026-2006 | PostgreSQL missing validation of multibyte character length executes arbitrary code | 8.8 | |
| High | CVE-2026-6473 | PostgreSQL server undersizes allocations, via integer wraparound | 8.8 | |
| High | CVE-2026-16239 | PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code | 8.8 | |
| High | CVE-2026-14669 | PostgreSQL to_char heap buffer overflow executes arbitrary code | 8.8 | |
| High | CVE-2026-15742 | PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound | 8.8 | |
| High | CVE-2026-14662 | PostgreSQL tsvector and tsquery undersize allocations, via integer wraparound | 8.8 | |
| High | CVE-2026-14670 | PostgreSQL plperl tied object heap buffer overflow executes arbitrary code | 8.8 | |
| High | CVE-2026-14664 | PostgreSQL regexp heap buffer overflow executes arbitrary code | 8.8 | |
| High | CVE-2026-15741 | PostgreSQL expression deparse allows SQL injection via EXTRACT argument | 8.8 | |
| High | CVE-2026-19385 | PostgreSQL pg_dump heap buffer overflow executes arbitrary code | 8.8 | |
| High | CVE-2026-14680 | PostgreSQL type confusion via "internal" arguments | 8.8 | |
| High | CVE-2026-14671 | PostgreSQL refint plan cache type confusion executes arbitrary code | 8.8 | |
| High | CVE-2026-14677 | PostgreSQL 32-bit pltcl and plperl undersize allocations, via integer wraparound | 8.8 | |
| High | CVE-2026-6471 | PostgreSQL logical decoding can dlopen arbitrary file | 7.2 | |
| High | CVE-2026-18408 | PostgreSQL: Inclusion of Functionality from Untrusted Control Sphere | 8.8 | |
| High | CVE-2026-6477 | PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory | 8.8 | |
| High | CVE-2026-6479 | PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion | 7.5 | |
| High | CVE-2026-6475 | PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice | 8.8 | |
| High | CVE-2026-6464 | PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands | 8.1 | |
| High | CVE-2026-14668 | PostgreSQL ctid type confusion in selectivity estimator discloses derivative of arbitrary read | 8.1 | |
| High | CVE-2026-6637 | PostgreSQL refint allows stack buffer overflow and SQL injection | 8.8 | |
| High | CVE-2026-14679 | PostgreSQL stack buffer overflow in argument match writes 0x0 and 0x1 to server memory | 8.2 | |
| Medium | CVE-2026-6478 | PostgreSQL discloses MD5-hashed passwords via covert timing channel | 6.5 |