Vendor
Pgedge
13 known vulnerabilities in products by Pgedge, 0 of them actively exploited (CISA KEV).
Key figures
13
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
0
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| High | CVE-2026-125327 | pgEdge RAG Server unbounded corpus read allows resource exhaustion from unauthenticated requests | 7.5 | |
| Medium | CVE-2026-125321 | pgEdge Postgres MCP Server login rate limiting can be evaded by a caller-supplied header | 6.5 | |
| High | CVE-2026-126197 | pgEdge Postgres MCP Server SQL injection through custom pl-do tool parameters | 8.8 | |
| High | CVE-2026-126196 | Pgedge-postgres-mcp: SQL Injection | 8.1 | |
| Medium | CVE-2026-125326 | pgEdge RAG Server discloses part of the configured provider credential through API error messages | 5.8 | |
| High | CVE-2026-125323 | pgEdge Control-plane: Missing Authentication for Critical Function | 7.8 | |
| Medium | CVE-2026-125322 | pgEdge Postgres MCP Server SQL injection in the count_rows where parameter | 6.5 | |
| Medium | CVE-2026-126199 | pgEdge Postgres MCP Server write confirmation skipped for writes that begin with a reading keyword | 6.8 | |
| Medium | CVE-2026-50735 | EnterpriseDB pglogical: Out-of-bounds Read | 6.8 | |
| Medium | CVE-2026-125328 | pgEdge Go LLM Library discloses provider API key fragments in error messages | 5.8 | |
| Medium | CVE-2026-125325 | pgEdge RAG Server shared keyword index leaked results between concurrent unauthenticated requests | 5.9 | |
| Medium | CVE-2026-125320 | pgEdge Postgres MCP Server did not validate the Origin header, allowing DNS rebinding | 5.3 | |
| Low | CVE-2026-126198 | pgEdge Postgres MCP Server custom tools performed writes without user confirmation | 3.1 |
Products
| Pgedge-postgres-mcp | 7 | 0 |
| Pgedge-rag-server | 3 | 0 |