CVE-2026-6464: psql COPY FROM STDIN, if the copy fails
before data rows begin, processes the following data lines
as psql commands.
CVE-2026-6469: ALTER TABLE ALTER TYPE incorrectly reassigns
ownership of dependent extended statistics objects to the
current user.
CVE-2026-6470: Missing privilege check for type USAGE allows
denial of service against ALTER and DROP of the type.
CVE-2026-6471: Logical decoding lets a REPLICATION-
privileged user dlopen an arbitrary file via the decoding
plugin choice, running arbitrary code as the server's OS
user.
CVE-2026-14662: Integer wraparound in tsvector and tsquery
functions can undersize an allocation, causing a buffer
overflow and arbitrary code execution.
CVE-2026-14663: pgcrypto silently encrypts to and decrypts
from cleartext for ciphers OpenSSL has disabled, letting an
attacker recover cleartext.
CVE-2026-14664: Heap buffer overflow in the regexp engine
allows arbitrary code execution via crafted input text.
CVE-2026-14666: Row-level security policy caching can retain
a stale policy after role changes, letting a user complete
now-forbidden reads or writes.
CVE-2026-14668: Type confusion in the ctid selectivity
estimator discloses a derivative of an arbitrary 4-byte span
of server memory.
CVE-2026-14669: Heap buffer overflow in to_char(timestamptz)
via a long POSIX timezone abbreviation allows arbitrary code
execution.
CVE-2026-14670: Heap buffer overflow in plperl, on return of
a tied hash, allows the function owner to execute arbitrary
code.
CVE-2026-14671: Type confusion in module "refint" allows an
object creator to execute arbitrary code.
CVE-2026-14672: SCRAM authentication reveals whether a role
exists via an observable difference in the reported
iteration count.
CVE-2026-14673: amcheck fails to clear an untrusted search
path, letting an EXECUTE grantee run arbitrary functions as
an expression index's owner.
CVE-2026-14676: Heap buffer overflow in pg_stat_statements
via crafted queries with array constants allows arbitrary
code execution.
CVE-2026-14677: Integer wraparound in 32-bit pltcl/plperl
builds can undersize an allocation, allowing arbitrary code
execution.
CVE-2026-14678: pg_trgm's picksplit function reads past the
end of a heap buffer, potentially disclosing limited memory.
CVE-2026-14679: Stack buffer overflow in argument-name
matching lets an object creator write a few attacker-
influenced bytes into server memory.
CVE-2026-14680: Type confusion via "internal"-typed function
arguments allows any user to execute arbitrary code.
CVE-2026-14681: GSSAPI encryption is not properly enforced
when coupled with an initial direct SSL connection.
CVE-2026-15741: Expression deparse of EXTRACT() allows SQL
injection via a hostile object definition, affecting pg_dump
and psql.
CVE-2026-15742: Integer wraparound in fuzzystrmatch's
levenshtein() functions allows writes to arbitrary addresses
and code execution.
CVE-2026-16238: Type confusion in
pg_restore_attribute_stats() allows arbitrary code execution
via conflated range/multirange values.
CVE-2026-16239: Type confusion via cursor DECLARE and CLOSE
allows a user to execute arbitrary code.
CVE-2026-16241: Integer underflow in ECPG can crash the
client via a bytea value lacking its mandatory prefix.
CVE-2026-18024: The ascii() function reads past the end of a
buffer, disclosing a few bytes of server memory.
CVE-2026-18408: psql's \unrestrict lets a malicious pg_dump
origin-server superuser execute arbitrary code in the
restoring client.
CVE-2026-19385: Heap buffer overflow in pg_dump, when
dumping long function transform lists, allows arbitrary code
execution.