VULN/vuln-cve
1
0 Fork 0
Code Pull Requests Actions Activity

CVE sync 2026-11-12T15:29:40Z

Browse Source
This commit is contained in:
Vulnerability Bot committed 2026-11-12 16:29:45 +01:00
1 parent 24315563e6
commit 8e4c58cd15
100 files changed
+8559 -1269
Download Patch File Download Diff File Expand all files Collapse all files

No files matched your search

data/2026/109xxx/CVE-2026-109582.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "jpcert",
"dateReserved": "2026-10-21T00:41:10.947Z",
"datePublished": "2026-11-09T07:56:55.020Z",
"dateUpdated": "2026-11-09T07:56:55.020Z"
"dateUpdated": "2026-11-12T14:44:28.218Z"
},
"containers": {
"cna": {
@@ -90,6 +90,40 @@
"shortName": "jpcert",
"dateUpdated": "2026-11-09T07:56:55.020Z"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:42:35.682111Z",
"id": "CVE-2026-109582",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:44:28.218Z"
}
}
]
}
}
data/2026/111xxx/CVE-2026-111395.json
+49 -1
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apache",
"dateReserved": "2026-10-15T23:36:49.102Z",
"datePublished": "2026-11-09T09:18:35.415Z",
"dateUpdated": "2026-11-09T10:09:34.312Z"
"dateUpdated": "2026-11-12T15:00:11.009Z"
},
"containers": {
"cna": {
@@ -123,6 +123,54 @@
"shortName": "CVE",
"dateUpdated": "2026-11-09T10:09:34.312Z"
}
},
{
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.2,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "HIGH",
"privilegesRequired": "NONE",
"confidentialityImpact": "NONE"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T15:00:06.238943Z",
"id": "CVE-2026-111395",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T15:00:11.009Z"
}
}
]
}
data/2026/111xxx/CVE-2026-111452.json
+49 -1
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apache",
"dateReserved": "2026-10-16T04:01:34.801Z",
"datePublished": "2026-11-09T09:12:05.040Z",
"dateUpdated": "2026-11-09T13:04:43.990Z"
"dateUpdated": "2026-11-12T14:55:49.574Z"
},
"containers": {
"cna": {
@@ -139,6 +139,54 @@
"shortName": "CVE",
"dateUpdated": "2026-11-09T10:09:36.852Z"
}
},
{
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:55:32.691442Z",
"id": "CVE-2026-111452",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:55:49.574Z"
}
}
]
}
data/2026/111xxx/CVE-2026-111454.json
+49 -1
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apache",
"dateReserved": "2026-10-16T04:01:37.703Z",
"datePublished": "2026-11-09T09:07:30.929Z",
"dateUpdated": "2026-11-10T17:22:56.784Z"
"dateUpdated": "2026-11-12T14:52:39.041Z"
},
"containers": {
"cna": {
@@ -139,6 +139,54 @@
"shortName": "CVE",
"dateUpdated": "2026-11-09T09:11:01.401Z"
}
},
{
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:52:26.201708Z",
"id": "CVE-2026-111454",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:52:39.041Z"
}
}
]
}
data/2026/111xxx/CVE-2026-111455.json
+49 -1
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apache",
"dateReserved": "2026-10-16T04:01:39.077Z",
"datePublished": "2026-11-09T09:06:33.573Z",
"dateUpdated": "2026-11-09T09:07:20.025Z"
"dateUpdated": "2026-11-12T14:50:20.913Z"
},
"containers": {
"cna": {
@@ -123,6 +123,54 @@
"shortName": "CVE",
"dateUpdated": "2026-11-09T09:07:20.025Z"
}
},
{
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
"integrityImpact": "HIGH",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "NONE"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:50:12.882916Z",
"id": "CVE-2026-111455",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:50:20.913Z"
}
}
]
}
data/2026/113xxx/CVE-2026-113437.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "jpcert",
"dateReserved": "2026-10-21T00:41:11.830Z",
"datePublished": "2026-11-09T07:57:09.421Z",
"dateUpdated": "2026-11-09T07:57:09.421Z"
"dateUpdated": "2026-11-12T14:45:29.778Z"
},
"containers": {
"cna": {
@@ -119,6 +119,40 @@
"shortName": "jpcert",
"dateUpdated": "2026-11-09T07:57:09.421Z"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:45:11.683910Z",
"id": "CVE-2026-113437",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:45:29.778Z"
}
}
]
}
}
data/2026/113xxx/CVE-2026-113572.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "adobe",
"dateReserved": "2026-10-20T11:12:04.769Z",
"datePublished": "2026-11-10T21:19:41.799Z",
"dateUpdated": "2026-11-10T21:19:41.799Z"
"dateUpdated": "2026-11-12T15:03:54.443Z"
},
"containers": {
"cna": {
@@ -132,6 +132,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T15:03:46.798519Z",
"id": "CVE-2026-113572",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T15:03:54.443Z"
}
}
]
}
}
data/2026/116xxx/CVE-2026-116303.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116303",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.051Z",
"datePublished": "2026-11-12T14:15:01.762Z",
"dateUpdated": "2026-11-12T14:15:01.762Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:01.762Z"
},
"title": "PostgreSQL foreign key and JSON conversions bypass EXECUTE privilege on cast functions",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Missing authorization in PostgreSQL type conversion allows a database user to invoke a cast function despite lacking EXECUTE privilege on that function, via foreign keys, to_json(), and others. A successful attack requires the attacker to search each database for access-restricted cast functions and identify confidentiality impact specific to each function implementation found. There are few or no practical examples of an access-restricted cast function or of a cast function having confidentiality impact. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-862",
"type": "CWE",
"description": "Missing Authorization"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116303/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 3.1,
"baseSeverity": "LOW"
}
}
],
"configurations": [
{
"lang": "en",
"value": "a cast function has revoked public access (no examples known), and calling it has confidentiality impact (independently, no examples known)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Filip Janus and Anthropic OSS program for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116304.json
+115
View File
@@ -0,0 +1,115 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116304",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.051Z",
"datePublished": "2026-11-12T14:15:02.654Z",
"dateUpdated": "2026-11-12T14:15:02.654Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:02.654Z"
},
"title": "PostgreSQL parallel RECORD typmod use-after-free executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Use after free in PostgreSQL coordination of anonymous RECORD type identifiers among parallel workers allows a database user to execute arbitrary code as the operating system user running the database, via causing one process to free a shared tuple descriptor while another process retains and later uses its address. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-416",
"type": "CWE",
"description": "Use After Free"
}
]
},
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-843",
"type": "CWE",
"description": "Access of Resource Using Incompatible Type ('Type Confusion')"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116304/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Peter Geoghegan for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116306.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116306",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.051Z",
"datePublished": "2026-11-12T14:15:03.245Z",
"dateUpdated": "2026-11-12T14:15:03.245Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:03.245Z"
},
"title": "PostgreSQL composite-type change during field assignment executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL composite-value field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via changing a composite type between deforming and reforming a value. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-843",
"type": "CWE",
"description": "Access of Resource Using Incompatible Type ('Type Confusion')"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116306/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks OpenAI Codex Security, Bronson Yen, and Mehmet D. INCE for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116307.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116307",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.051Z",
"datePublished": "2026-11-12T14:15:03.906Z",
"dateUpdated": "2026-11-12T14:15:03.906Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:03.906Z"
},
"title": "PostgreSQL plperl prepared-query use-after-free executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via re-entering plperl and freeing a prepared query while an outer invocation is executing it. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-416",
"type": "CWE",
"description": "Use After Free"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116307/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "Attacker has permission to \"CREATE EXTENSION plperl\", or another user previously issued that. Attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)."
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Zheng Yu for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116308.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116308",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.051Z",
"datePublished": "2026-11-12T14:15:04.565Z",
"dateUpdated": "2026-11-12T14:15:04.565Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:04.565Z"
},
"title": "PostgreSQL dict_int reads beyond zero-length tokens",
"x_postgresql": {
"component": "contrib module"
},
"descriptions": [
{
"lang": "en",
"value": "Buffer over-read in PostgreSQL dict_int allows a database user to disclose portions of server memory, via a zero-length token. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-126",
"type": "CWE",
"description": "Buffer Over-read"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116308/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
}
}
],
"configurations": [
{
"lang": "en",
"value": "Attacker has permission to \"CREATE EXTENSION dict_int\", or another user previously issued that."
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Anthropic OSS program for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116309.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116309",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.052Z",
"datePublished": "2026-11-12T14:15:05.119Z",
"dateUpdated": "2026-11-12T14:15:05.119Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:05.119Z"
},
"title": "PostgreSQL plperl blessed-reference type confusion may execute arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL plperl may allow an object creator to execute arbitrary code, via blessing a non-hash reference into PostgreSQL::InServer::ARRAY. We have not confirmed or ruled out a way to control the pointer sufficiently to achieve security impact, but we are proceeding as though that is possible. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-843",
"type": "CWE",
"description": "Access of Resource Using Incompatible Type ('Type Confusion')"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116309/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "Attacker has permission to \"CREATE EXTENSION plperl\", or another user previously issued that. Attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)."
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Zheng Yu for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116310.json
+87
View File
@@ -0,0 +1,87 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116310",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.052Z",
"datePublished": "2026-11-12T14:15:05.798Z",
"dateUpdated": "2026-11-12T14:15:05.798Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:05.798Z"
},
"title": "PostgreSQL COPY error context uses freed field storage",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Use after free in PostgreSQL COPY FROM error reporting allows a database user to disclose portions of server memory, via a longer input row following an ignored or nullified conversion error. file_fdw reaches the same code path in affected version 18. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-416",
"type": "CWE",
"description": "Use After Free"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116310/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
}
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks 안지용 for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116311.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116311",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.052Z",
"datePublished": "2026-11-12T14:15:06.390Z",
"dateUpdated": "2026-11-12T14:15:06.390Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:06.390Z"
},
"title": "PostgreSQL DROP OWNED can remove restrictive row security policies from non-owned tables",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Missing authorization in PostgreSQL DROP OWNED allows a role to remove itself from restrictive row level security policies, thereby reading or modifying rows that the policy was intended to deny, via queries after the DROP OWNED. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-862",
"type": "CWE",
"description": "Missing Authorization"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116311/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM"
}
}
],
"configurations": [
{
"lang": "en",
"value": "a restrictive row level security policy on a non-attacker-owned table applies to the attacker"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Zsolt Parragi and Anthropic OSS program for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116312.json
+105
View File
@@ -0,0 +1,105 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116312",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.052Z",
"datePublished": "2026-11-12T14:15:06.946Z",
"dateUpdated": "2026-11-12T14:15:06.946Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:06.946Z"
},
"title": "PostgreSQL MERGE can place the wrong row in a trigger transition table",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Inconsistent transition-capture state in PostgreSQL MERGE allows a table data modifier to make an AFTER trigger process the wrong new row, via a partitioned table MERGE that performs an INSERT before an UPDATE. Within major versions 15-18, minor versions before PostgreSQL 18.7, 17.12, 16.16, and 15.20 are affected. Versions before PostgreSQL 15 are unaffected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-1250",
"type": "CWE",
"description": "Improper Preservation of Consistency Between Independent Representations of Shared State"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116312/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM"
}
}
],
"configurations": [
{
"lang": "en",
"value": "a partitioned table has an AFTER UPDATE statement trigger with a transition table"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Jacek Bylina, Timothy Ball, Jacob Robertson, Nigel Gott, and Claude and Ada Logics for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116313.json
+87
View File
@@ -0,0 +1,87 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116313",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.052Z",
"datePublished": "2026-11-12T14:15:07.627Z",
"dateUpdated": "2026-11-12T14:15:07.627Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:07.627Z"
},
"title": "PostgreSQL \"vacuumdb --missing-stats-only\" lets a database owner execute code as the vacuumdb user",
"x_postgresql": {
"component": "client"
},
"descriptions": [
{
"lang": "en",
"value": "Untrusted search path in PostgreSQL vacuumdb allows a database owner to execute arbitrary SQL as the database user running vacuumdb, via shadowing operators used in the --missing-stats-only catalog query. The pg_upgrade documentation recommends an affected vacuumdb invocation. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-426",
"type": "CWE",
"description": "Untrusted Search Path"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116313/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.2,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "attacker owns the database; victim runs vacuumdb with --missing-stats-only against that database"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Anthropic OSS program for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116314.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116314",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.052Z",
"datePublished": "2026-11-12T14:15:08.184Z",
"dateUpdated": "2026-11-12T14:15:08.184Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:08.184Z"
},
"title": "PostgreSQL pg_restore executes arbitrary code due to missing non-plain archive validation",
"x_postgresql": {
"component": "client"
},
"descriptions": [
{
"lang": "en",
"value": "Improper input validation in PostgreSQL pg_restore allows a non-plain archive provider to execute arbitrary code as the operating system user running pg_restore, via a crafted archive. Note a contrast: crafted archive data may legitimately cause arbitrary SQL to execute at the restore destination, but it does not legitimately confer arbitrary code execution in the pg_restore OS process. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-20",
"type": "CWE",
"description": "Improper Input Validation"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116314/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "victim runs pg_restore on an attacker-crafted archive"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Dilip Kumar, Yonghwa Lee, OpenSec, and Ben Dixon for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116315.json
+105
View File
@@ -0,0 +1,105 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116315",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.052Z",
"datePublished": "2026-11-12T14:15:08.773Z",
"dateUpdated": "2026-11-12T14:15:08.773Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:08.773Z"
},
"title": "PostgreSQL tsvector_delete() heap buffer overflow executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Heap-based buffer overflow in PostgreSQL tsvector_delete() allows a database user to execute arbitrary code as the operating system user running the database, via a tsvector whose lexeme data uses a nonstandard but valid ordering that requires additional alignment padding in the result. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-122",
"type": "CWE",
"description": "Heap-based Buffer Overflow"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116315/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Anthropic OSS program for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116316.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116316",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.052Z",
"datePublished": "2026-11-12T14:15:09.406Z",
"dateUpdated": "2026-11-12T14:15:09.406Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:09.406Z"
},
"title": "PostgreSQL security-restricted operations can create types in pg_temp, which later queries of the session find",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Improper protection of alternate path in PostgreSQL security-restricted operations allows an object creator to execute arbitrary SQL as the operation's caller, via a domain, enum, or range type created in pg_temp. The victim session must later run a query containing an unqualified type name, e.g. \"SELECT '1'::bigint\"; autovacuum and other common security-restricted operation users do not do so, so they are unaffected. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-424",
"type": "CWE",
"description": "Improper Protection of Alternate Path"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116316/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "victim session runs a security-restricted operation, then a regular query with unqualified type names"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Anthropic OSS program for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116317.json
+105
View File
@@ -0,0 +1,105 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116317",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.052Z",
"datePublished": "2026-11-12T14:15:09.968Z",
"dateUpdated": "2026-11-12T14:15:09.968Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:09.968Z"
},
"title": "PostgreSQL ts_rank_cd() heap buffer overflow may execute arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Heap-based buffer overflow in PostgreSQL ts_rank_cd() may allow a database user to execute arbitrary code as the operating system user running the database, via an invalid tsvector containing duplicate positions. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-122",
"type": "CWE",
"description": "Heap-based Buffer Overflow"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116317/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Anthropic OSS program for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116318.json
+87
View File
@@ -0,0 +1,87 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116318",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.052Z",
"datePublished": "2026-11-12T14:15:10.532Z",
"dateUpdated": "2026-11-12T14:15:10.532Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:10.532Z"
},
"title": "PostgreSQL pg_dump not-null constraint name allows SQL injection",
"x_postgresql": {
"component": "client"
},
"descriptions": [
{
"lang": "en",
"value": "SQL injection in PostgreSQL pg_dump allows an object creator to execute arbitrary SQL as the user restoring the dump, via an inherited column having a child-local not-null constraint whose name requires quoting. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-89",
"type": "CWE",
"description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116318/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create non-temporary objects in at least one schema"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Anthropic OSS program, Sarath Kumar, and Nikolay Samokhvalov for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116319.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116319",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.052Z",
"datePublished": "2026-11-12T14:15:11.112Z",
"dateUpdated": "2026-11-12T14:15:11.112Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:11.112Z"
},
"title": "PostgreSQL plperl reentrant return_next() use-after-free executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via reentrant return_next() calls. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-416",
"type": "CWE",
"description": "Use After Free"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116319/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "Attacker has permission to \"CREATE EXTENSION plperl\", or another user previously issued that. Attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)."
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Anthropic OSS program for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116320.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116320",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.052Z",
"datePublished": "2026-11-12T14:15:11.698Z",
"dateUpdated": "2026-11-12T14:15:11.698Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:11.698Z"
},
"title": "PostgreSQL plperl array and hash conversion use-after-free executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Use after free in PostgreSQL plperl allows an object creator to execute arbitrary code as the operating system user running the database, via dropping the final reference to a Perl array or hash while PostgreSQL is converting that object. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-416",
"type": "CWE",
"description": "Use After Free"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116320/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "Attacker has permission to \"CREATE EXTENSION plperl\", or another user previously issued that. Attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)."
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Anthropic OSS program for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116321.json
+105
View File
@@ -0,0 +1,105 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116321",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.053Z",
"datePublished": "2026-11-12T14:15:12.297Z",
"dateUpdated": "2026-11-12T14:15:12.297Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:12.297Z"
},
"title": "PostgreSQL unterminated name value discloses server memory",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Improper null termination in PostgreSQL array element assignment allows a database user to disclose server memory, via changing the final byte of a fixed-length name value to a nonzero byte and passing it to code that treats the value as a C string. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-170",
"type": "CWE",
"description": "Improper Null Termination"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116321/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
}
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Anthropic OSS program for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116322.json
+81
View File
@@ -0,0 +1,81 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116322",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.053Z",
"datePublished": "2026-11-12T14:15:12.887Z",
"dateUpdated": "2026-11-12T14:15:12.887Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:12.887Z"
},
"title": "PostgreSQL pre-authentication cancel request can leak a spinlock",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Improper locking in PostgreSQL startup processing allows an unauthenticated network client to trigger a server restart, via arranging for authentication_timeout to arrive while it holds a spinlock during cancel handling. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-667",
"type": "CWE",
"description": "Improper Locking"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116322/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"baseScore": 5.3,
"baseSeverity": "MEDIUM"
}
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Anthropic OSS program for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116323.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116323",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.053Z",
"datePublished": "2026-11-12T14:15:13.913Z",
"dateUpdated": "2026-11-12T14:15:13.913Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:13.913Z"
},
"title": "PostgreSQL pltcl reentrant result conversion use-after-free executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Use after free in PostgreSQL pltcl allows an object creator to execute arbitrary code as the operating system user running the database, via a domain CHECK that re-enters the Tcl interpreter and frees or changes a string still used by the outer result conversion. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-416",
"type": "CWE",
"description": "Use After Free"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116323/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "Attacker has permission to \"CREATE EXTENSION pltcl\", or another user previously issued that. Attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)."
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Anthropic OSS program for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116325.json
+93
View File
@@ -0,0 +1,93 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116325",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.053Z",
"datePublished": "2026-11-12T14:15:14.469Z",
"dateUpdated": "2026-11-12T14:15:14.469Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:14.469Z"
},
"title": "PostgreSQL reindexdb index name quoting allows SQL injection",
"x_postgresql": {
"component": "client"
},
"descriptions": [
{
"lang": "en",
"value": "SQL injection in PostgreSQL reindexdb allows an object creator to execute arbitrary SQL as the database user running reindexdb, via a crafted index name embedded in the parallel catalog query for --jobs with --index. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-89",
"type": "CWE",
"description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116325/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "victim runs reindexdb with --jobs and --index for an attacker-named index"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Anthropic OSS program for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116326.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116326",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.053Z",
"datePublished": "2026-11-12T14:15:15.067Z",
"dateUpdated": "2026-11-12T14:15:15.067Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:15.067Z"
},
"title": "PostgreSQL plperl tied-object exceptions follow stale sigjmp_buf",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Uncaught exceptions in PostgreSQL plperl allow an object creator to cause use of a stale sigjmp_buf, via a tied Perl object, or a Perl object whose overloaded conversion throws while plperl is handling another error. We have not ruled out arbitrary code execution on some platform. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-672",
"type": "CWE",
"description": "Operation on a Resource after Expiration or Release"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116326/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "Attacker has permission to \"CREATE EXTENSION plperl\", or another user previously issued that. Attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)."
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Dwij Mehta, Ngoc Trần, and Anthropic OSS program for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116327.json
+105
View File
@@ -0,0 +1,105 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116327",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.053Z",
"datePublished": "2026-11-12T14:15:15.661Z",
"dateUpdated": "2026-11-12T14:15:15.661Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:15.661Z"
},
"title": "PostgreSQL security_barrier analysis can expose hidden values through indirect expressions",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Exposure of sensitive information in PostgreSQL security_barrier processing allows a database user to infer values hidden by a security_barrier view, via applying a leaky function to a CASE test value or internal parameter that indirectly represents a protected column. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-862",
"type": "CWE",
"description": "Missing Authorization"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116327/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
}
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Only see myself for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116328.json
+93
View File
@@ -0,0 +1,93 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116328",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.054Z",
"datePublished": "2026-11-12T14:15:16.239Z",
"dateUpdated": "2026-11-12T14:15:16.239Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:16.239Z"
},
"title": "PostgreSQL generation memory context integer wraparound executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user running the database, via freeing an allocation larger than 1 GB and causing its block to be reused for smaller chunks whose back-pointer offset cannot represent that position. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-190",
"type": "CWE",
"description": "Integer Overflow or Wraparound"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116328/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Jayden Sarveshkumar for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116329.json
+87
View File
@@ -0,0 +1,87 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116329",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.054Z",
"datePublished": "2026-11-12T14:15:16.818Z",
"dateUpdated": "2026-11-12T14:15:16.818Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:16.818Z"
},
"title": "PostgreSQL statistics import type confusion executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL statistics import allows a table maintainer to execute arbitrary code as the operating system user running the database, via nested SET DATA TYPE during conversion of values to import. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-843",
"type": "CWE",
"description": "Access of Resource Using Incompatible Type ('Type Confusion')"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116329/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Mehmet D. INCE for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116330.json
+117
View File
@@ -0,0 +1,117 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116330",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.054Z",
"datePublished": "2026-11-12T14:15:17.385Z",
"dateUpdated": "2026-11-12T14:15:17.385Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:17.385Z"
},
"title": "PostgreSQL pg_dump tar restore.sql fails to block psql command injection",
"x_postgresql": {
"component": "client"
},
"descriptions": [
{
"lang": "en",
"value": "Untrusted data inclusion in PostgreSQL pg_dump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in restore.sql. This is a gap in the fix for CVE-2025-8714. restore.sql is undocumented. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-829",
"type": "CWE",
"description": "Inclusion of Functionality from Untrusted Control Sphere"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116330/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "victim runs psql on restore.sql from a tar-format dump of an attacker-controlled origin server"
}
],
"workarounds": [
{
"lang": "en",
"value": "use pg_restore instead of running restore.sql"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Pavel Kopylov for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116331.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116331",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.054Z",
"datePublished": "2026-11-12T14:15:17.983Z",
"dateUpdated": "2026-11-12T14:15:17.983Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:17.983Z"
},
"title": "PostgreSQL min/max aggregate type confusion executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL min/max aggregate optimization allows an object creator to execute arbitrary code as the operating system user running the database, via a user-defined aggregate whose SORTOP option causes the planner to treat the aggregate's input and result as the same type when they differ. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-843",
"type": "CWE",
"description": "Access of Resource Using Incompatible Type ('Type Confusion')"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116331/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Zheng Yu for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116332.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116332",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T03:52:44.054Z",
"datePublished": "2026-11-12T14:15:18.550Z",
"dateUpdated": "2026-11-12T14:15:18.550Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:18.550Z"
},
"title": "PostgreSQL portal setup use-after-free executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Use after free in PostgreSQL portal setup allows an object creator to execute arbitrary code as the operating system user running the database, via running user-defined code during planning or executor startup that closes the portal currently being prepared. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-416",
"type": "CWE",
"description": "Use After Free"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116332/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Tomas Vondra for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116333.json
+93
View File
@@ -0,0 +1,93 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116333",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T04:01:48.585Z",
"datePublished": "2026-11-12T14:15:19.133Z",
"dateUpdated": "2026-11-12T14:15:19.133Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:19.133Z"
},
"title": "PostgreSQL parallel B-tree array scan reads beyond array bounds",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Buffer over-read in PostgreSQL parallel B-tree scans allows an object creator to read attacker-chosen server-memory addresses, via a function incorrectly marked PARALLEL SAFE or STABLE to make participating workers build different scan-key arrays. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-126",
"type": "CWE",
"description": "Buffer Over-read"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116333/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"baseScore": 6.5,
"baseSeverity": "MEDIUM"
}
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Claude and Ada Logics for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116335.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116335",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T04:01:48.586Z",
"datePublished": "2026-11-12T14:15:19.796Z",
"dateUpdated": "2026-11-12T14:15:19.796Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:19.796Z"
},
"title": "PostgreSQL commutator or negator result-type confusion executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating system user running the database, via linking operators having different result types or creating inconsistent reciprocal links. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-843",
"type": "CWE",
"description": "Access of Resource Using Incompatible Type ('Type Confusion')"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116335/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Stephan Lipp for reporting this problem."
}
]
}
}
}
data/2026/116xxx/CVE-2026-116336.json
+121
View File
@@ -0,0 +1,121 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-116336",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-26T04:01:48.586Z",
"datePublished": "2026-11-12T14:15:20.347Z",
"dateUpdated": "2026-11-12T14:15:20.347Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:20.347Z"
},
"title": "PostgreSQL REINDEX CONCURRENTLY does not block DROP INDEX during index functions",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system user running the database, via an index expression that issues DROP INDEX. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-843",
"type": "CWE",
"description": "Access of Resource Using Incompatible Type ('Type Confusion')"
}
]
},
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-672",
"type": "CWE",
"description": "Operation on a Resource after Expiration or Release"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-116336/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Florent Saudel for reporting this problem."
}
]
}
}
}
data/2026/118xxx/CVE-2026-118480.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "adobe",
"dateReserved": "2026-10-28T11:11:00.477Z",
"datePublished": "2026-11-10T21:56:44.019Z",
"dateUpdated": "2026-11-10T21:56:44.019Z"
"dateUpdated": "2026-11-12T15:07:52.137Z"
},
"containers": {
"cna": {
@@ -95,6 +95,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T15:07:44.508243Z",
"id": "CVE-2026-118480",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T15:07:52.137Z"
}
}
]
}
}
data/2026/120xxx/CVE-2026-120139.json
+105
View File
@@ -0,0 +1,105 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120139",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-30T22:45:08.382Z",
"datePublished": "2026-11-12T14:15:20.956Z",
"dateUpdated": "2026-11-12T14:15:20.956Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:20.956Z"
},
"title": "PostgreSQL tuple-size integer wraparound executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system user running the database, via oversized tuple data. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-190",
"type": "CWE",
"description": "Integer Overflow or Wraparound"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120139/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Hillai Ben Sasson, Jayden Sarveshkumar, and Mehmet Ince for reporting this problem."
}
]
}
}
}
data/2026/120xxx/CVE-2026-120141.json
+105
View File
@@ -0,0 +1,105 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120141",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-30T22:45:08.382Z",
"datePublished": "2026-11-12T14:15:21.515Z",
"dateUpdated": "2026-11-12T14:15:21.515Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:21.515Z"
},
"title": "PostgreSQL materialized set-returning function type confusion executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system user running the database, via returning rows having different dynamic RECORD return types. json_populate_recordset() is one affected function. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-843",
"type": "CWE",
"description": "Access of Resource Using Incompatible Type ('Type Confusion')"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120141/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Peter Geoghegan for reporting this problem."
}
]
}
}
}
data/2026/120xxx/CVE-2026-120142.json
+93
View File
@@ -0,0 +1,93 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120142",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-30T22:45:08.382Z",
"datePublished": "2026-11-12T14:15:22.150Z",
"dateUpdated": "2026-11-12T14:15:22.150Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:22.150Z"
},
"title": "PostgreSQL dropped-column type confusion executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running the database, via row types having dropped attributes in the same positions but with different widths or alignments. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-843",
"type": "CWE",
"description": "Access of Resource Using Incompatible Type ('Type Confusion')"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120142/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Peter Geoghegan for reporting this problem."
}
]
}
}
}
data/2026/120xxx/CVE-2026-120143.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120143",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-30T22:45:08.383Z",
"datePublished": "2026-11-12T14:15:22.843Z",
"dateUpdated": "2026-11-12T14:15:22.843Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:22.843Z"
},
"title": "PostgreSQL transition-table cursor use-after-free executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the database, via a cursor over a transition table. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-416",
"type": "CWE",
"description": "Use After Free"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120143/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Peter Geoghegan for reporting this problem."
}
]
}
}
}
data/2026/120xxx/CVE-2026-120144.json
+87
View File
@@ -0,0 +1,87 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120144",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-30T22:45:08.383Z",
"datePublished": "2026-11-12T14:15:23.436Z",
"dateUpdated": "2026-11-12T14:15:23.436Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:23.436Z"
},
"title": "PostgreSQL type-cache invalidation gap executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system user running the database, via a composite type change while its cache entry is being populated. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-843",
"type": "CWE",
"description": "Access of Resource Using Incompatible Type ('Type Confusion')"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120144/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Peter Geoghegan for reporting this problem."
}
]
}
}
}
data/2026/120xxx/CVE-2026-120145.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120145",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-30T22:45:08.383Z",
"datePublished": "2026-11-12T14:15:23.991Z",
"dateUpdated": "2026-11-12T14:15:23.991Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:23.991Z"
},
"title": "PostgreSQL logical replication can write to subscriber system catalogs, executing arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running the superuser-owned subscription, via naming a system catalog as a replication target. Only subscriptions owned by a superuser are vulnerable. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-862",
"type": "CWE",
"description": "Missing Authorization"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120145/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "victim has created a superuser-owned subscription to an attacker-controlled publisher"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks qian zhang for reporting this problem."
}
]
}
}
}
data/2026/120xxx/CVE-2026-120146.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120146",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-30T22:45:08.383Z",
"datePublished": "2026-11-12T14:15:24.583Z",
"dateUpdated": "2026-11-12T14:15:24.583Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:24.583Z"
},
"title": "PostgreSQL REASSIGN OWNED bypasses role SET and CREATEDB checks",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role. It also allows reassignment of database ownership without the CREATEDB privilege. The equivalent ALTER ... OWNER commands block this. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-862",
"type": "CWE",
"description": "Missing Authorization"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120146/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
}
}
],
"configurations": [
{
"lang": "en",
"value": "a role grant to the attacker has INHERIT TRUE and SET FALSE, or the attacker could run ALTER DATABASE ... OWNER but for lack of CREATEDB privilege"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Zsolt Parragi for reporting this problem."
}
]
}
}
}
data/2026/120xxx/CVE-2026-120147.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120147",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-30T22:45:08.383Z",
"datePublished": "2026-11-12T14:15:25.141Z",
"dateUpdated": "2026-11-12T14:15:25.141Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:25.141Z"
},
"title": "PostgreSQL dblink reentrant disconnect use-after-free executes arbitrary code",
"x_postgresql": {
"component": "contrib module"
},
"descriptions": [
{
"lang": "en",
"value": "Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running the database, via type conversion code that re-enters dblink and closes a connection whose results an outer dblink call is reading. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-416",
"type": "CWE",
"description": "Use After Free"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120147/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "Superuser previously issued \"CREATE EXTENSION dblink\". Attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)."
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks 안지용 for reporting this problem."
}
]
}
}
}
data/2026/120xxx/CVE-2026-120148.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120148",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-30T22:45:08.383Z",
"datePublished": "2026-11-12T14:15:25.724Z",
"dateUpdated": "2026-11-12T14:15:25.724Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:25.724Z"
},
"title": "PostgreSQL extended-statistics pseudo-type confusion executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the database, via a statistics expression of an anonymous RECORD type whose backend-local type identifier denotes a different row type in another session. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-843",
"type": "CWE",
"description": "Access of Resource Using Incompatible Type ('Type Confusion')"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120148/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"baseScore": 8.1,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Mehmet D. INCE for reporting this problem."
}
]
}
}
}
data/2026/120xxx/CVE-2026-120149.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120149",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-30T22:45:08.383Z",
"datePublished": "2026-11-12T14:15:26.749Z",
"dateUpdated": "2026-11-12T14:15:26.749Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:26.749Z"
},
"title": "PostgreSQL FDW batch-insert mismatch executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied. postgres_fdw can legitimately encounter this when a rule on the remote table expands an INSERT into additional rows. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-122",
"type": "CWE",
"description": "Heap-based Buffer Overflow"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120149/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "Superuser previously issued \"CREATE EXTENSION postgres_fdw\"; attacker has local permission to create objects (temporary objects or non-temporary objects in at least one schema); attacker has remote-server permission to create non-temporary objects in at least one schema."
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Sumedh Pathak and Sven Klemm for reporting this problem."
}
]
}
}
}
data/2026/120xxx/CVE-2026-120150.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120150",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-30T22:45:08.383Z",
"datePublished": "2026-11-12T14:15:27.323Z",
"dateUpdated": "2026-11-12T14:15:27.323Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:27.323Z"
},
"title": "PostgreSQL expanded-record domain-check use-after-free executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user running the database, via repeated checks of a domain over a composite type that cause reuse of a dangling memory-context pointer. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-416",
"type": "CWE",
"description": "Use After Free"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120150/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Claude and Ada Logics for reporting this problem."
}
]
}
}
}
data/2026/120xxx/CVE-2026-120151.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120151",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-30T22:45:08.383Z",
"datePublished": "2026-11-12T14:15:27.877Z",
"dateUpdated": "2026-11-12T14:15:27.877Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:27.877Z"
},
"title": "PostgreSQL plpgsql record-field type confusion executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via a reentrant domain CHECK that changes a RECORD variable's row type while a value is being cast. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-843",
"type": "CWE",
"description": "Access of Resource Using Incompatible Type ('Type Confusion')"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120151/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Claude and Ada Logics for reporting this problem."
}
]
}
}
}
data/2026/120xxx/CVE-2026-120152.json
+93
View File
@@ -0,0 +1,93 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120152",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-30T22:45:08.383Z",
"datePublished": "2026-11-12T14:15:28.444Z",
"dateUpdated": "2026-11-12T14:15:28.444Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:28.444Z"
},
"title": "PostgreSQL pg_show_all_settings() use-after-free discloses memory",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-416",
"type": "CWE",
"description": "Use After Free"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120152/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
}
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Stephan Lipp for reporting this problem."
}
]
}
}
}
data/2026/120xxx/CVE-2026-120153.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120153",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-30T22:45:08.383Z",
"datePublished": "2026-11-12T14:15:29.010Z",
"dateUpdated": "2026-11-12T14:15:29.010Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:29.010Z"
},
"title": "PostgreSQL extension-script substitutions allow SQL injection through object names",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a non-bundled extension with a vulnerable script pattern. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-89",
"type": "CWE",
"description": "Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120153/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.2,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has database-level CREATE privilege, and administrator has installed the files of a vulnerable non-bundled extension"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Anthropic OSS program, Sven Klemm, and Aaron chen for reporting this problem."
}
]
}
}
}
data/2026/120xxx/CVE-2026-120154.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-120154",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-10-30T22:45:08.383Z",
"datePublished": "2026-11-12T14:15:29.579Z",
"dateUpdated": "2026-11-12T14:15:29.579Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:29.579Z"
},
"title": "PostgreSQL INSERT ... ON CONFLICT can read rows despite row security policies",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper writes. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-424",
"type": "CWE",
"description": "Improper Protection of Alternate Path"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-120154/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 4.3,
"baseSeverity": "MEDIUM"
}
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has INSERT, UPDATE, and applicable SELECT privileges on a table with a row security policy"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Peter Geoghegan, Zsolt Parragi, Only see myself, Nicholas Carlini, Joao Detomini, Josef Šimánek, and Qing Xu for reporting this problem."
}
]
}
}
}
data/2026/120xxx/CVE-2026-120386.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "jpcert",
"dateReserved": "2026-11-02T06:51:45.477Z",
"datePublished": "2026-11-09T07:44:40.532Z",
"dateUpdated": "2026-11-09T07:44:40.532Z"
"dateUpdated": "2026-11-12T14:42:10.986Z"
},
"containers": {
"cna": {
@@ -93,6 +93,40 @@
"shortName": "jpcert",
"dateUpdated": "2026-11-09T07:44:40.532Z"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:41:54.838669Z",
"id": "CVE-2026-120386",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:42:10.986Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121350.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "adobe",
"dateReserved": "2026-11-03T11:25:17.009Z",
"datePublished": "2026-11-10T21:30:52.459Z",
"dateUpdated": "2026-11-10T21:30:52.459Z"
"dateUpdated": "2026-11-12T15:10:50.735Z"
},
"containers": {
"cna": {
@@ -186,6 +186,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T15:10:41.129819Z",
"id": "CVE-2026-121350",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T15:10:50.735Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121355.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "adobe",
"dateReserved": "2026-11-03T11:25:17.355Z",
"datePublished": "2026-11-10T21:30:50.152Z",
"dateUpdated": "2026-11-10T21:30:50.152Z"
"dateUpdated": "2026-11-12T15:09:16.558Z"
},
"containers": {
"cna": {
@@ -186,6 +186,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T15:09:03.741862Z",
"id": "CVE-2026-121355",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T15:09:16.558Z"
}
}
]
}
}
data/2026/121xxx/CVE-2026-121912.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "adobe",
"dateReserved": "2026-11-04T11:19:35.160Z",
"datePublished": "2026-11-10T21:30:53.640Z",
"dateUpdated": "2026-11-10T21:30:53.640Z"
"dateUpdated": "2026-11-12T15:12:03.041Z"
},
"containers": {
"cna": {
@@ -186,6 +186,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T15:11:54.955611Z",
"id": "CVE-2026-121912",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T15:12:03.041Z"
}
}
]
}
}
data/2026/122xxx/CVE-2026-122098.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "adobe",
"dateReserved": "2026-11-04T17:33:55.381Z",
"datePublished": "2026-11-10T21:19:41.244Z",
"dateUpdated": "2026-11-10T21:19:41.244Z"
"dateUpdated": "2026-11-12T15:05:51.951Z"
},
"containers": {
"cna": {
@@ -132,6 +132,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T15:05:42.002383Z",
"id": "CVE-2026-122098",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T15:05:51.951Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123259.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "adobe",
"dateReserved": "2026-11-05T18:08:36.763Z",
"datePublished": "2026-11-10T21:56:50.842Z",
"dateUpdated": "2026-11-10T21:56:50.842Z"
"dateUpdated": "2026-11-12T15:06:46.706Z"
},
"containers": {
"cna": {
@@ -131,6 +131,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T15:06:39.599429Z",
"id": "CVE-2026-123259",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T15:06:46.706Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123261.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "adobe",
"dateReserved": "2026-11-05T18:08:36.763Z",
"datePublished": "2026-11-10T21:19:40.094Z",
"dateUpdated": "2026-11-10T21:19:40.094Z"
"dateUpdated": "2026-11-12T15:04:47.816Z"
},
"containers": {
"cna": {
@@ -132,6 +132,40 @@
"x_generator": {
"engine": "cvelib 1.8.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T15:04:38.542063Z",
"id": "CVE-2026-123261",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T15:04:47.816Z"
}
}
]
}
}
data/2026/123xxx/CVE-2026-123790.json
+72
View File
@@ -0,0 +1,72 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-123790",
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"state": "PUBLISHED",
"assignerShortName": "certcc",
"dateReserved": "2026-11-06T14:47:00.908Z",
"datePublished": "2026-11-12T14:48:30.110Z",
"dateUpdated": "2026-11-12T15:13:46.135Z"
},
"containers": {
"cna": {
"title": "Unauthenticated Path Traversal in ComfyUI-Easy-Use Allows Remote Code Execution",
"descriptions": [
{
"lang": "en",
"value": "ComfyUI-Easy-Use version 1.3.6 contains a path traversal vulnerability in the `save_preview()` handler for POST `/easyuse/save/{name}`. The handler checks the source directory before appending a user-supplied filename and allows the request to select the `custom_nodes` directory as a copy destination. An unauthenticated attacker who can reach the ComfyUI server can overwrite an installed custom node’s Python entry point with an uploaded file. When ComfyUI restarts and loads the modified node, the attacker’s code runs with the privileges of the ComfyUI process."
}
],
"source": {
"discovery": "UNKNOWN"
},
"affected": [
{
"vendor": "ComfyUI-Easy-Use",
"product": "ComfyUI-Easy-Use",
"versions": [
{
"status": "affected",
"version": "1.3.6",
"lessThanOrEqual": "1.4.1",
"versionType": "custom"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-22 Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"
}
]
}
],
"references": [
{
"url": "https://github.com/yolain/ComfyUI-Easy-Use"
},
{
"url": "https://blog.nhhoang.io.vn/posts/2026/11/cve-2026-123790-comfyui-easy-use-save-preview-rce/"
},
{
"url": "https://github.com/yolain/ComfyUI-Easy-Use/commit/8a0f2fc412c1c6f9109e9392064800a87a706775"
}
],
"x_generator": {
"engine": "VINCE 4.0.3",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-123790"
},
"providerMetadata": {
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc",
"dateUpdated": "2026-11-12T15:13:46.135Z"
}
}
}
}
data/2026/123xxx/CVE-2026-123867.json
+82 -65
View File
@@ -8,20 +8,59 @@
"assignerShortName": "openjs",
"dateReserved": "2026-11-06T16:16:19.081Z",
"datePublished": "2026-11-11T18:23:12.991Z",
"dateUpdated": "2026-11-11T18:23:12.991Z"
"dateUpdated": "2026-11-12T14:34:33.702Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "ce714d77-add3-4f53-aff5-83d477b104bb",
"shortName": "openjs",
"dateUpdated": "2026-11-11T18:23:12.991Z"
"dateUpdated": "2026-11-12T14:34:33.702Z"
},
"title": "Node.js is vulnerable to a per-host mTLS authorization bypass via a CA-only SNI context failing open to the default CA",
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-295",
"description": "CWE-295 Improper Certificate Validation",
"type": "CWE"
}
]
}
],
"affected": [
{
"vendor": "nodejs",
"product": "node",
"versions": [
{
"status": "affected",
"version": "0.0.0",
"lessThan": "22.23.5",
"versionType": "semver"
},
{
"status": "affected",
"version": "23.0.0",
"lessThan": "24.22.3",
"versionType": "semver"
},
{
"status": "affected",
"version": "25.0.0",
"lessThan": "26.13.1",
"versionType": "semver"
}
],
"defaultStatus": "unaffected"
}
],
"descriptions": [
{
"lang": "en",
"value": "A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with server.addContext(host, { ca: protectedCA }) but no server certificate in that SNI context, the per-host client CA is never installed and the handshake falls back to the default client CA. In src/crypto/crypto_tls.cc, CertCbDone installs the SNI context's CA only when setSniContext succeeds, but setSniContext returns false for a context with no server certificate, so a CA-only SNI context silently keeps the default CA. A client holding a certificate trusted by the default CA, but not the protected CA, can therefore complete mTLS to the protected hostname and read its response even with requestCert and rejectUnauthorized enabled, while a client certified by the protected CA is rejected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.",
"value": "A per-host mutual-TLS authorization bypass in Node.js lets a client authorized for the default hostname reach a protected hostname it is not authorized for. When a TLS server assigns a hostname a different client-certificate CA with `server.addContext(host, { ca: protectedCA })` but no server certificate in that SNI context, the per-host client CA is never installed and the handshake falls back to the default client CA. In `src/crypto/crypto_tls.cc`, `CertCbDone` installs the SNI context's CA only when `setSniContext` succeeds, but `setSniContext` returns `false` for a context with no server certificate, so a CA-only SNI context silently keeps the default CA. A client holding a certificate trusted by the default CA, but not the protected CA, can therefore complete mTLS to the protected hostname and read its response even with `requestCert` and `rejectUnauthorized` enabled, while a client certified by the protected CA is rejected. This vulnerability affects Node.js 26.x, 24.x, and 22.x.",
"supportingMedia": [
{
"type": "text/markdown",
@@ -31,10 +70,46 @@
]
}
],
"references": [
{
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases",
"tags": [
"vendor-advisory"
]
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"metrics": [
{
"format": "CVSS",
"scenarios": [
{
"lang": "en",
"value": "GENERAL"
}
],
"cvssV3_1": {
"version": "3.1",
"attackVector": "NETWORK",
"attackComplexity": "HIGH",
"privilegesRequired": "LOW",
"userInteraction": "NONE",
"scope": "UNCHANGED",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"availabilityImpact": "NONE",
"baseSeverity": "MEDIUM",
"baseScore": 4.2,
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N"
}
}
],
"credits": [
{
"lang": "en",
"value": "aur0r4_glyph",
"value": "Uttkarsh Singh",
"type": "reporter"
},
{
@@ -58,67 +133,9 @@
"type": "coordinator"
}
],
"affected": [
{
"vendor": "nodejs",
"product": "node",
"defaultStatus": "unaffected",
"versions": [
{
"version": "0.0.0",
"status": "affected",
"lessThan": "22.23.5",
"versionType": "semver"
},
{
"version": "23.0.0",
"status": "affected",
"lessThan": "24.22.3",
"versionType": "semver"
},
{
"version": "25.0.0",
"status": "affected",
"lessThan": "26.13.1",
"versionType": "semver"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"type": "CWE",
"cweId": "CWE-295",
"description": "Improper Certificate Validation"
}
]
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_0": {
"version": "3.0",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"baseScore": 4.2,
"baseSeverity": "MEDIUM"
}
}
],
"references": [
{
"url": "https://nodejs.org/en/blog/vulnerability/november-2026-security-releases",
"tags": [
"vendor-advisory"
]
},
{
"url": "https://cna.openjsf.org/security-advisories.html"
}
],
"source": {
"discovery": "UNKNOWN"
},
"x_generator": {
"engine": "nodejs-private/security-release publish-cves"
}
data/2026/123xxx/CVE-2026-123870.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "eclipse",
"dateReserved": "2026-11-06T16:18:10.512Z",
"datePublished": "2026-11-09T09:00:13.022Z",
"dateUpdated": "2026-11-09T09:00:13.022Z"
"dateUpdated": "2026-11-12T14:48:33.436Z"
},
"containers": {
"cna": {
@@ -138,6 +138,48 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"references": [
{
"url": "https://github.com/eclipse-csi/otterdog/security/advisories/GHSA-32xf-7j44-xq72",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:47:57.838315Z",
"id": "CVE-2026-123870",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:48:33.436Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124498.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulDB",
"dateReserved": "2026-11-08T07:57:57.014Z",
"datePublished": "2026-11-08T23:00:25.558Z",
"dateUpdated": "2026-11-08T23:00:25.558Z"
"dateUpdated": "2026-11-12T14:23:01.435Z"
},
"containers": {
"cna": {
@@ -169,6 +169,40 @@
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:19:36.540402Z",
"id": "CVE-2026-124498",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:23:01.435Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124507.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulDB",
"dateReserved": "2026-11-08T10:52:07.791Z",
"datePublished": "2026-11-09T01:00:36.982Z",
"dateUpdated": "2026-11-09T01:00:36.982Z"
"dateUpdated": "2026-11-12T14:27:27.998Z"
},
"containers": {
"cna": {
@@ -335,6 +335,48 @@
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"adp": [
{
"references": [
{
"url": "https://vuldb.com/submit/1035482",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:24:59.555911Z",
"id": "CVE-2026-124507",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:27:27.998Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124551.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulnCheck",
"dateReserved": "2026-11-08T13:43:23.426Z",
"datePublished": "2026-11-08T13:52:34.322Z",
"dateUpdated": "2026-11-08T13:52:34.322Z"
"dateUpdated": "2026-11-12T14:18:44.603Z"
},
"containers": {
"cna": {
@@ -170,6 +170,48 @@
"x_generator": {
"engine": "vulncheck-endgame"
}
}
},
"adp": [
{
"references": [
{
"url": "https://hackmd.io/@hieuPenguinnn/classroomio-course-clone-cross-org-content-exfiltration",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:16:52.655548Z",
"id": "CVE-2026-124551",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:18:44.603Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124555.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulDB",
"dateReserved": "2026-11-08T14:12:14.844Z",
"datePublished": "2026-11-09T02:00:24.957Z",
"dateUpdated": "2026-11-09T02:00:24.957Z"
"dateUpdated": "2026-11-12T14:30:42.751Z"
},
"containers": {
"cna": {
@@ -161,6 +161,48 @@
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"adp": [
{
"references": [
{
"url": "https://vuldb.com/submit/1035488",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:28:14.164778Z",
"id": "CVE-2026-124555",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:30:42.751Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124560.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulDB",
"dateReserved": "2026-11-08T14:46:52.217Z",
"datePublished": "2026-11-09T03:00:30.223Z",
"dateUpdated": "2026-11-09T03:00:30.223Z"
"dateUpdated": "2026-11-12T14:31:45.907Z"
},
"containers": {
"cna": {
@@ -172,6 +172,40 @@
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:31:27.490788Z",
"id": "CVE-2026-124560",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:31:45.907Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124564.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulDB",
"dateReserved": "2026-11-08T14:47:06.763Z",
"datePublished": "2026-11-09T04:00:29.414Z",
"dateUpdated": "2026-11-09T04:00:29.414Z"
"dateUpdated": "2026-11-12T14:32:46.615Z"
},
"containers": {
"cna": {
@@ -162,6 +162,40 @@
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:32:11.510590Z",
"id": "CVE-2026-124564",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:32:46.615Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124568.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulDB",
"dateReserved": "2026-11-08T14:55:18.061Z",
"datePublished": "2026-11-09T05:00:22.396Z",
"dateUpdated": "2026-11-09T05:00:22.396Z"
"dateUpdated": "2026-11-12T14:38:05.605Z"
},
"containers": {
"cna": {
@@ -161,6 +161,40 @@
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:36:57.859891Z",
"id": "CVE-2026-124568",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:38:05.605Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124572.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulDB",
"dateReserved": "2026-11-08T16:50:33.276Z",
"datePublished": "2026-11-09T06:00:36.553Z",
"dateUpdated": "2026-11-09T06:00:36.553Z"
"dateUpdated": "2026-11-12T14:38:58.441Z"
},
"containers": {
"cna": {
@@ -183,6 +183,40 @@
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:38:45.828773Z",
"id": "CVE-2026-124572",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:38:58.441Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124576.json
+44 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "VulDB",
"dateReserved": "2026-11-08T16:59:31.143Z",
"datePublished": "2026-11-09T07:00:23.096Z",
"dateUpdated": "2026-11-09T07:00:23.096Z"
"dateUpdated": "2026-11-12T14:39:41.405Z"
},
"containers": {
"cna": {
@@ -311,6 +311,48 @@
"x_generator": [
"VulDB PVTS v202611"
]
}
},
"adp": [
{
"references": [
{
"url": "https://vuldb.com/submit/1038160",
"tags": [
"exploit"
]
}
],
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:39:21.513940Z",
"id": "CVE-2026-124576",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:39:41.405Z"
}
}
]
}
}
data/2026/124xxx/CVE-2026-124637.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "INCIBE",
"dateReserved": "2026-11-09T08:09:21.010Z",
"datePublished": "2026-11-09T09:15:45.855Z",
"dateUpdated": "2026-11-09T09:15:45.855Z"
"dateUpdated": "2026-11-12T14:56:42.349Z"
},
"containers": {
"cna": {
@@ -140,6 +140,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:56:04.799872Z",
"id": "CVE-2026-124637",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:56:42.349Z"
}
}
]
}
}
data/2026/126xxx/CVE-2026-126996.json
+174
View File
@@ -0,0 +1,174 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126996",
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"state": "PUBLISHED",
"assignerShortName": "VulDB",
"dateReserved": "2026-11-12T07:59:56.922Z",
"datePublished": "2026-11-12T14:15:17.499Z",
"dateUpdated": "2026-11-12T14:15:17.499Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB",
"dateUpdated": "2026-11-12T14:15:17.499Z"
},
"title": "SakanaAI text-to-LoRA Checkpoint Loading model_loading.py get_tokenizer path traversal",
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-22",
"lang": "en",
"description": "Path Traversal"
}
]
}
],
"affected": [
{
"vendor": "SakanaAI",
"product": "text-to-LoRA",
"versions": [
{
"version": "0.0.1",
"status": "affected"
}
],
"cpes": [
"cpe:2.3:a:sakanaai:text-to-lora:*:*:*:*:*:*:*:*"
],
"modules": [
"Checkpoint Loading"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was determined in SakanaAI text-to-LoRA 0.0.1. Affected by this issue is the function get_tokenizer of the file src/hyper_llm_modulator/utils/model_loading.py of the component Checkpoint Loading. Executing a manipulation of the argument base_model_name_or_path can lead to path traversal. The attack may be launched remotely. The exploit has been publicly disclosed and may be utilized. The project was informed of the problem early through an issue report but has not responded yet."
}
],
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"baseScore": 5.3,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"baseSeverity": "MEDIUM"
}
},
{
"cvssV3_1": {
"version": "3.1",
"baseScore": 6.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"baseSeverity": "MEDIUM"
}
},
{
"cvssV3_0": {
"version": "3.0",
"baseScore": 6.3,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"baseSeverity": "MEDIUM"
}
},
{
"cvssV2_0": {
"version": "2.0",
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"
}
}
],
"timeline": [
{
"time": "2026-11-12T00:00:00.000Z",
"lang": "en",
"value": "Advisory disclosed"
},
{
"time": "2026-11-12T01:00:00.000Z",
"lang": "en",
"value": "VulDB entry created"
},
{
"time": "2026-11-12T09:05:03.000Z",
"lang": "en",
"value": "VulDB entry last update"
}
],
"credits": [
{
"lang": "en",
"value": "Dem000 (VulDB User)",
"type": "reporter"
},
{
"lang": "en",
"value": "VulDB CNA Team",
"type": "coordinator"
}
],
"references": [
{
"url": "https://vuldb.com/vuln/436295",
"name": "VDB-436295 | SakanaAI text-to-LoRA Checkpoint Loading model_loading.py get_tokenizer path traversal",
"tags": [
"vdb-entry",
"technical-description"
]
},
{
"url": "https://vuldb.com/vuln/436295/cti",
"name": "VDB-436295 | CTI Indicators (IOB, IOC, TTP, IOA)",
"tags": [
"signature",
"permissions-required"
]
},
{
"url": "https://vuldb.com/cve/CVE-2026-126996",
"name": "CVE-2026-126996 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://vuldb.com/submit/1040637",
"name": "Submit #1040637 | SakanaAI text-to-LoRA 0.0.1 (commit 8ba77493eb8c), vulnerable code unchanged on the main branch as of 2026-10-16 Path Traversal",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://github.com/SakanaAI/text-to-lora/issues/13",
"tags": [
"issue-tracking"
]
},
{
"url": "https://github.com/user-attachments/files/33599890/poc.zip",
"tags": [
"exploit"
]
},
{
"url": "https://github.com/SakanaAI/text-to-lora/",
"tags": [
"product"
]
}
],
"x_generator": [
"VulDB PVTS v202611"
]
}
}
}
data/2026/126xxx/CVE-2026-126997.json
+186
View File
@@ -0,0 +1,186 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126997",
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"state": "PUBLISHED",
"assignerShortName": "VulDB",
"dateReserved": "2026-11-12T08:02:04.098Z",
"datePublished": "2026-11-12T14:30:26.335Z",
"dateUpdated": "2026-11-12T14:30:26.335Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB",
"dateUpdated": "2026-11-12T14:30:26.335Z"
},
"title": "JeecgBoot flow-run Endpoint a.class RestTemplate.exchange server-side request forgery",
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-918",
"lang": "en",
"description": "Server-Side Request Forgery"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "JeecgBoot",
"versions": [
{
"version": "3.9.0",
"status": "affected"
},
{
"version": "3.9.1",
"status": "affected"
},
{
"version": "3.9.2",
"status": "affected"
},
{
"version": "3.9.3",
"status": "affected"
},
{
"version": "3.9.4",
"status": "affected"
},
{
"version": "3.9.5",
"status": "affected"
},
{
"version": "3.9.6",
"status": "affected"
}
],
"cpes": [
"cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:*"
],
"modules": [
"flow-run Endpoint"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A vulnerability was identified in JeecgBoot up to 3.9.6. This affects the function RestTemplate.exchange of the file org/jeecg/modules/airag/flow/c/a.class of the component flow-run Endpoint. The manipulation leads to server-side request forgery. Remote exploitation of the attack is possible. The exploit is publicly available and might be used. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"baseScore": 6.9,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"baseSeverity": "MEDIUM"
}
},
{
"cvssV3_1": {
"version": "3.1",
"baseScore": 7.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"baseSeverity": "HIGH"
}
},
{
"cvssV3_0": {
"version": "3.0",
"baseScore": 7.3,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"baseSeverity": "HIGH"
}
},
{
"cvssV2_0": {
"version": "2.0",
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"
}
}
],
"timeline": [
{
"time": "2026-11-12T00:00:00.000Z",
"lang": "en",
"value": "Advisory disclosed"
},
{
"time": "2026-11-12T01:00:00.000Z",
"lang": "en",
"value": "VulDB entry created"
},
{
"time": "2026-11-12T09:07:11.000Z",
"lang": "en",
"value": "VulDB entry last update"
}
],
"credits": [
{
"lang": "en",
"value": "dptcc (VulDB User)",
"type": "reporter"
},
{
"lang": "en",
"value": "VulDB CNA Team",
"type": "coordinator"
}
],
"references": [
{
"url": "https://vuldb.com/vuln/436296",
"name": "VDB-436296 | JeecgBoot flow-run Endpoint a.class RestTemplate.exchange server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
]
},
{
"url": "https://vuldb.com/vuln/436296/cti",
"name": "VDB-436296 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
]
},
{
"url": "https://vuldb.com/cve/CVE-2026-126997",
"name": "CVE-2026-126997 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://vuldb.com/submit/1040927",
"name": "Submit #1040927 | Jeecg JeecgBoot 3.8.0~v3.9.5 Server-Side Request Forgery",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://github.com/dingpotian/cve-vul/blob/main/jeecgboot/advisory-01-airag-flow-ssrf.md",
"tags": [
"exploit"
]
}
],
"x_generator": [
"VulDB PVTS v202611"
]
}
}
}
data/2026/126xxx/CVE-2026-126998.json
+182
View File
@@ -0,0 +1,182 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-126998",
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"state": "PUBLISHED",
"assignerShortName": "VulDB",
"dateReserved": "2026-11-12T08:04:31.383Z",
"datePublished": "2026-11-12T14:45:16.200Z",
"dateUpdated": "2026-11-12T14:45:16.200Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB",
"dateUpdated": "2026-11-12T14:45:16.200Z"
},
"title": "JeecgBoot Authentication Filter call OpenApiController.call server-side request forgery",
"problemTypes": [
{
"descriptions": [
{
"type": "CWE",
"cweId": "CWE-918",
"lang": "en",
"description": "Server-Side Request Forgery"
}
]
}
],
"affected": [
{
"vendor": "n/a",
"product": "JeecgBoot",
"versions": [
{
"version": "3.9.0",
"status": "affected"
},
{
"version": "3.9.1",
"status": "affected"
},
{
"version": "3.9.2",
"status": "affected"
},
{
"version": "3.9.3",
"status": "affected"
},
{
"version": "3.9.4",
"status": "affected"
},
{
"version": "3.9.5",
"status": "affected"
}
],
"cpes": [
"cpe:2.3:a:jeecgboot:jeecgboot:*:*:*:*:*:*:*:*"
],
"modules": [
"Authentication Filter"
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in JeecgBoot up to 3.9.5. This vulnerability affects the function OpenApiController.call of the file /openapi/call of the component Authentication Filter. The manipulation results in server-side request forgery. The attack can be executed remotely. The exploit has been released to the public and may be used for attacks. The vendor was contacted early about this disclosure but did not respond in any way."
}
],
"metrics": [
{
"cvssV4_0": {
"version": "4.0",
"baseScore": 6.9,
"vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N/E:P",
"baseSeverity": "MEDIUM"
}
},
{
"cvssV3_1": {
"version": "3.1",
"baseScore": 7.3,
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"baseSeverity": "HIGH"
}
},
{
"cvssV3_0": {
"version": "3.0",
"baseScore": 7.3,
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:P/RL:X/RC:C",
"baseSeverity": "HIGH"
}
},
{
"cvssV2_0": {
"version": "2.0",
"baseScore": 7.5,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P/E:POC/RL:ND/RC:C"
}
}
],
"timeline": [
{
"time": "2026-11-12T00:00:00.000Z",
"lang": "en",
"value": "Advisory disclosed"
},
{
"time": "2026-11-12T01:00:00.000Z",
"lang": "en",
"value": "VulDB entry created"
},
{
"time": "2026-11-12T09:09:36.000Z",
"lang": "en",
"value": "VulDB entry last update"
}
],
"credits": [
{
"lang": "en",
"value": "dptcc (VulDB User)",
"type": "reporter"
},
{
"lang": "en",
"value": "VulDB CNA Team",
"type": "coordinator"
}
],
"references": [
{
"url": "https://vuldb.com/vuln/436297",
"name": "VDB-436297 | JeecgBoot Authentication Filter call OpenApiController.call server-side request forgery",
"tags": [
"vdb-entry",
"technical-description"
]
},
{
"url": "https://vuldb.com/vuln/436297/cti",
"name": "VDB-436297 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
]
},
{
"url": "https://vuldb.com/cve/CVE-2026-126998",
"name": "CVE-2026-126998 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://vuldb.com/submit/1040929",
"name": "Submit #1040929 | Jeecg JeecgBoot 3.9.2/3.9.3/3.9.5 Server-Side Request Forgery",
"tags": [
"third-party-advisory"
]
},
{
"url": "https://github.com/dingpotian/cve-vul/blob/main/jeecgboot/advisory-02-openapi-options-auth-bypass.md",
"tags": [
"exploit"
]
}
],
"x_generator": [
"VulDB PVTS v202611"
]
}
}
}
data/2026/127xxx/CVE-2026-127109.json
+66
View File
@@ -0,0 +1,66 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-127109",
"assignerOrgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"state": "PUBLISHED",
"assignerShortName": "certcc",
"dateReserved": "2026-11-12T15:07:38.409Z",
"datePublished": "2026-11-12T15:08:53.202Z",
"dateUpdated": "2026-11-12T15:08:53.202Z"
},
"containers": {
"cna": {
"title": "CVE-2026-127109",
"descriptions": [
{
"lang": "en",
"value": "A code injection vulnerability in promzard’s template-loading functionality allows an attacker who can control property names in the context object (ctx) to execute arbitrary code with the privileges of the Node.js process. The library inserts context property names into a generated function’s parameter list without validation or escaping and evaluates the resulting source using `vm.runInThisContext()`. A crafted property name can escape the parameter list and inject JavaScript code, even when the template file is fully trusted."
}
],
"source": {
"discovery": "UNKNOWN"
},
"affected": [
{
"vendor": "Promzard",
"product": "Promzard",
"versions": [
{
"status": "affected",
"version": "0",
"lessThanOrEqual": "4.0.0",
"versionType": "custom"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"description": "CWE-94 Improper Control of Generation of Code ('Code Injection')"
}
]
}
],
"references": [
{
"url": "https://github.com/npm/promzard"
}
],
"x_generator": {
"engine": "VINCE 4.0.3",
"env": "prod",
"origin": "https://cveawg.mitre.org/api/cve/CVE-2026-127109"
},
"providerMetadata": {
"orgId": "37e5125f-f79b-445b-8fad-9564f167944b",
"shortName": "certcc",
"dateUpdated": "2026-11-12T15:08:53.202Z"
}
}
}
}
data/2026/14xxx/CVE-2026-14661.json
+125
View File
@@ -0,0 +1,125 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-14661",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-07-03T20:28:07.149Z",
"datePublished": "2026-11-12T14:15:30.140Z",
"dateUpdated": "2026-11-12T14:15:30.140Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:30.140Z"
},
"title": "PostgreSQL dblink and subscriptions can append to arbitrary files",
"x_postgresql": {
"component": "contrib module"
},
"descriptions": [
{
"lang": "en",
"value": "External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial of service, via appending invalid data to a chosen file. Specifically, the \"sslkeylogfile\" connection parameter appends data, in NSS keylog format, to a file of the user's choosing. This \"sslkeylogfile\" mechanism cannot add arbitrary bytes. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are also affected if libpq version 18 or later is installed and in use by the server."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-73",
"type": "CWE",
"description": "External Control of File Name or Path"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-14661/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"baseScore": 8.1,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "Superuser previously issued \"CREATE EXTENSION dblink\"."
},
{
"lang": "en",
"value": "Superuser previously granted pg_create_subscription to non-superuser roles."
}
],
"workarounds": [
{
"lang": "en",
"value": "Revoke public EXECUTE permission on dblink functions"
},
{
"lang": "en",
"value": "Revoke pg_create_subscription from any roles that do not already have pg_write_server_files privileges"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Andrey Krasichkov, b.altawil, and Zsolt Parragi for reporting this problem."
}
]
}
}
}
data/2026/16xxx/CVE-2026-16237.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-16237",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-07-20T01:55:06.428Z",
"datePublished": "2026-11-12T14:15:30.710Z",
"dateUpdated": "2026-11-12T14:15:30.710Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:30.710Z"
},
"title": "PostgreSQL INSERT ... ON CONFLICT can read or modify rows despite auto-updatable view WHERE condition",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, whether or not the view is a security_barrier view. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-424",
"type": "CWE",
"description": "Improper Protection of Alternate Path"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-16237/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"baseScore": 5.4,
"baseSeverity": "MEDIUM"
}
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has INSERT and UPDATE privileges on an auto-updatable view but lacks one of those on its base table"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Qing Xu, Carl Andersen, Zsolt Parragi, and shihao zhong for reporting this problem."
}
]
}
}
}
data/2026/16xxx/CVE-2026-16240.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-16240",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-07-20T01:55:33.940Z",
"datePublished": "2026-11-12T14:15:31.280Z",
"dateUpdated": "2026-11-12T14:15:31.280Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:31.280Z"
},
"title": "PostgreSQL pg_basebackup can use backup manifest content as a format string",
"x_postgresql": {
"component": "client"
},
"descriptions": [
{
"lang": "en",
"value": "Use of externally-controlled format string in PostgreSQL pg_basebackup allows an attacker having already compromised a server to achieve disclosure from pg_basebackup memory, via backup manifest bytes. The vulnerability does not return the improperly-read bytes back to the attacker's server, so a successful attack would need separate implementation-specific secrets for that. Integrity impact is unlikely; in particular, the applicable formatter does not support %n. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-134",
"type": "CWE",
"description": "Use of Externally-Controlled Format String"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-16240/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"baseScore": 3.7,
"baseSeverity": "LOW"
}
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has compromised the server being backed up; attacker has a separate way to retrieve the improperly-read bytes from the host running pg_basebackup; victim runs a backup without starting the server from that backup"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Peter Eisentraut for reporting this problem."
}
]
}
}
}
data/2026/17xxx/CVE-2026-17131.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ibm",
"dateReserved": "2026-07-24T16:51:34.904Z",
"datePublished": "2026-11-07T04:31:52.553Z",
"dateUpdated": "2026-11-07T04:31:52.553Z"
"dateUpdated": "2026-11-12T14:54:35.952Z"
},
"containers": {
"cna": {
@@ -101,6 +101,40 @@
}
],
"title": "Multiple Vulnerabilities in IBM API Connect"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:54:26.390247Z",
"id": "CVE-2026-17131",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:54:35.952Z"
}
}
]
}
}
data/2026/17xxx/CVE-2026-17306.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ibm",
"dateReserved": "2026-07-25T01:13:42.123Z",
"datePublished": "2026-11-07T04:32:57.966Z",
"dateUpdated": "2026-11-07T04:32:57.966Z"
"dateUpdated": "2026-11-12T14:53:15.453Z"
},
"containers": {
"cna": {
@@ -101,6 +101,40 @@
}
],
"title": "Multiple Vulnerabilities in IBM API Connect"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:53:07.356039Z",
"id": "CVE-2026-17306",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:53:15.453Z"
}
}
]
}
}
data/2026/17xxx/CVE-2026-17316.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ibm",
"dateReserved": "2026-07-25T01:42:10.084Z",
"datePublished": "2026-11-07T04:33:08.513Z",
"dateUpdated": "2026-11-07T04:33:08.513Z"
"dateUpdated": "2026-11-12T14:51:07.803Z"
},
"containers": {
"cna": {
@@ -101,6 +101,40 @@
}
],
"title": "Multiple Vulnerabilities in IBM API Connect"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:50:58.604487Z",
"id": "CVE-2026-17316",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:51:07.803Z"
}
}
]
}
}
data/2026/17xxx/CVE-2026-17341.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ibm",
"dateReserved": "2026-07-25T02:42:02.255Z",
"datePublished": "2026-11-07T04:33:34.065Z",
"dateUpdated": "2026-11-07T04:33:34.065Z"
"dateUpdated": "2026-11-12T14:52:10.943Z"
},
"containers": {
"cna": {
@@ -101,6 +101,40 @@
}
],
"title": "Multiple Vulnerabilities in IBM API Connect"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:52:03.356628Z",
"id": "CVE-2026-17341",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:52:10.943Z"
}
}
]
}
}
data/2026/17xxx/CVE-2026-17344.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "ibm",
"dateReserved": "2026-07-25T02:48:23.249Z",
"datePublished": "2026-11-07T04:33:37.096Z",
"dateUpdated": "2026-11-07T04:33:37.096Z"
"dateUpdated": "2026-11-12T14:56:16.723Z"
},
"containers": {
"cna": {
@@ -101,6 +101,40 @@
}
],
"title": "Multiple Vulnerabilities in IBM API Connect"
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:56:05.690818Z",
"id": "CVE-2026-17344",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:56:16.723Z"
}
}
]
}
}
data/2026/18xxx/CVE-2026-18447.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-18447",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-07-31T02:56:08.443Z",
"datePublished": "2026-11-12T14:15:31.850Z",
"dateUpdated": "2026-11-12T14:15:31.850Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:31.850Z"
},
"title": "PostgreSQL output parameter type confusion executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating system user running the database, via an output parameter of type \"any\". Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-843",
"type": "CWE",
"description": "Access of Resource Using Incompatible Type ('Type Confusion')"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-18447/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Stephan Lipp for reporting this problem."
}
]
}
}
}
data/2026/18xxx/CVE-2026-18767.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "CERTVDE",
"dateReserved": "2026-08-04T07:16:35.058Z",
"datePublished": "2026-11-11T08:19:35.444Z",
"dateUpdated": "2026-11-11T08:19:35.444Z"
"dateUpdated": "2026-11-12T15:00:11.333Z"
},
"containers": {
"cna": {
@@ -307,6 +307,40 @@
"x_generator": {
"engine": "Vulnogram 0.4.0"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:59:58.664035Z",
"id": "CVE-2026-18767",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "total"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T15:00:11.333Z"
}
}
]
}
}
data/2026/40xxx/CVE-2026-40913.json
+49 -1
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apache",
"dateReserved": "2026-04-15T16:43:15.722Z",
"datePublished": "2026-11-09T10:00:01.368Z",
"dateUpdated": "2026-11-09T10:12:08.062Z"
"dateUpdated": "2026-11-12T15:14:53.200Z"
},
"containers": {
"cna": {
@@ -123,6 +123,54 @@
"shortName": "CVE",
"dateUpdated": "2026-11-09T10:12:08.062Z"
}
},
{
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 8.2,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:L",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "LOW",
"privilegesRequired": "NONE",
"confidentialityImpact": "HIGH"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T15:13:07.528387Z",
"id": "CVE-2026-40913",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T15:14:53.200Z"
}
}
]
}
data/2026/50xxx/CVE-2026-50204.json
+49 -1
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apache",
"dateReserved": "2026-06-04T00:06:16.496Z",
"datePublished": "2026-11-09T09:57:52.924Z",
"dateUpdated": "2026-11-09T13:03:51.065Z"
"dateUpdated": "2026-11-12T15:08:35.209Z"
},
"containers": {
"cna": {
@@ -145,6 +145,54 @@
"shortName": "CVE",
"dateUpdated": "2026-11-09T10:12:39.031Z"
}
},
{
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T15:07:55.774059Z",
"id": "CVE-2026-50204",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T15:08:35.209Z"
}
}
]
}
data/2026/68xxx/CVE-2026-68982.json
+52 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apache",
"dateReserved": "2026-08-02T00:09:01.550Z",
"datePublished": "2026-11-09T09:55:00.238Z",
"dateUpdated": "2026-11-09T13:05:04.432Z"
"dateUpdated": "2026-11-12T15:05:33.620Z"
},
"containers": {
"cna": {
@@ -115,6 +115,56 @@
"x_generator": {
"engine": "airflow-s/generate_cve_json.py"
}
}
},
"adp": [
{
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 7.3,
"attackVector": "NETWORK",
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"integrityImpact": "LOW",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "LOW",
"privilegesRequired": "NONE",
"confidentialityImpact": "LOW"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T15:05:24.911063Z",
"id": "CVE-2026-68982",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T15:05:33.620Z"
}
}
]
}
}
data/2026/6xxx/CVE-2026-6460.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-6460",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-04-17T00:15:46.725Z",
"datePublished": "2026-11-12T14:15:32.415Z",
"dateUpdated": "2026-11-12T14:15:32.415Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:32.415Z"
},
"title": "PostgreSQL type confusion after ALTER ... SET DATA TYPE executes arbitrary code",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily. Other DDL attack routes exist, such as \"ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN\". The system had inadequate tracking of typed values, and values were not self-identifying. Stale values could appear in data dictionary entries, PL/pgSQL variables, and many other parts of the system. PostgreSQL Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-843",
"type": "CWE",
"description": "Access of Resource Using Incompatible Type ('Type Confusion')"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-6460/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 8.8,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has permission to create objects (temporary objects or non-temporary objects in at least one schema)"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Andrew Gierth, Alexander Lakhin, Francesco Verardi, Hcamael, Tomer Fichman, OpenAI Security Research Team, Mehmet Ince @mdisec, Bryan Green, Sumedh Pathak, Nicholas Carlini, Sergey Shinderuk, Yuxiao Guo, Nikhil Sontakke, Stephan Lipp, and Daniel Bakker for reporting this problem."
}
]
}
}
}
data/2026/6xxx/CVE-2026-6467.json
+111
View File
@@ -0,0 +1,111 @@
{
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"cveMetadata": {
"cveId": "CVE-2026-6467",
"assignerOrgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"state": "PUBLISHED",
"assignerShortName": "PostgreSQL",
"dateReserved": "2026-04-17T00:20:56.212Z",
"datePublished": "2026-11-12T14:15:32.994Z",
"dateUpdated": "2026-11-12T14:15:32.994Z"
},
"containers": {
"cna": {
"providerMetadata": {
"orgId": "f86ef6dc-4d3a-42ad-8f28-e6d5547a5007",
"shortName": "PostgreSQL",
"dateUpdated": "2026-11-12T14:15:32.994Z"
},
"title": "PostgreSQL extension script schema mishandling executes arbitrary SQL",
"x_postgresql": {
"component": "core server"
},
"descriptions": [
{
"lang": "en",
"value": "Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA \"$user\". ALTER EXTENSION was also affected. A trusted-extension script located the wrong object and executed arbitrary SQL of the attacker's choice. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected."
}
],
"affected": [
{
"defaultStatus": "unaffected",
"product": "PostgreSQL",
"vendor": "n/a",
"versions": [
{
"lessThan": "18.7",
"status": "affected",
"version": "18",
"versionType": "rpm"
},
{
"lessThan": "17.12",
"status": "affected",
"version": "17",
"versionType": "rpm"
},
{
"lessThan": "16.16",
"status": "affected",
"version": "16",
"versionType": "rpm"
},
{
"lessThan": "15.20",
"status": "affected",
"version": "15",
"versionType": "rpm"
},
{
"lessThan": "14.25",
"status": "affected",
"version": "0",
"versionType": "rpm"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"lang": "en",
"cweId": "CWE-427",
"type": "CWE",
"description": "Uncontrolled Search Path Element"
}
]
}
],
"references": [
{
"url": "https://www.postgresql.org/support/security/CVE-2026-6467/"
}
],
"metrics": [
{
"format": "CVSS",
"cvssV3_1": {
"version": "3.1",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
"baseScore": 7.2,
"baseSeverity": "HIGH"
}
}
],
"configurations": [
{
"lang": "en",
"value": "attacker has database-level CREATE privilege"
}
],
"credits": [
{
"lang": "en",
"value": "The PostgreSQL project thanks Noah Misch for reporting this problem."
}
]
}
}
}
data/2026/76xxx/CVE-2026-76185.json
+49 -1
View File
@@ -8,7 +8,7 @@
"assignerShortName": "apache",
"dateReserved": "2026-08-19T10:41:07.241Z",
"datePublished": "2026-11-09T09:53:57.995Z",
"dateUpdated": "2026-11-10T17:22:57.031Z"
"dateUpdated": "2026-11-12T15:02:35.015Z"
},
"containers": {
"cna": {
@@ -123,6 +123,54 @@
"shortName": "CVE",
"dateUpdated": "2026-11-09T10:13:03.458Z"
}
},
{
"metrics": [
{
"cvssV3_1": {
"scope": "UNCHANGED",
"version": "3.1",
"baseScore": 6.5,
"attackVector": "NETWORK",
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
"integrityImpact": "NONE",
"userInteraction": "NONE",
"attackComplexity": "LOW",
"availabilityImpact": "NONE",
"privilegesRequired": "LOW",
"confidentialityImpact": "HIGH"
}
},
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T15:02:13.526966Z",
"id": "CVE-2026-76185",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T15:02:35.015Z"
}
}
]
}
data/2026/78xxx/CVE-2026-78367.json
+48 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-08-24T12:52:02.839Z",
"datePublished": "2026-08-24T13:48:52.103Z",
"dateUpdated": "2026-11-12T11:55:33.044Z"
"dateUpdated": "2026-11-12T14:38:08.771Z"
},
"containers": {
"cna": {
@@ -66,6 +66,44 @@
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rpm",
"defaultStatus": "affected",
"versions": [
{
"version": "0:4.16.1.3-43.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rpm",
"defaultStatus": "affected",
"versions": [
{
"version": "0:4.16.1.3-43.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
@@ -114,16 +152,6 @@
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rpm",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
@@ -454,6 +482,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99593",
"name": "RHSA-2026:99593",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99595",
"name": "RHSA-2026:99595",
@@ -522,7 +558,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T11:55:33.044Z"
"dateUpdated": "2026-11-12T14:38:08.771Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/84xxx/CVE-2026-84837.json
+48 -12
View File
@@ -8,7 +8,7 @@
"assignerShortName": "redhat",
"dateReserved": "2026-09-02T11:56:41.213Z",
"datePublished": "2026-09-02T15:12:58.497Z",
"dateUpdated": "2026-11-12T11:55:33.092Z"
"dateUpdated": "2026-11-12T14:38:08.798Z"
},
"containers": {
"cna": {
@@ -66,6 +66,44 @@
"cpe:/o:redhat:enterprise_linux:10.3"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rpm",
"defaultStatus": "affected",
"versions": [
{
"version": "0:4.16.1.3-43.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rpm",
"defaultStatus": "affected",
"versions": [
{
"version": "0:4.16.1.3-43.el9_9",
"lessThan": "*",
"versionType": "rpm",
"status": "unaffected"
}
],
"cpes": [
"cpe:/a:redhat:enterprise_linux:9::appstream",
"cpe:/o:redhat:enterprise_linux:9::baseos"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Hardened Images",
@@ -114,16 +152,6 @@
"cpe:/a:redhat:enterprise_linux:8"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat Enterprise Linux 9",
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"packageName": "rpm",
"defaultStatus": "affected",
"cpes": [
"cpe:/a:redhat:enterprise_linux:9"
]
},
{
"vendor": "Red Hat",
"product": "Red Hat OpenShift AI (RHOAI)",
@@ -454,6 +482,14 @@
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99593",
"name": "RHSA-2026:99593",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
]
},
{
"url": "https://access.redhat.com/errata/RHSA-2026:99595",
"name": "RHSA-2026:99595",
@@ -519,7 +555,7 @@
"providerMetadata": {
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat",
"dateUpdated": "2026-11-12T11:55:33.092Z"
"dateUpdated": "2026-11-12T14:38:08.798Z"
},
"x_generator": {
"engine": "cvelib 1.8.0"
data/2026/92xxx/CVE-2026-92606.json
+36 -2
View File
@@ -8,7 +8,7 @@
"assignerShortName": "TR-CERT",
"dateReserved": "2026-09-16T13:51:12.021Z",
"datePublished": "2026-11-09T08:40:23.219Z",
"dateUpdated": "2026-11-09T08:40:23.219Z"
"dateUpdated": "2026-11-12T14:46:46.592Z"
},
"containers": {
"cna": {
@@ -124,6 +124,40 @@
"x_generator": {
"engine": "Vulnogram 1.0.5"
}
}
},
"adp": [
{
"metrics": [
{
"other": {
"type": "ssvc",
"content": {
"timestamp": "2026-11-12T14:45:42.899836Z",
"id": "CVE-2026-92606",
"options": [
{
"Exploitation": "none"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"version": "2.0.3"
}
}
}
],
"title": "CISA ADP Vulnrichment",
"providerMetadata": {
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP",
"dateUpdated": "2026-11-12T14:46:46.592Z"
}
}
]
}
}
data/delta.json
+30 -78
View File
@@ -1,98 +1,50 @@
{
"fetchTime": "2026-11-12T14:14:33.753Z",
"numberOfChanges": 15,
"fetchTime": "2026-11-12T15:18:14.653Z",
"numberOfChanges": 7,
"new": [
{
"cveId": "CVE-2026-120490",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120490",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120490.json",
"dateUpdated": "2026-11-12T14:01:48.152Z"
},
{
"cveId": "CVE-2026-120869",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-120869",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/120xxx/CVE-2026-120869.json",
"dateUpdated": "2026-11-12T14:03:14.594Z"
},
{
"cveId": "CVE-2026-123039",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123039",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123039.json",
"dateUpdated": "2026-11-12T14:02:13.665Z"
},
{
"cveId": "CVE-2026-71367",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-71367",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/71xxx/CVE-2026-71367.json",
"dateUpdated": "2026-11-12T14:05:21.077Z"
"cveId": "CVE-2026-127109",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-127109",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/127xxx/CVE-2026-127109.json",
"dateUpdated": "2026-11-12T15:08:53.202Z"
}
],
"updated": [
{
"cveId": "CVE-2026-100229",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-100229",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/100xxx/CVE-2026-100229.json",
"dateUpdated": "2026-11-12T14:02:33.097Z"
"cveId": "CVE-2026-121350",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121350",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121350.json",
"dateUpdated": "2026-11-12T15:10:50.735Z"
},
{
"cveId": "CVE-2026-123523",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123523",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123523.json",
"dateUpdated": "2026-11-12T14:03:34.788Z"
"cveId": "CVE-2026-121355",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121355",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121355.json",
"dateUpdated": "2026-11-12T15:09:16.558Z"
},
{
"cveId": "CVE-2026-123527",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123527",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123527.json",
"dateUpdated": "2026-11-12T14:04:40.567Z"
"cveId": "CVE-2026-121912",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-121912",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/121xxx/CVE-2026-121912.json",
"dateUpdated": "2026-11-12T15:12:03.041Z"
},
{
"cveId": "CVE-2026-123531",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123531",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123531.json",
"dateUpdated": "2026-11-12T14:06:05.424Z"
"cveId": "CVE-2026-123790",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123790",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123790.json",
"dateUpdated": "2026-11-12T15:13:46.135Z"
},
{
"cveId": "CVE-2026-123535",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123535",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123535.json",
"dateUpdated": "2026-11-12T14:06:57.116Z"
"cveId": "CVE-2026-40913",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-40913",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/40xxx/CVE-2026-40913.json",
"dateUpdated": "2026-11-12T15:14:53.200Z"
},
{
"cveId": "CVE-2026-123539",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123539",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123539.json",
"dateUpdated": "2026-11-12T14:07:56.763Z"
},
{
"cveId": "CVE-2026-123543",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-123543",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/123xxx/CVE-2026-123543.json",
"dateUpdated": "2026-11-12T14:08:49.224Z"
},
{
"cveId": "CVE-2026-124485",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124485",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124485.json",
"dateUpdated": "2026-11-12T14:07:37.412Z"
},
{
"cveId": "CVE-2026-124489",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124489",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124489.json",
"dateUpdated": "2026-11-12T14:09:00.349Z"
},
{
"cveId": "CVE-2026-124493",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-124493",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/124xxx/CVE-2026-124493.json",
"dateUpdated": "2026-11-12T14:12:42.900Z"
},
{
"cveId": "CVE-2026-15554",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-15554",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/15xxx/CVE-2026-15554.json",
"dateUpdated": "2026-11-12T14:08:30.966Z"
"cveId": "CVE-2026-50204",
"cveOrgLink": "https://www.cve.org/CVERecord?id=CVE-2026-50204",
"githubLink": "https://raw.githubusercontent.com/CVEProject/cvelistV5/main/cves/2026/50xxx/CVE-2026-50204.json",
"dateUpdated": "2026-11-12T15:08:35.209Z"
}
],
"error": []
data/deltaLog.json
+665 -1032
View File
File diff suppressed because it is too large. Load diff
state/sync.json
+3 -3
View File
@@ -1,7 +1,7 @@
{
"source": "https://github.com/CVEProject/cvelistV5.git",
"upstream_commit": "b831d6a43ebb3a22ce249044528b84f902e71350",
"upstream_commit": "87ea9da1fcd18bb77ece7d85d29472b99eac2448",
"since_year": 2017,
"records": 331551,
"synced_at_utc": "2026-11-12T14:24:33.910482+00:00"
"records": 331608,
"synced_at_utc": "2026-11-12T15:25:13.829937+00:00"
}