CVE-2026-120141 is a type confusion vulnerability in PostgreSQL materialized set-returning functions, including json_populate_recordset(). It allows a database user to execute arbitrary code as the OS user running the database by returning rows with incompatible dynamic RECORD types. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The vulnerability has a high severity with a CVSS score of 8.8. Fixed versions are available for all affected branches.
CVE-2026-120139 is an integer overflow or wraparound vulnerability in PostgreSQL affecting in-memory tuple-size calculations. This flaw allows a database user to execute arbitrary code with the privileges of the operating system user running the database by supplying oversized tuple data. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are vulnerable. The vulnerability has a high severity with a CVSS score of 8.8.
CVE-2026-116336 is a high-severity vulnerability in PostgreSQL that allows an attacker with privileges to operate on a dropped index using REINDEX CONCURRENTLY to execute arbitrary code as the operating system user running the database. This occurs via an index expression that issues DROP INDEX. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-116335 is a high-severity type confusion vulnerability in PostgreSQL affecting versions before 18.7, 17.12, 16.16, 15.20, and 14.25. It arises from improper handling of operator commutator and negator links, allowing an object creator to execute arbitrary code with the privileges of the database operating system user. This occurs when operators with different result types are linked or when inconsistent reciprocal links are created. The vulnerability has been fixed in the specified versions.
CVE-2026-116333 is a buffer over-read vulnerability in PostgreSQL affecting parallel B-tree scans. It allows an object creator to read server memory addresses chosen by an attacker due to a function incorrectly marked as PARALLEL SAFE or STABLE, causing inconsistent scan-key arrays among worker processes. This affects PostgreSQL major versions 17 and 18, specifically versions before 17.12 and 18.7. Versions prior to 17 are not affected. The vulnerability has a CVSS score of 6.5, indicating medium severity.
CVE-2026-116332 is a use-after-free vulnerability in PostgreSQL portal setup that allows an object creator to execute arbitrary code as the operating system user running the database. This occurs when user-defined code runs during planning or executor startup and closes the portal currently being prepared. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-116331 is a high-severity type confusion vulnerability in PostgreSQL's min/max aggregate optimization. It allows an object creator to execute arbitrary code with the privileges of the operating system user running the database. The flaw arises when a user-defined aggregate uses the SORTOP option, causing the query planner to incorrectly treat the aggregate's input and result as the same type when they differ. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-126996 is a path traversal vulnerability in SakanaAI text-to-LoRA version 0.0.1. The flaw exists in the get_tokenizer function within the src/hyper_llm_modulator/utils/model_loading.py file, specifically in the Checkpoint Loading component. Manipulating the base_model_name_or_path argument can allow an attacker to perform path traversal. The vulnerability can be exploited remotely and public exploit code has been disclosed. The vendor has been informed but has not yet responded or issued a fix.
CVE-2026-116330 is a vulnerability in PostgreSQL where untrusted data inclusion in the pg_dump tar-format restore.sql file allows a compromised origin server to execute arbitrary code as the client OS user running psql. This issue affects versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 and represents a gap in the previous fix for CVE-2025-8714. The restore.sql file is undocumented, increasing the risk of unnoticed exploitation.
CVE-2026-116329 is a type confusion vulnerability in PostgreSQL statistics import functionality. It allows a table maintainer to execute arbitrary code as the operating system user running the database by exploiting nested SET DATA TYPE operations during value conversion. This affects PostgreSQL major version 18 prior to minor version 18.7. Versions before 18 are not affected. The vulnerability has a high severity with a CVSS score of 8.8.
CVE-2026-116328 is an integer overflow or wraparound vulnerability in PostgreSQL's generation memory contexts. It allows a database user to execute arbitrary code as the operating system user running the database by freeing a large allocation and causing memory corruption. This affects PostgreSQL major versions 16 through 18, specifically versions before 16.16, 17.12, and 18.7. Versions prior to 16 are not affected. The vulnerability has a high severity with a CVSS score of 8.8.
CVE-2026-116327 is a vulnerability in PostgreSQL where sensitive information can be inferred by a database user through missing authorization checks in security_barrier view processing. This occurs when a leaky function is applied to a CASE test value or internal parameter that indirectly represents a protected column. Versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-116326 is a high-severity vulnerability in PostgreSQL's plperl procedural language. It involves uncaught exceptions that allow an object creator to use a stale sigjmp_buf via tied Perl objects or Perl objects with overloaded conversions that throw errors during plperl error handling. This flaw affects multiple PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25. The vulnerability could potentially lead to arbitrary code execution on some platforms.
CVE-2026-116325 is a SQL injection vulnerability in PostgreSQL's reindexdb utility. It allows an object creator to execute arbitrary SQL commands as the database user running reindexdb by crafting a malicious index name used in parallel catalog queries with the --jobs and --index options. This affects PostgreSQL major versions 17 and 18, specifically versions prior to 17.12 and 18.7. Versions before 17 are not affected.
CVE-2026-116323 is a use-after-free vulnerability in PostgreSQL's pltcl extension. It allows an object creator to execute arbitrary code with the privileges of the database operating system user. This occurs via a domain CHECK constraint that re-enters the Tcl interpreter and manipulates a string still in use during result conversion. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-116322 is a vulnerability in PostgreSQL versions 18.0 up to but not including 18.7. It involves improper locking during startup processing, which allows an unauthenticated network client to cause a server restart by triggering authentication_timeout while holding a spinlock during cancel handling.
CVE-2026-116321 is a vulnerability in PostgreSQL involving improper null termination during array element assignment. This flaw allows a database user to disclose server memory by manipulating the final byte of a fixed-length name value, which is then treated as a C string. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-116320 is a use-after-free vulnerability in the PostgreSQL plperl procedural language. It allows an attacker who can create objects to execute arbitrary code with the privileges of the operating system user running the database. This occurs when PostgreSQL drops the final reference to a Perl array or hash during object conversion. Versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-116319 is a use-after-free vulnerability in the PostgreSQL plperl procedural language. It allows an object creator to execute arbitrary code with the privileges of the operating system user running the database. This affects PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25.
CVE-2026-116318 is a high-severity SQL injection vulnerability in PostgreSQL's pg_dump utility. It allows an object creator to execute arbitrary SQL commands as the user restoring the dump. The issue arises from an inherited column with a child-local not-null constraint whose name requires quoting. This affects PostgreSQL major version 18 prior to minor version 18.7. Versions before 18 are not affected. The vulnerability has been fixed in PostgreSQL 18.7.