CVE-2026-14661 is a vulnerability in PostgreSQL affecting versions prior to 18.7 in major version 18, and earlier versions with certain libpq versions. It involves external control of the file name or path via the "sslkeylogfile" connection parameter, which appends NSS keylog format data to a user-chosen file. This can lead to a persistent denial of service condition by appending invalid data to files.
CVE-2026-120154 is a vulnerability in PostgreSQL's INSERT ... ON CONFLICT feature that allows an attacker with INSERT, UPDATE, and applicable SELECT privileges to bypass row security policies and read every row in a table. This issue affects multiple PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25. The vulnerability does not allow unauthorized writes. A fix is available in the specified patched versions.
CVE-2026-120153 is a high-severity SQL injection vulnerability in PostgreSQL affecting versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25. It allows an attacker with database CREATE privilege to execute arbitrary code as the bootstrap superuser by exploiting extension-script substitutions with specially crafted schema or owner names containing newlines or special substrings. This vulnerability requires a non-bundled extension with a vulnerable script pattern and is similar to CVE-2023-39417.
CVE-2026-120152 is a use-after-free vulnerability in PostgreSQL's pg_show_all_settings() function. It allows a database user to read memory contents by loading a module while the function scans custom-variable placeholders that the module replaces and frees. This affects PostgreSQL major versions 16 through 18, specifically versions before 16.16, 17.12, and 18.7. Versions prior to 16 are not affected. The vulnerability has a medium severity with a CVSS score of 4.3.
CVE-2026-120151 is a high-severity type confusion vulnerability in PostgreSQL's plpgsql record-field assignment. It allows an object creator to execute arbitrary code as the operating system user running the database by exploiting a reentrant domain CHECK that modifies a RECORD variable's row type during a value cast. This affects PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25.
CVE-2026-120150 is a use-after-free vulnerability in PostgreSQL affecting versions before 18.7, 17.12, 16.16, 15.20, and 14.25. It arises from expanded-record domain checks that allow reuse of a dangling memory-context pointer. This flaw enables an object creator to execute arbitrary code with the privileges of the operating system user running the database.
CVE-2026-120149 is a heap-based buffer overflow vulnerability in PostgreSQL affecting foreign batch inserts. This flaw allows a foreign server to execute arbitrary code by reporting that it inserted more rows than actually supplied by the server. The issue arises when postgres_fdw encounters a rule on the remote table that expands an INSERT into additional rows. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-120148 is a high-severity type confusion vulnerability in PostgreSQL extended statistics. It allows an object creator to execute arbitrary code with the privileges of the operating system user running the database. The flaw arises from a statistics expression using an anonymous RECORD type whose backend-local type identifier mismatches a different row type in another session. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-120147 is a use-after-free vulnerability in the PostgreSQL dblink extension that allows an object creator to execute arbitrary code with the privileges of the database operating system user. This occurs due to type conversion code that re-enters dblink and closes a connection while an outer dblink call is still reading its results. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-120146 is a vulnerability in PostgreSQL where missing authorization checks in the REASSIGN OWNED command allow a role with INHERIT privilege but without SET privilege to transfer objects to the granted role. Additionally, it permits reassignment of database ownership without requiring the CREATEDB privilege. This issue affects PostgreSQL versions prior to 18.7, 17.12, 16.16, 15.20, and 14.25.
CVE-2026-120145 is a high-severity vulnerability in PostgreSQL affecting logical replication. It allows a compromised publisher to execute arbitrary code as the operating system user running a superuser-owned subscription by naming a system catalog as a replication target. Only subscriptions owned by a superuser are vulnerable. The issue affects PostgreSQL versions before 18.7, 17.12, 16.16, 15.20, and 14.25. A fix is available in these versions.
CVE-2026-120144 is a high-severity type confusion vulnerability in PostgreSQL versions 18.0 up to but not including 18.7. It arises from incomplete invalidation of the PostgreSQL type cache, allowing an object creator to execute arbitrary code as the operating system user running the database by exploiting a composite type change during cache population. Versions prior to 18.0 are not affected. The issue is fixed in PostgreSQL 18.7.
CVE-2026-120143 is a use-after-free vulnerability in PostgreSQL trigger functions that allows an object creator to execute arbitrary code with the privileges of the operating system user running the database. This occurs via a cursor over a transition table. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-120142 is a high-severity type confusion vulnerability in PostgreSQL affecting anonymous RECORD types. It allows an attacker who can create objects to execute arbitrary code with the privileges of the database operating system user. The flaw arises from row types with dropped attributes in identical positions but differing widths or alignments. This issue affects PostgreSQL major versions 17 and 18, specifically versions before 17.12 and 18.7. Versions prior to 17 are not vulnerable. The vulnerability has a CVSS score of 8.8, indicating a critical impact on confidentiality, integrity, and availability.
CVE-2026-120141 is a type confusion vulnerability in PostgreSQL materialized set-returning functions, including json_populate_recordset(). It allows a database user to execute arbitrary code as the OS user running the database by returning rows with incompatible dynamic RECORD types. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected. The vulnerability has a high severity with a CVSS score of 8.8. Fixed versions are available for all affected branches.
CVE-2026-120139 is an integer overflow or wraparound vulnerability in PostgreSQL affecting in-memory tuple-size calculations. This flaw allows a database user to execute arbitrary code with the privileges of the operating system user running the database by supplying oversized tuple data. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are vulnerable. The vulnerability has a high severity with a CVSS score of 8.8.
CVE-2026-116336 is a high-severity vulnerability in PostgreSQL that allows an attacker with privileges to operate on a dropped index using REINDEX CONCURRENTLY to execute arbitrary code as the operating system user running the database. This occurs via an index expression that issues DROP INDEX. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-116335 is a high-severity type confusion vulnerability in PostgreSQL affecting versions before 18.7, 17.12, 16.16, 15.20, and 14.25. It arises from improper handling of operator commutator and negator links, allowing an object creator to execute arbitrary code with the privileges of the database operating system user. This occurs when operators with different result types are linked or when inconsistent reciprocal links are created. The vulnerability has been fixed in the specified versions.
CVE-2026-116333 is a buffer over-read vulnerability in PostgreSQL affecting parallel B-tree scans. It allows an object creator to read server memory addresses chosen by an attacker due to a function incorrectly marked as PARALLEL SAFE or STABLE, causing inconsistent scan-key arrays among worker processes. This affects PostgreSQL major versions 17 and 18, specifically versions before 17.12 and 18.7. Versions prior to 17 are not affected. The vulnerability has a CVSS score of 6.5, indicating medium severity.
CVE-2026-116332 is a use-after-free vulnerability in PostgreSQL portal setup that allows an object creator to execute arbitrary code as the operating system user running the database. This occurs when user-defined code runs during planning or executor startup and closes the portal currently being prepared. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.