Debian vulnerabilities

Latest Debian CVEs

Newest publication first · page 4 of 40 · showing the latest 1,000

1. CVE-2026-120154 PostgreSQL INSERT ... ON CONFLICT can read rows despite row security policies

   Published 2026-11-12

   Medium·CVSS 4.3 EPSS 0.30%

   Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not fa...

2. CVE-2026-120153 PostgreSQL extension-script substitutions allow SQL injection through object names

   Published 2026-11-12

   High·CVSS 7.2 EPSS 0.55%

   SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417,...

3. CVE-2026-120152 PostgreSQL pg_show_all_settings() use-after-free discloses memory

   Published 2026-11-12

   Medium·CVSS 4.3 EPSS 0.30%

   Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees. Within major versions 16-18, minor versions before PostgreS...

4. CVE-2026-120151 PostgreSQL plpgsql record-field type confusion executes arbitrary code

   Published 2026-11-12

   High·CVSS 8.8 EPSS 0.59%

   Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via a reentrant domain CHECK that changes a RECORD variable's row type while a value is being cast. Versions before P...

5. CVE-2026-120150 PostgreSQL expanded-record domain-check use-after-free executes arbitrary code

   Published 2026-11-12

   High·CVSS 8.8 EPSS 0.58%

   Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user running the database, via repeated checks of a domain over a composite type that cause reuse of a dangling memory-context pointer. Versions b...

6. CVE-2026-120149 PostgreSQL FDW batch-insert mismatch executes arbitrary code

   Published 2026-11-12

   High·CVSS 8.8 EPSS 0.60%

   Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied. postgres_fdw can legitimately encounter this when a rule on the remote table expands an INSERT into...

7. CVE-2026-120148 PostgreSQL extended-statistics pseudo-type confusion executes arbitrary code

   Published 2026-11-12

   High·CVSS 8.1 EPSS 0.48%

   Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the database, via a statistics expression of an anonymous RECORD type whose backend-local type identifier denotes a different row type in anoth...

8. CVE-2026-120147 PostgreSQL dblink reentrant disconnect use-after-free executes arbitrary code

   Published 2026-11-12

   High·CVSS 8.8 EPSS 0.59%

   Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running the database, via type conversion code that re-enters dblink and closes a connection whose results an outer dblink call is reading. Versions b...

9. CVE-2026-120146 PostgreSQL REASSIGN OWNED bypasses role SET and CREATEDB checks

   Published 2026-11-12

   Medium·CVSS 4.3 EPSS 0.25%

   Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role. It also allows reassignment of database ownership without the CREATEDB privilege. The equivalent ALTER ... OWNER commands block this. Versions bef...

10. CVE-2026-120145 PostgreSQL logical replication can write to subscriber system catalogs, executing arbitrary code

    Published 2026-11-12

    High·CVSS 8.8 EPSS 0.54%

    Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running the superuser-owned subscription, via naming a system catalog as a replication target. Only subscriptions owned by a superuser are...

11. CVE-2026-120144 PostgreSQL type-cache invalidation gap executes arbitrary code

    Published 2026-11-12

    High·CVSS 8.8 EPSS 0.59%

    Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system user running the database, via a composite type change while its cache entry is being populated. Within major version 18, minor versions be...

12. CVE-2026-120143 PostgreSQL transition-table cursor use-after-free executes arbitrary code

    Published 2026-11-12

    High·CVSS 8.8 EPSS 0.59%

    Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the database, via a cursor over a transition table. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

13. CVE-2026-120142 PostgreSQL dropped-column type confusion executes arbitrary code

    Published 2026-11-12

    High·CVSS 8.8 EPSS 0.59%

    Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running the database, via row types having dropped attributes in the same positions but with different widths or alignments. Within major versions 1...

14. CVE-2026-120141 PostgreSQL materialized set-returning function type confusion executes arbitrary code

    Published 2026-11-12

    High·CVSS 8.8 EPSS 0.59%

    Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system user running the database, via returning rows having different dynamic RECORD return types. json_populate_recordset() is one affected functio...

15. CVE-2026-120139 PostgreSQL tuple-size integer wraparound executes arbitrary code

    Published 2026-11-12

    High·CVSS 8.8 EPSS 0.59%

    Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system user running the database, via oversized tuple data. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.

16. CVE-2026-116336 PostgreSQL REINDEX CONCURRENTLY does not block DROP INDEX during index functions

    Published 2026-11-12

    High·CVSS 8.8 EPSS 0.64%

    Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system user running the database, via an index expression that issues DROP INDEX. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 ar...

17. CVE-2026-116335 PostgreSQL commutator or negator result-type confusion executes arbitrary code

    Published 2026-11-12

    High·CVSS 8.8 EPSS 0.59%

    Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating system user running the database, via linking operators having different result types or creating inconsistent reciprocal links. Versions before...

18. CVE-2026-116333 PostgreSQL parallel B-tree array scan reads beyond array bounds

    Published 2026-11-12

    Medium·CVSS 6.5 EPSS 0.37%

    Buffer over-read in PostgreSQL parallel B-tree scans allows an object creator to read attacker-chosen server-memory addresses, via a function incorrectly marked PARALLEL SAFE or STABLE to make participating workers build different scan-key arrays. Within major versions 17-18, min...

19. CVE-2026-116332 PostgreSQL portal setup use-after-free executes arbitrary code

    Published 2026-11-12

    High·CVSS 8.8 EPSS 0.59%

    Use after free in PostgreSQL portal setup allows an object creator to execute arbitrary code as the operating system user running the database, via running user-defined code during planning or executor startup that closes the portal currently being prepared. Versions before Postg...

20. CVE-2026-116331 PostgreSQL min/max aggregate type confusion executes arbitrary code

    Published 2026-11-12

    High·CVSS 8.8 EPSS 0.59%

    Type confusion in PostgreSQL min/max aggregate optimization allows an object creator to execute arbitrary code as the operating system user running the database, via a user-defined aggregate whose SORTOP option causes the planner to treat the aggregate's input and result as the s...

21. CVE-2026-116330 PostgreSQL pg_dump tar restore.sql fails to block psql command injection

    Published 2026-11-12

    High·CVSS 8.8 EPSS 0.37%

    Untrusted data inclusion in PostgreSQL pg_dump tar-format restore.sql allows a compromised origin server to execute arbitrary code as the client operating system account running psql, via the predictable restriction key in restore.sql. This is a gap in the fix for CVE-2025-8714....

22. CVE-2026-116329 PostgreSQL statistics import type confusion executes arbitrary code

    Published 2026-11-12

    High·CVSS 8.8 EPSS 0.59%

    Type confusion in PostgreSQL statistics import allows a table maintainer to execute arbitrary code as the operating system user running the database, via nested SET DATA TYPE during conversion of values to import. Within major version 18, minor versions before PostgreSQL 18.7 are...

23. CVE-2026-116328 PostgreSQL generation memory context integer wraparound executes arbitrary code

    Published 2026-11-12

    High·CVSS 8.8 EPSS 0.59%

    Integer wraparound in PostgreSQL generation memory contexts allows a database user to execute arbitrary code as the operating system user running the database, via freeing an allocation larger than 1 GB and causing its block to be reused for smaller chunks whose back-pointer offs...

24. CVE-2026-116327 PostgreSQL security_barrier analysis can expose hidden values through indirect expressions

    Published 2026-11-12

    Medium·CVSS 4.3 EPSS 0.22%

    Exposure of sensitive information in PostgreSQL security_barrier processing allows a database user to infer values hidden by a security_barrier view, via applying a leaky function to a CASE test value or internal parameter that indirectly represents a protected column. Versions b...

25. CVE-2026-116326 PostgreSQL plperl tied-object exceptions follow stale sigjmp_buf

    Published 2026-11-12

    High·CVSS 8.8 EPSS 0.64%

    Uncaught exceptions in PostgreSQL plperl allow an object creator to cause use of a stale sigjmp_buf, via a tied Perl object, or a Perl object whose overloaded conversion throws while plperl is handling another error. We have not ruled out arbitrary code execution on some platform...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.