PT-2026-94389

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions prior to 9.18 Description The Restore and Maintenance tools pass the client-supplied database field directly as the value of the --dbname option for pg restore and psql. Because libpq expands database names containing an...

PT-2026-79990

Type confusion in PostgreSQL pg restore attribute stats allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.6 are affected. Versions before...

AZL-66327 CVE-2025-8715 affecting package postgresql for versions less than 14.19-1

Improper neutralization of newlines in pgdump in PostgreSQL allows a user of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql meta-commands inside a purpose-crafted object name. The same attacks...

PT-2025-33268

Name of the Vulnerable Software and Affected Versions PostgreSQL versions prior to 17.6 PostgreSQL versions prior to 16.10 PostgreSQL versions prior to 15.14 PostgreSQL versions prior to 14.19 PostgreSQL versions prior to 13.22 Description Untrusted data inclusion in the pg dump utility allows a...