Поиск уязвимостей
Количество 67
Количество 67
CVE-2026-18408
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-18408
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-18408
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected.
CVE-2026-18408
PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client
CVE-2026-18408
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious s ...
GHSA-p745-282f-cxpr
Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.
BDU:2026-11972
Уязвимость утилиты pg_dump системы управления базами данных PostgreSQL, позволяющая нарушителю выполнить произвольный код
ROS-20261002-80-0025
Уязвимость postgresql18
ROS-20261002-80-0024
Уязвимость postgresql17
ROS-20261002-80-0023
Уязвимость postgresql16
ROS-20261002-80-0022
Уязвимость postgresql15
ROS-20261002-80-0021
Уязвимость postgresql14
ROS-20261002-80-0020
Уязвимость postgresql
ROS-20261002-73-0020
Уязвимость postgresql18
ROS-20261002-73-0019
Уязвимость postgresql17
ROS-20261002-73-0018
Уязвимость postgresql16
ROS-20261002-73-0017
Уязвимость postgresql15
ROS-20261002-73-0016
Уязвимость postgresql14
RLSA-2026:72274
Important: postgresql:12 security update
ELSA-2026-72274
ELSA-2026-72274: postgresql:12 security update (IMPORTANT)
Уязвимостей на страницу
Уязвимость | CVSS | EPSS | Опубликовано | |
|---|---|---|---|---|
 | CVE-2026-18408 Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. | CVSS3: 8.8 | 0% Низкий | 3 месяца назад |
 | CVE-2026-18408 Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. | CVSS3: 8.4 | 0% Низкий | 3 месяца назад |
 | CVE-2026-18408 Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.6, 17.11, 16.15, 15.19, and 14.24 are affected. | CVSS3: 8.8 | 0% Низкий | 3 месяца назад |
 | CVE-2026-18408 PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client | CVSS3: 8.8 | 0% Низкий | 3 месяца назад |
| CVE-2026-18408 Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious s ... | CVSS3: 8.8 | 0% Низкий | 3 месяца назад |
| GHSA-p745-282f-cxpr Untrusted data inclusion in pg_dump in PostgreSQL allows a malicious superuser of the origin server to inject arbitrary code for restore-time execution as the client operating system account running psql to restore the dump, via psql \restrict meta-command input expansion. The fix for CVE-2025-8714 introduced \restrict and \unrestrict to block this attack, but \unrestrict itself was sufficient for an attack. pg_dumpall is also affected. pg_restore is affected when used to generate a plain-format dump. Non-core use of \restrict would be affected, but we've not identified non-core use. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected. | CVSS3: 8.8 | 0% Низкий | 3 месяца назад |
 | BDU:2026-11972 Уязвимость утилиты pg_dump системы управления базами данных PostgreSQL, позволяющая нарушителю выполнить произвольный код | CVSS3: 8.8 | 0% Низкий | 3 месяца назад |
 | ROS-20261002-80-0025 Уязвимость postgresql18 | CVSS3: 8.8 | 0% Низкий | около 1 месяца назад |
| ROS-20261002-80-0024 Уязвимость postgresql17 | CVSS3: 8.8 | 0% Низкий | около 1 месяца назад |
| ROS-20261002-80-0023 Уязвимость postgresql16 | CVSS3: 8.8 | 0% Низкий | около 1 месяца назад |
| ROS-20261002-80-0022 Уязвимость postgresql15 | CVSS3: 8.8 | 0% Низкий | около 1 месяца назад |
| ROS-20261002-80-0021 Уязвимость postgresql14 | CVSS3: 8.8 | 0% Низкий | около 1 месяца назад |
| ROS-20261002-80-0020 Уязвимость postgresql | CVSS3: 8.8 | 0% Низкий | около 1 месяца назад |
| ROS-20261002-73-0020 Уязвимость postgresql18 | CVSS3: 8.8 | 0% Низкий | около 1 месяца назад |
| ROS-20261002-73-0019 Уязвимость postgresql17 | CVSS3: 8.8 | 0% Низкий | около 1 месяца назад |
| ROS-20261002-73-0018 Уязвимость postgresql16 | CVSS3: 8.8 | 0% Низкий | около 1 месяца назад |
| ROS-20261002-73-0017 Уязвимость postgresql15 | CVSS3: 8.8 | 0% Низкий | около 1 месяца назад |
| ROS-20261002-73-0016 Уязвимость postgresql14 | CVSS3: 8.8 | 0% Низкий | около 1 месяца назад |
 | RLSA-2026:72274 Important: postgresql:12 security update | около 1 месяца назад | ||
| ELSA-2026-72274 ELSA-2026-72274: postgresql:12 security update (IMPORTANT) | около 1 месяца назад |
Уязвимостей на страницу