Red Hat Linux OS and other open source products

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in any Red Hat product.

RSS Feeds for Red Hat security vulnerabilities

Create a CVE RSS feed including security vulnerabilities found in Red Hat products with stack.watch. Just hit watch, then grab your custom RSS feed url.

Products by Red Hat Sorted by Most Security Vulnerabilities since 2018

Red Hat Enterprise Linux (RHEL)3071 vulnerabilities

Red Hat Enterprise Linux Server1534 vulnerabilities
RedHat Enterprise Linux (RHEL) Server. Includes software bundeled with RHEL server.

Red Hat Enterprise Linux Workstation1504 vulnerabilities
RedHat Enterprise Linux (RHEL) Workstation. Includes software bundled with RHEL Workstation.

Red Hat Enterprise Linux Desktop1493 vulnerabilities
RedHat Enterprise Linux (RHEL) Desktop. Includes software bundled with RHEL desktop

Red Hat Enterprise Linux Eus1251 vulnerabilities

Red Hat Rhel Els1233 vulnerabilities

Red Hat Enterprise Linux Server Aus884 vulnerabilities

Red Hat Openshift762 vulnerabilities

Red Hat Rhel Eus721 vulnerabilities

Red Hat Enterprise Linux Server Tus701 vulnerabilities

Red Hat Rhel E4s602 vulnerabilities

Red Hat Rhel Tus511 vulnerabilities

Red Hat Rhel Aus500 vulnerabilities

Red Hat Openshift Ai438 vulnerabilities

Red Hat Rhel Eus Long Life417 vulnerabilities

Red Hat Enterprise Linux Server Eus414 vulnerabilities

Red Hat Satellite408 vulnerabilities

Red Hat Hummingbird401 vulnerabilities

Red Hat Jboss Enterprise Application Platform343 vulnerabilities

Red Hat Openstack319 vulnerabilities

Red Hat Build Keycloak315 vulnerabilities

Red Hat Single Sign On288 vulnerabilities

Red Hat Jbosseapxp265 vulnerabilities

Red Hat Ansible Automation Platform263 vulnerabilities

Red Hat Jboss Fuse252 vulnerabilities

Red Hat Openshift Container Platform230 vulnerabilities

Red Hat Jboss Data Grid218 vulnerabilities

Red Hat Rhivos199 vulnerabilities

Red Hat Enterprise Linux Ai168 vulnerabilities

Red Hat Openshift Devspaces168 vulnerabilities

Red Hat Quay168 vulnerabilities

Red Hat Acm163 vulnerabilities

Red Hat Kafka142 vulnerabilities

Red Hat Rhdh130 vulnerabilities

Red Hat Discovery129 vulnerabilities

Red Hat Software Collections123 vulnerabilities

Red Hat Keycloak123 vulnerabilities

Red Hat Cryostat121 vulnerabilities

Red Hat Ai Inference Server117 vulnerabilities

Red Hat Virtualization115 vulnerabilities

Red Hat Camel Spring Boot113 vulnerabilities

Red Hat Rhui109 vulnerabilities

Red Hat Enterprise Linux Ibm Z Systems108 vulnerabilities

Red Hat Ceph Storage106 vulnerabilities

Red Hat Ansible Automation Platform Developer104 vulnerabilities

Red Hat Enterprise Linux Power Little Endian103 vulnerabilities

Red Hat Jboss Enterprise Bpms Platform102 vulnerabilities

Red Hat Multicluster Engine101 vulnerabilities

Red Hat Apache Camel Hawtio99 vulnerabilities

Red Hat Amq Broker97 vulnerabilities

Red Hat Trusted Artifact Signer96 vulnerabilities

Red Hat Openshift Pipelines96 vulnerabilities

Red Hat Single Sign On95 vulnerabilities

Red Hat Quarkus94 vulnerabilities

Red Hat Advanced Cluster Security94 vulnerabilities

Red Hat Ansible Automation Platform Inside94 vulnerabilities

Red Hat Container Native Virtualization93 vulnerabilities

Red Hat Amq Streams92 vulnerabilities

Red Hat Logging92 vulnerabilities

Red Hat Enterprise Linux Power Little Endian Eus88 vulnerabilities

Red Hat Service Mesh88 vulnerabilities

Red Hat Openshift Data Foundation84 vulnerabilities

Red Hat Satellite Capsule83 vulnerabilities

Red Hat Enterprise Linux Ibm Z Systems Eus82 vulnerabilities

Red Hat Camel Quarkus82 vulnerabilities

Red Hat Ansible Portal80 vulnerabilities

Red Hat Apicurio Registry79 vulnerabilities

Red Hat Serverless79 vulnerabilities

Red Hat Openshift Lightspeed76 vulnerabilities

Red Hat Migration Toolkit Applications74 vulnerabilities

Red Hat Http Server74 vulnerabilities

Red Hat Cert Manager72 vulnerabilities

Red Hat Enterprise Linux Scientific Computing71 vulnerabilities

Red Hat Openshift Gitops70 vulnerabilities

Red Hat Ansible Tower69 vulnerabilities

Red Hat Satellite Utils69 vulnerabilities

Red Hat 3scale Amp64 vulnerabilities

Red Hat Enterprise Linux Server Power Little Endian Update Services Sap Solutions61 vulnerabilities

Red Hat Podman Desktop60 vulnerabilities

Red Hat Apache Camel Spring Boot58 vulnerabilities

Red Hat Rhmt57 vulnerabilities

Red Hat Debezium57 vulnerabilities

Red Hat Directory Server56 vulnerabilities

Red Hat Libvirt55 vulnerabilities

Red Hat Multicluster Globalhub55 vulnerabilities

Red Hat Service Registry54 vulnerabilities

Red Hat Satellite Maintenance53 vulnerabilities

Red Hat Virtualization Host53 vulnerabilities

Red Hat Openshift Distributed Tracing52 vulnerabilities

Red Hat Network Observ Optr51 vulnerabilities

Red Hat Jboss Core Services49 vulnerabilities

Red Hat Apache Camel Quarkus46 vulnerabilities

Red Hat Confidential Compute Attestation46 vulnerabilities

Red Hat Enterprise Linux Power Big Endian45 vulnerabilities

Red Hat Insights Proxy44 vulnerabilities

Recent Red Hat Security Advisories

Advisory	Title	Published
RHSA-2026:100159	(RHSA-2026:100159) General availability of the satellite/iop-yuptoo-rhel9 container image	November 13, 2026
RHSA-2026:100158	(RHSA-2026:100158) Technical preview of the satellite/iop-vmaas-rhel9 container image	November 13, 2026
RHSA-2026:100155	(RHSA-2026:100155) General availability of the satellite/iop-advisor-backend-rhel9 container image	November 13, 2026
RHSA-2026:100153	(RHSA-2026:100153) General availability of the satellite/iop-insights-engine-rhel9 container image	November 13, 2026
RHSA-2026:100152	(RHSA-2026:100152) satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview	November 13, 2026
RHSA-2026:100151	(RHSA-2026:100151) General availability of the satellite/iop-insights-engine-rhel9 container image	November 13, 2026
RHSA-2026:100150	(RHSA-2026:100150) satellite/iop-vulnerability-engine-rhel9 container image available as a Technology Preview	November 13, 2026
RHSA-2026:100149	(RHSA-2026:100149) General availability of the satellite/iop-advisor-backend-rhel9 container image	November 13, 2026
RHSA-2026:100147	(RHSA-2026:100147) Technical preview of the satellite/iop-vulnerability-frontend-rhel9 container image	November 13, 2026
RHSA-2026:100146	(RHSA-2026:100146) General availability of the satellite/iop-advisor-frontend-rhel9 container image	November 13, 2026

By the Year

In 2026 there have been 6075 vulnerabilities in Red Hat with an average score of 7.3 out of ten. Last year, in 2025 Red Hat had 1207 security vulnerabilities published. That is, 4868 more vulnerabilities have already been reported in 2026 as compared to last year. However, the average CVE base score of the vulnerabilities in 2026 is greater by 0.40.

Year	Vulnerabilities	Average Score
2026	6075	7.28
2025	1207	6.88
2024	1705	6.83
2023	1208	6.74
2022	1362	6.98
2021	1123	6.54
2020	664	6.37
2019	772	6.93
2018	762	7.17

It may take a day or so for new Red Hat vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Red Hat Security Vulnerabilities

CVE	Date	Vulnerability	Products
CVE-2026-128886	Nov 13, 2026	D-Bus nonce-tcp transport DoS via stalled unauthenticated connection A flaw was found in dbus when configured with the nonce-tcp transport. An unauthenticated attacker able to connect to an exposed listener can cause a Denial of Service (DoS) by opening a connection and withholding the expected authentication token. Because the server processes this verification without enforcing a timeout, the stalled connection blocks the accept process and prevents legitimate clients from establishing new connections.	Enterprise Linux (RHEL)
CVE-2026-110330	Nov 13, 2026	Local PrivEsc via PID Spoofing in ABRT Server (abrt.socket) A flaw was found in abrt. abrt-server trusts a client-supplied PID when creating problem dumps over abrt.socket and, running as root, copies that process's /proc data (including environ) into a dump directory owned by the connecting unprivileged user. This allows a local attacker to read environment variables and related metadata of other users' or root processes when abrtd is running.	Rhel Els Enterprise Linux (RHEL)
CVE-2026-110331	Nov 13, 2026	ABRT local privilege bypass via dump dir count check A flaw was found in abrt. The completeness check introduced to mitigate CVE-2026-54228 and CVE-2026-54229 only verifies that a dump directory contains a "count" element, which an unprivileged user can create. This allows a local attacker to bypass the guard and again poison elements in, or seize ownership of, dump directories while privileged ABRT handlers are processing them. Related Problems2 mutating methods remain ungated by the same check.	Rhel Els Enterprise Linux (RHEL)
CVE-2026-128987	Nov 13, 2026	dbus DoS via socket retry loop (CPU exhaustion) A flaw was found in dbus. A local attacker can exploit this vulnerability by connecting to an affected service, requesting a response, and stopping socket reads while keeping the connection open. Because the socket transport handles broken pipe write errors as retryable, the application enters a continuous retry loop. This can lead to excessive CPU consumption, resulting in a denial of service (DoS) for the target process.	Enterprise Linux (RHEL)
CVE-2026-128885	Nov 13, 2026	D-Bus select() FD OOB Write DoS A flaw was found in D-Bus. In configurations where the daemon falls back to using the Unix select() mechanism for event monitoring, it does not verify whether file descriptor numbers exceed allocated limits. A local attacker can exploit this flaw by opening a large number of concurrent connections to trigger an out-of-bounds write on the stack. This can cause the daemon to crash, resulting in a Denial of Service (DoS).	Enterprise Linux (RHEL)
CVE-2026-123177	Nov 13, 2026	Unauthenticated D-Bus RCE in dnf5daemon-server (root pkg loader) A flaw was found in dnf5daemon-server. Unauthenticated D-Bus methods pass caller-controlled URL or .rpm path patterns into a root-privileged cmdline package loader that may store fetched content in a world-readable cache without size limits, or open local paths as root, allowing a local attacker to disclose privileged content and to deny service via disk exhaustion.	Hummingbird
CVE-2026-128824	Nov 13, 2026	Red Hat Quay Reflected XSS via v1 Registry API error handler A flaw was found in Red Hat Quay. The v1 registry API error handler reflects the attacker-supplied image_id path segment in a response served as text/html, allowing a reflected cross-site scripting (XSS) attack. By tricking a user into visiting a specially crafted URL, a remote attacker can execute arbitrary JavaScript in the victim's browser within the Quay origin, potentially compromising the user's session.	Mirror Registry Quay
CVE-2026-128424	Nov 13, 2026	Kroxylicious ACL Authorizer Regex Escaping Bypass A flaw was found in Kroxylicious. The ACL authorizer's rules-file parser unquotes `matching //` regular-expression literals using the string unquoting rules, which strips every backslash escape. As a result, an allow rule such as `matching /orders\.v1/` is compiled as the regex `orders.v1`, which also matches unintended names such as `ordersXv1`, and character classes such as `\d` and `\w` lose their special meaning. Allow rules written with regex escapes can therefore apply to more resources than the author intended. Depending on the ACL configuration, this may allow an authenticated Kafka client to access a resource (such as read or write a topic) that should have been denied.	Amq Streams
CVE-2026-86324	Nov 12, 2026	Foreman SSH Key Authorization Bypass via API A flaw was found in Foremans Api::V2::SshKeysController, where the target user is resolved through Foreman::Controller::UserAware#find_user using User.find(params[:user_id]) without enforcing the required parent-user authorization check. An attacker with the create_ssh_keys permission can exploit this authorization bypass by submitting POST /api/v2/users/:user_id/ssh_keys with another users ID and injecting their own public SSH key into the targeted account. The injected key is subsequently propagated to hosts provisioned by that user, potentially allowing the attacker to authenticate to and gain SSH access to the victims managed hosts.	Satellite Satellite Capsule Satellite Utils And others...
CVE-2026-86323	Nov 12, 2026	Foreman API V2 MailNotifications Auth Bypass & Access Control Flaw A flaw was found in Foremans Api::V2::MailNotificationsController, where authorization checks on user-specific mail-notification resources are insufficient. The GET /api/v2/users/:id/mail_notifications endpoint resolves the target account using User.find(params[:id]) without verifying that the authenticated user is authorized to access that users notification configuration. Additionally, the POST and PUT /api/v2/users/:user_id/mail_notifications paths call deny_access when the requester is unauthorized but fail to halt execution, allowing the request to continue and persist the unauthorized change despite a 403 response or subsequent DoubleRenderError. This can allow a user to disclose another users mail-notification configuration, including mail_query values, and, where write permissions apply, modify or create notification settings for another user.	Satellite Satellite Capsule Satellite Utils And others...
CVE-2026-86322	Nov 12, 2026	Foreman API Personal Access Token IDOR A flaw was found in Foremans Api::V2::PersonalAccessTokensController, where Foreman::Controller::UserAware#find_user resolves the target account using User.find(params[:user_id]) without applying the required parent-user authorization check. An attacker with the create_personal_access_tokens permission can therefore invoke POST /api/v2/users/:user_id/personal_access_tokens with another users ID and create a Personal Access Token on their behalf. The resulting plaintext token is returned in the API response, while PersonalAccessToken#check_permissions_after_save only validates create_personal_access_tokens on the token and does not enforce edit_users authorization on the target user. The attacker can then use the forged token to authenticate as the victim, potentially resulting in complete account takeover, including administrator accounts.	Satellite Satellite Capsule Satellite Utils And others...
CVE-2026-111456	Nov 12, 2026	Candlepin Missing Auth Check Enables Cross-Org Consumer Registration A missing authorization check has been found in ConsumerResource.setupOwner() function of consumer registration module in the Candlepin package. The registration method checks permission to create a consumer only when the caller is a user. A consumer that authenticates with its identity certificate does not go through that check. A low-privileged network attacker or user who has a valid consumer certificate for one organization can register a new consumer in a different organization by supplying that organization's key. The response includes an identity certificate for the new consumer. With that certificate, the attacker can view the target organization's subscription pools. When the organization is not using simple content access, the attacker can attach that organization's entitlements to the new consumer.	Satellite Satellite Capsule Satellite Utils And others...
CVE-2026-107443	Nov 12, 2026	Foreman API Host-Template Render Info Disclosure (Auth) A flaw was found in Foreman. An authenticated user with view_hosts privileges can retrieve rendered provisioning template content for a host via the hosts template API endpoint, disclosing sensitive data such as the host root password. This is an incomplete fix of CVE-2026-96659, which hardened the web UI preview path but left the API host-template render path authorized for Viewer-level users.	Satellite Satellite Capsule Satellite Utils And others...
CVE-2026-107360	Nov 12, 2026	Ruby Safemode Gem Remote Method Invocation via Compound Assignment A flaw was found in rubygem-safemode. Compound assignment expressions in sandboxed code are evaluated without mediating method calls through the Jail allow-list. An authenticated attacker who can supply template content can invoke arbitrary no-argument methods on objects exposed to the template renderer without Jail mediation, including destructive operations such as host deletion and disclosure of non-allow-listed object state.	Satellite Satellite Capsule Satellite Utils And others...
CVE-2026-107152	Nov 12, 2026	Foreman smart_proxy_dynflow Auth Bypass via Client Cert (CVE2026107152) An improper authentication vulnerability has been found in the task console in the smart_proxy_dynflow package. The console accepts any client certificate signed by the capsule's certificate authority. It does not check the list of servers the capsule trusts. A low-privileged network attacker or user must already hold such a certificate. They can open the console and read job details. Those details include passwords when a job was given them. They can also cancel a running task.	Satellite Satellite Capsule Satellite Utils And others...
CVE-2026-18379	Nov 12, 2026	Path Traversal -> Arbitrary File Modification in yggdrasil-worker-package-manager A flaw was found in yggdrasil-worker-package-manager. An authenticated attacker can exploit this issue to achieve arbitrary file modification or potential privilege escalation. The vulnerability exists because repository management operations fail to sanitize directory traversal sequences (such as '../') within repository names. By supplying a crafted repository name, an attacker can manipulate the root-level worker process into creating or deleting files outside the intended directory, compromising host system integrity.	Enterprise Linux (RHEL)
CVE-2026-127101	Nov 12, 2026	SSSD PAM Responder NULLPtr DoS (CVE2026127101) A flaw was found in SSSD's PAM responder. A local attacker can send an authentication request without first negotiating the client protocol version. The responder dereferences a NULL protocol-version pointer and crashes, disrupting SSSD-backed authentication. Repeated crafted requests can sustain the denial of service.	Enterprise Linux (RHEL) Rhel Els Openshift And others...
CVE-2026-127100	Nov 12, 2026	SSSD PAM responder NULL ptr deref via malformed OAuth2 JSON A flaw was found in SSSD's PAM responder on builds with the JSON PAM extension enabled. A local attacker can submit a crafted authentication request containing a non-string OAuth2 code value. Missing JSON type validation leads to a NULL pointer dereference, terminating the PAM responder and disrupting SSSD-backed authentication.	Enterprise Linux (RHEL) Rhel Els Openshift And others...
CVE-2026-127099	Nov 12, 2026	SSSD RSA cert to SSH key stack buffer overflow (CVE2026127099) A flaw was found in SSSD's conversion of X.509 certificate RSA public keys to SSH keys. Missing size checks before copying RSA components into fixed-size stack buffers can cause a stack buffer overflow. An attacker able to supply a certificate with oversized RSA components that passes the configured certificate checks can cause denial of service and corrupt SSH responder memory.	Enterprise Linux (RHEL) Rhel Els Openshift And others...
CVE-2026-107365	Nov 12, 2026	Grafana GCM Plugin <12.6.7 SSRF via Resource Proxy A user with query access to a Google Cloud Monitoring data source can use its resource proxy to send requests to other Cloud Monitoring API paths with the data source's credentials, and read data from any project those credentials can reach. When the data source forwards the user's OAuth identity or uses Workload Identity Federation, the impact depends on that credential's permissions. Fixed in Google Cloud Monitoring plugin 12.6.7.
CVE-2026-126831	Nov 12, 2026	Stack Buffer Overflow DoS in GNU cpio (tar/ustar) A flaw was found in cpio. A local user can cause a Denial of Service (DoS) by triggering a stack-based buffer overflow when creating archives in tar or ustar formats. When archiving files owned by users or groups with names exceeding 32 characters, cpio copies these names into fixed-size memory without verifying their length. This unbounded copy corrupts stack memory and causes the application to crash.	Enterprise Linux (RHEL) Rhel Els Hummingbird And others...
CVE-2026-71363	Nov 12, 2026	AWX Debug API Unauthenticated Access Leads to DoS A flaw was found in AWX. The debug API endpoints (/api/debug/task_manager/, /api/debug/dependency_manager/, /api/debug/workflow_manager/) are registered unconditionally in the URL configuration and use AllowAny permission class with _ignore_model_permissions=True. This allows an unauthenticated remote attacker to repeatedly invoke scheduler operations that acquire database advisory locks and open transactions, potentially leading to resource exhaustion and degraded service availability.	Ansible Automation Platform
CVE-2026-121876	Nov 12, 2026	systemd-gpt-auto-generator auto-mount enables TEE memory leak in OpenShift A flaw was found in the interaction between systemd-gpt-auto-generator and confidential computing guest VM images in OpenShift Sandboxed Containers (confidential peer pods). systemd-gpt-auto-generator automatically discovers and mounts GPT partitions by type GUID at boot with no user confirmation. In the confidential computing threat model, where the host/hypervisor is the adversary, a malicious host can inject partitions into the guest's virtual disk. Most critically, injecting a swap partition causes the guest kernel to page out TEE-encrypted memory to a host-controlled block device, breaking the confidentiality guarantee of the hardware TEE (AMD SEV-SNP, Intel TDX). The PodVM images use a GPT-partitioned disk with dm-verity on the root partition. However, the roothash= kernel parameter only disables root auto-discovery non-root partitions (swap, /home, /var, /srv, /var/tmp) are still auto-discovered and mounted. The generator is shipped unmasked in the RHEL systemd-udev subpackage, and no kernel command line parameter in the measured UKI addon disables it. Additionally, the PodVM measurement script captures PCRs 3, 9, 11, and 12, but not PCR 5 (GPT partition table), so partition table modifications are not detected by remote attestation.	Enterprise Linux (RHEL) Rhel Els Openshift And others...
CVE-2026-127030	Nov 12, 2026	FreeRADIUS EAP-FAST Stack Buffer Overflow DoS (CVE-2026-127030) A flaw was found in freeradius. An improper length validation in the EAP-FAST module allows a stack-based buffer overflow during session ticket processing. A remote, unauthenticated attacker can exploit this flaw by sending a specially crafted handshake request, causing the server process to crash and resulting in a Denial of Service (DoS).	Enterprise Linux (RHEL) Rhel Els
CVE-2026-127029	Nov 12, 2026	FreeRADIUS EAPSIM Buffer Overflow DoS A flaw was found in freeradius's Extensible Authentication Protocol Method for Subscriber Identity Module (EAP-SIM) module. When handling authentication requests, the server copies a client-supplied identity into an internal structure without properly checking its length against a fixed-size buffer. An unauthenticated remote attacker can exploit this issue by sending specially crafted EAP-SIM messages, triggering a stack buffer overflow that crashes the service and results in a Denial of Service (DoS).	Enterprise Linux (RHEL) Rhel Els
CVE-2026-6467	Nov 12, 2026	PostgreSQL <14.2518.6 Uncontrolled Search Path RCE via CREATE EXTENSION Uncontrolled search path element in PostgreSQL CREATE EXTENSION allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via ALTER SCHEMA ... RENAME or CREATE EXTENSION ... SCHEMA "$user". ALTER EXTENSION was also affected. A trusted-extension script located the wrong object and executed arbitrary SQL of the attacker's choice. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-18447	Nov 12, 2026	PostgreSQL pre-18.7/17.12/16.16/15.20/14.25 Type Confusion RCE via any output Type confusion in PostgreSQL SQL-language functions allows an object creator to execute arbitrary code as the operating system user running the database, via an output parameter of type "any". Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-6460	Nov 12, 2026	PostgreSQL type conf via ALTER SET DATA TYPE (pre 18.7/17.12/16.16/15.20/14.25) Type confusion in PostgreSQL allows an object creator to execute arbitrary code as the operating system user running the database, via ALTER ... SET DATA TYPE primarily. Other DDL attack routes exist, such as "ALTER TABLE ... ADD COLUMN; ROLLBACK; ALTER TABLE ... ADD COLUMN". The system had inadequate tracking of typed values, and values were not self-identifying. Stale values could appear in data dictionary entries, PL/pgSQL variables, and many other parts of the system. PostgreSQL Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-16237	Nov 12, 2026	PostgreSQL <18.7 Autoupdatable view INSERT ON CONFLICT Privilege Bypass Improper protection in PostgreSQL INSERT ... ON CONFLICT on auto-updatable views allows an attacker having INSERT and UPDATE privileges on the view to read and modify every row in the view's base table, via iterated INSERT ... ON CONFLICT DO UPDATE. This bypasses the view's WHERE condition, whether or not the view is a security_barrier view. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-16240	Nov 12, 2026	PostgreSQL pg_basebackup format string leak (pre 18.7-14.25) Use of externally-controlled format string in PostgreSQL pg_basebackup allows an attacker having already compromised a server to achieve disclosure from pg_basebackup memory, via backup manifest bytes. The vulnerability does not return the improperly-read bytes back to the attacker's server, so a successful attack would need separate implementation-specific secrets for that. Integrity impact is unlikely; in particular, the applicable formatter does not support %n. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-120154	Nov 12, 2026	PostgreSQL <18.7, <17.12, <16.16, <15.20, <14.25 RLS Bypass via INSERT ON CONFLICT Improper protection in PostgreSQL INSERT ... ON CONFLICT allows an attacker having INSERT, UPDATE, and applicable SELECT privileges on the table to read every row despite row security policies, via iterated INSERT ... ON CONFLICT DO UPDATE. Unlike CVE-2026-16237, this does not facilitate improper writes. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-14661	Nov 12, 2026	PostgreSQL <18.7 sslkeylogfile File Name Injection DoS External control of file name in PostgreSQL dblink and CREATE/ALTER SUBSCRIPTION allows a user to achieve persistent denial of service, via appending invalid data to a chosen file. Specifically, the "sslkeylogfile" connection parameter appends data, in NSS keylog format, to a file of the user's choosing. This "sslkeylogfile" mechanism cannot add arbitrary bytes. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are also affected if libpq version 18 or later is installed and in use by the server.
CVE-2026-120153	Nov 12, 2026	PostgreSQL <14.2518.7 SQLi via extension script substitution SQL injection in PostgreSQL extension-script substitutions allows an attacker with database-level CREATE privilege to execute arbitrary code as the bootstrap superuser, via a schema or owner name containing newlines or other special substrings. This is similar to CVE-2023-39417, but it requires a non-bundled extension with a vulnerable script pattern. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-120151	Nov 12, 2026	PostgreSQL <18.7 Type Confusion in plpgsql Record Assignment RCE Type confusion in PostgreSQL plpgsql record-field assignment allows an object creator to execute arbitrary code as the operating system user running the database, via a reentrant domain CHECK that changes a RECORD variable's row type while a value is being cast. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-120152	Nov 12, 2026	PostgreSQL pg_show_all_settings() Use-After-Free (<=16.15, <=17.11, <=18.6) Use after free in PostgreSQL pg_show_all_settings() allows a database user to retrieve memory contents, via loading a module while the function is scanning custom-variable placeholders that the module replaces and frees. Within major versions 16-18, minor versions before PostgreSQL 18.7, 17.12, and 16.16 are affected. Versions before PostgreSQL 16 are unaffected.
CVE-2026-120150	Nov 12, 2026	PostgreSQL <18.7 Use-After-Free in Expanded-Record Domain Checks Use after free in PostgreSQL expanded-record domain checks allows an object creator to execute arbitrary code as the operating system user running the database, via repeated checks of a domain over a composite type that cause reuse of a dangling memory-context pointer. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-120149	Nov 12, 2026	PostgreSQL <14.25-18.7 heap overflow in postgres_fdw batch insert Heap-based buffer overflow in PostgreSQL foreign batch inserts allows a foreign server to execute arbitrary code, via reporting that it inserted more rows than the server supplied. postgres_fdw can legitimately encounter this when a rule on the remote table expands an INSERT into additional rows. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-120148	Nov 12, 2026	PostgreSQL <14.25 /15.20 /16.16 /17.12 /18.7 Type Confusion RCE Type confusion in PostgreSQL extended statistics allows an object creator to execute arbitrary code as the operating system user running the database, via a statistics expression of an anonymous RECORD type whose backend-local type identifier denotes a different row type in another session. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-120146	Nov 12, 2026	PostgreSQL <18.7/17.12/16.16/15.20/14.25: Missing Auth in REASSIGN OWNED Missing authorization in PostgreSQL REASSIGN OWNED allows a role granted INHERIT but not SET to transfer objects to the granted role. It also allows reassignment of database ownership without the CREATEDB privilege. The equivalent ALTER ... OWNER commands block this. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-120147	Nov 12, 2026	PostgreSQL dblink Use-After-Free (pre 18.7,17.12,16.16,15.20,14.25) Use after free in the PostgreSQL dblink extension allows an object creator to execute arbitrary code as the operating system user running the database, via type conversion code that re-enters dblink and closes a connection whose results an outer dblink call is reading. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-120145	Nov 12, 2026	PostgreSQL <18.7 logical replication auth bypass OS RCE Missing authorization in PostgreSQL logical replication allows a compromised publisher to execute arbitrary code as the operating system user running the superuser-owned subscription, via naming a system catalog as a replication target. Only subscriptions owned by a superuser are vulnerable. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-120143	Nov 12, 2026	PostgreSQL Use-After-Free in Functions (pre 18.7/17.12/16.16/15.20/14.25) Use after free in PostgreSQL trigger functions allows an object creator to execute arbitrary code as the operating system user running the database, via a cursor over a transition table. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-120144	Nov 12, 2026	PostgreSQL 18 <18.7 Type-Cache Confusion RCE Type confusion from incomplete PostgreSQL type-cache invalidation allows an object creator to execute arbitrary code as the operating system user running the database, via a composite type change while its cache entry is being populated. Within major version 18, minor versions before PostgreSQL 18.7 are affected. Versions before PostgreSQL 18 are unaffected.
CVE-2026-120142	Nov 12, 2026	PostgreSQL 17/18 <18.7, <17.12 Type Confusion RCE Type confusion in PostgreSQL anonymous RECORD types allows an object creator to execute arbitrary code as the operating system user running the database, via row types having dropped attributes in the same positions but with different widths or alignments. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.
CVE-2026-120141	Nov 12, 2026	PostgreSQL <18.7 Type Confusion in json_populate_recordset RCE Type confusion in PostgreSQL materialized set-returning functions allows a database user to execute arbitrary code as the operating system user running the database, via returning rows having different dynamic RECORD return types. json_populate_recordset() is one affected function. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-120139	Nov 12, 2026	PostgreSQL <18.7,17.12,16.16,15.20,14.25>: Integer Wraparound in Tuple OS Exec Integer wraparound in PostgreSQL in-memory tuple-size calculations allows a database user to execute arbitrary code as the operating system user running the database, via oversized tuple data. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-116335	Nov 12, 2026	PostgreSQL <18.7, <17.12, <16.16, <15.20, <14.25 Type Confusion RCE Type confusion in PostgreSQL operator commutator and negator links allows an object creator to execute arbitrary code as the operating system user running the database, via linking operators having different result types or creating inconsistent reciprocal links. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-116336	Nov 12, 2026	PostgreSQL REINDEX CONCURRENTLY Drop Index RCE (pre-18.7,17.12,16.16,15.20,14.25) Operation on a dropped index in PostgreSQL REINDEX CONCURRENTLY allows an object creator to execute arbitrary code as the operating system user running the database, via an index expression that issues DROP INDEX. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVE-2026-116333	Nov 12, 2026	PostgreSQL 17/18 Btree Scan Buffer Overread (pre 17.12, 18.7) Buffer over-read in PostgreSQL parallel B-tree scans allows an object creator to read attacker-chosen server-memory addresses, via a function incorrectly marked PARALLEL SAFE or STABLE to make participating workers build different scan-key arrays. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.
CVE-2026-116332	Nov 12, 2026	PostgreSQL <18.7 Use-After-Free in portal setup OS RCE Use after free in PostgreSQL portal setup allows an object creator to execute arbitrary code as the operating system user running the database, via running user-defined code during planning or executor startup that closes the portal currently being prepared. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.