バージョンを確認する
psql --version10.3 に影響するCVE
| CVE | タイトル | CVSS | 悪用 | EPSS | 公開日 |
|---|---|---|---|---|---|
| CVE-2020-25695 | A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 an... | 8.8 | — | 2020-11-16 | |
| CVE-2019-10127 | A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for BigSQL-supplied... | 8.8 | — | 2021-03-20 | |
| CVE-2021-32027 | A flaw was found in postgresql in versions before 13.3, before 12.7, before 11.12, before 10.17 and before 9.6... | 8.8 | — | 2021-06-01 | |
| CVE-2022-1552 | A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged... | 8.8 | — | 2022-08-31 | |
| CVE-2026-6473 | PostgreSQL server undersizes allocations, via integer wraparound | 8.8 | — | 2026-05-14 | |
| CVE-2026-6475 | PostgreSQL pg_basebackup and pg_rewind can overwrite unrelated files of origin superuser choice | 8.8 | — | 2026-05-14 | |
| CVE-2026-6477 | PostgreSQL libpq lo_* functions let server superuser overwrite client stack memory | 8.8 | — | 2026-05-14 | |
| CVE-2026-6637 | PostgreSQL refint allows stack buffer overflow and SQL injection | 8.8 | — | 2026-05-14 | |
| CVE-2026-116323 | PostgreSQL pltcl reentrant result conversion use-after-free executes arbitrary code | 8.8 | 0.6% | 2026-11-12 | |
| CVE-2026-116326 | PostgreSQL plperl tied-object exceptions follow stale sigjmp_buf | 8.8 | 0.6% | 2026-11-12 | |
| CVE-2026-116330 | PostgreSQL pg_dump tar restore.sql fails to block psql command injection | 8.8 | 0.4% | 2026-11-12 | |
| CVE-2026-120145 | PostgreSQL logical replication can write to subscriber system catalogs, executing arbitrary code | 8.8 | 0.5% | 2026-11-12 | |
| CVE-2026-120147 | PostgreSQL dblink reentrant disconnect use-after-free executes arbitrary code | 8.8 | 0.6% | 2026-11-12 | |
| CVE-2026-120149 | PostgreSQL FDW batch-insert mismatch executes arbitrary code | 8.8 | 0.6% | 2026-11-12 | |
| CVE-2026-120150 | PostgreSQL expanded-record domain-check use-after-free executes arbitrary code | 8.8 | 0.6% | 2026-11-12 | |
| CVE-2018-10915 | A vulnerability was found in libpq, the default PostgreSQL client library where libpq failed to properly reset... | 8.5 | — | 2018-08-10 | |
| CVE-2020-25694 | A flaw was found in PostgreSQL versions before 13.1, before 12.5, before 11.10, before 10.15, before 9.6.20 an... | 8.1 | — | 2020-11-16 | |
| CVE-2021-23214 | When the server is configured to use trust authentication with a clientcert requirement or to use cert authent... | 8.1 | — | 2022-03-04 | |
| CVE-2026-120148 | PostgreSQL extended-statistics pseudo-type confusion executes arbitrary code | 8.1 | 0.5% | 2026-11-12 | |
| CVE-2022-2625 | A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at... | 8.0 | — | 2022-08-18 | |
| CVE-2018-16850 | postgresql before versions 11.1, 10.6 is vulnerable to a to SQL injection in pg_upgrade and pg_dump via CREATE... | 8.0 | — | 2018-11-14 | |
| CVE-2019-10128 | A vulnerability was found in postgresql versions 11.x prior to 11.3. The Windows installer for EnterpriseDB-su... | 7.8 | — | 2021-03-20 | |
| CVE-2019-10211 | Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via bundled Ope... | 7.8 | — | 2019-10-29 | |
| CVE-2020-25696 | A flaw was found in the psql interactive terminal of PostgreSQL in versions before 13.1, before 12.5, before 1... | 7.5 | — | 2020-11-24 | |
| CVE-2026-6479 | PostgreSQL SSL/GSS init causes denial of service, via uncontrolled recursion | 7.5 | — | 2026-05-14 | |
| CVE-2019-10164 | PostgreSQL versions 10.x before 10.9 and versions 11.x before 11.4 are vulnerable to a stack-based buffer over... | 7.5 | — | 2019-06-27 | |
| CVE-2019-10208 | A flaw was discovered in postgresql versions 9.4.x before 9.4.24, 9.5.x before 9.5.19, 9.6.x before 9.6.15, 10... | 7.5 | — | 2019-10-29 | |
| CVE-2020-14350 | It was found that some PostgreSQL extensions did not use search_path safely in their installation script. An a... | 7.3 | — | 2020-08-24 | |
| CVE-2020-10733 | The Windows installer for PostgreSQL 9.5 - 12 invokes system-provided executables that do not have fully-quali... | 7.3 | — | 2020-09-16 | |
| CVE-2019-9193 | In PostgreSQL 9.3 through 11.2, the "COPY TO/FROM PROGRAM" function allows superusers and users in the 'pg_exe... | 7.2 | — | 2019-04-01 | |
| CVE-2020-14349 | It was found that PostgreSQL versions before 12.4, before 11.9 and before 10.14 did not properly sanitize the... | 7.1 | — | 2020-08-24 | |
| CVE-2018-10925 | It was discovered that PostgreSQL versions before 10.5, 9.6.10, 9.5.14, 9.4.19, and 9.3.24 failed to properly... | 7.1 | — | 2018-08-10 | |
| CVE-2019-10210 | Postgresql Windows installer before versions 11.5, 10.10, 9.6.15, 9.5.19, 9.4.24 is vulnerable via superuser w... | 6.7 | — | 2019-10-29 | |
| CVE-2021-32028 | A flaw was found in postgresql. Using an INSERT ... ON CONFLICT ... DO UPDATE command on a purpose-crafted tab... | 6.5 | — | 2021-10-11 | |
| CVE-2026-6478 | PostgreSQL discloses MD5-hashed passwords via covert timing channel | 6.5 | — | 2026-05-14 | |
| CVE-2021-23222 | A man-in-the-middle attacker can inject false responses to the client's first few queries, despite the use of... | 5.9 | — | 2022-03-02 | |
| CVE-2021-43767 | Odyssey passes to client unencrypted bytes from man-in-the-middle When Odyssey storage is configured to use th... | 5.9 | — | 2022-08-26 | |
| CVE-2026-6472 | PostgreSQL CREATE TYPE does not check multirange schema CREATE privilege | 5.4 | — | 2026-05-14 | |
| CVE-2021-3393 | An information leak was discovered in postgresql in versions before 13.2, before 12.6 and before 11.11. A user... | 4.3 | — | 2021-04-01 | |
| CVE-2026-6474 | PostgreSQL timeofday() can disclose portions of server memory | 4.3 | — | 2026-05-14 | |
| CVE-2018-1115 | postgresql before versions 10.4, 9.6.9 is vulnerable in the adminpack extension, the pg_catalog.pg_logfile_rot... | 4.2 | — | 2018-05-11 | |
| CVE-2020-1720 | A flaw was found in PostgreSQL's "ALTER ... DEPENDS ON EXTENSION", where sub-commands did not perform authoriz... | 3.1 | — | 2020-03-18 | |
| CVE-2019-10130 | A vulnerability was found in PostgreSQL versions 11.x up to excluding 11.3, 10.x up to excluding 10.8, 9.6.x u... | 3.1 | — | 2019-07-31 |
データ：CVE List（CVE® Program）、NVD、CISA KEV、FIRST EPSS（EPSS については https://www.first.org/epss を参照）、endoflife.date。ソフトウェア一覧：awesome-selfhosted（CC BY-SA 3.0）。