EnterpriseDB

Products

Exploited and recent CVEs

• CVE-2026-104949 Medium 5.4 WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in gp_add_coordinator_standby(). The function is named gp_add_master_st 0.2%
• CVE-2026-104948 High 7.1 WarehousePG (WHPG) 6.27.1 through 6.27.6 and 7.2.1 through 7.6.0 are affected by a missing authorization vulnerability (CWE-862) in the built-in cluster expansion functions gp_expand_lock_catalog() an 0.2%
• CVE-2026-104947 Medium 5.3 WarehousePG (WHPG) 7.2.1 through 7.6.0 is affected by a missing authorization vulnerability (CWE-862) in the built-in function gp_log_backend_memory_contexts(). Any authenticated database role can run 0.2%
• CVE-2026-93853 High 7.2 Barman snapshot backup deletion trusts unverified backup catalog metadata 0.2%
• CVE-2026-96538 High 8.7 WarehousePG pg_file_write/pg_file_rename/pg_file_unlink/pg_logdir_ls privilege escalation 0.3%
• CVE-2026-50738 High 7.7 A use-after-free condition exists in pglogical's worker signaling code, where a worker structure can be dereferenced after the underlying slot has been freed or recycled during normal worker lifecycle 0.5%
• CVE-2026-50737 Critical 9.0 When applying replicated changes for a row that is missing one or more columns, pglogical evaluates the affected table's default expressions on the subscriber. Because the apply worker runs at a privi 0.4%
• CVE-2026-50736 Critical 9.0 The pglogical queue mechanism, used to convey out-of-band commands such as replicated DDL from a publisher to a subscriber, executes message payloads on the subscriber at the privilege level of the ap 0.4%
• CVE-2026-50735 Medium 6.1 pglogical's apply worker does not sufficiently validate the length of certain fields in incoming replication protocol messages before copying them, resulting in an out-of-bounds read. A party acting a 0.4%
• CVE-2026-0949 Medium 6.5 PEM versions prior to 9.8.1 are affected by a stored Cross-site Scripting (XSS) vulnerability that allows users with access to the Manage Charts menu to inject arbitrary JavaScript when creating a new 0.2%
• CVE-2025-14038 High 7.0 EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. This could allow an attacker to read potentially sensitive data or possibly cause 0.2%
• CVE-2025-14038 High 7.0 EDB Hybrid Manager contains a flaw that allows an unauthenticated attacker to directly access certain gRPC endpoints. This could allow an attacker to read potentially sensitive data or possibly cause 0.2%
• CVE-2025-2506 Medium 5.3 When pglogical attempts to replicate data, it does not verify it is using a replication connection, which means a user with CONNECT access to a database configured for replication can execute the pglo 0.3%
• CVE-2025-2506 Medium 5.3 When pglogical attempts to replicate data, it does not verify it is using a replication connection, which means a user with CONNECT access to a database configured for replication can execute the pglo 0.3%
• CVE-2024-4545 High 7.7 EDB Postgres Advanced Server (EPAS) authenticated file read permissions bypass using edbldr 0.5%