34 vulnerabilities across 1 product scored HIGH or above on November 12, 2026.

  • 🟠 HIGH: 34

🟠 [HIGH] postgresql/postgresql

34 CVEs | CVSS 3.1: 8.8 | AAS 10.6

  • cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* (>= 14.0, < 14.25)
  • cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* (>= 16.0, < 16.16)
  • cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* (>= 17.0, < 17.12)
  • cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* (>= 18.0, < 18.7)
  • cpe:2.3:a:postgresql:postgresql:*:*:*:*:*:*:*:* (>= 11.0, < 11.22)

PostgreSQL has disclosed 34 vulnerabilities affecting multiple release branches, with the most severe carrying a CVSS score of 8.8 (HIGH). The lead vulnerability, CVE-2026-116330, is an incomplete fix for CVE-2025-8714 that allows a compromised origin server to execute arbitrary code on the client system during pg_dump tar-format restoration via psql, exploiting a predictable restriction key in the undocumented restore.sql file. Versions prior to PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected, and the vulnerability is considered exploitable.

Database administrators and any teams running PostgreSQL in production, development, or backup workflows should treat this as a priority update. The large number of CVEs in this batch means multiple attack surfaces are addressed, including at least one that could lead to remote code execution in common backup and restore scenarios. Organizations should upgrade to the latest patched release for their major version branch immediately and review vendor advisories for the full set of fixes at the PostgreSQL security page.

Vendor Advisory