Vulnerabilities
Summary — last 7 days
New vulnerabilities4,784▲ 1,735 vs. last week
Critical / high2,627▲ 1,089 vs. last week
New active exploitation (KEV)7▲ 3 vs. last week
Unscored (no CVSS)209▲ 39 vs. last week
3 results, sorted by published date (most recent first)
| CVE | Status | Severity | EPSS | Active exploitation | Affected technologies | Published ▼ | Modified | Description |
|---|---|---|---|---|---|---|---|---|
| Awaiting Analysis | Medium (5.3) | 0.12% | — | Postgresql PgjdbcAI | 10/7/2026 | 10/8/2026 | pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is shorter than its declared length with bytes left in its send buffer instead of zeros, and the server stores those bytes as part of the value. The bytes are messages the driver sent earlier on the same connection: SQL text and… | |
| Awaiting Analysis | Medium (5.9) | 0.26% | — | Postgresql PgjdbcAI | 10/7/2026 | 10/8/2026 | pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.11 through 42.7.13 enforce no restriction when the requireAuth connection property excludes all six authentication methods the driver knows, for example requireAuth=!password,!md5,!gss,!sspi,!scram-sha-256,!none. The driver then accepts any method the server asks for,… | |
| Awaiting Analysis | Medium (4.2) | 0.14% | — | PgjdbcAI | 10/7/2026 | 10/8/2026 | pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 and 42.7.5 can send the previous contents of the GSS send buffer in place of the first part of a value on a connection with GSS encryption (gssEncMode=prefer or require), and the server stores the value without an error. The buffer is 16320 bytes with MIT Kerberos.… |