Vulnerability feed
CVE and vendor PSIRT advisories from 13 sources, last 30 days. Updated hourly, last run
| Expand | Severity |
Score |
Advisory |
Title |
Source |
Flags |
Published |
|---|---|---|---|---|---|---|---|
| High | 8.4 | CVE-2026-63120 |
pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores
Aiven-Open, pghoardAiven-Open pghoard, pghoard
|
NVD | |||
|
CVE-2026-63120pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores
Executive summaryAn incomplete fix for a path traversal flaw in pghoard, a PostgreSQL backup tool, lets an attacker who can write to the backup storage place files anywhere on the restoring host. The advisory rates it High, with a CVSS score of 8.4. The vendor recommends upgrading to version 2.7.2, which is not yet described as released at the time of the advisory, and states there are no workarounds. Technical summaryThe flaw is CWE-22 path traversal in restore.py, where an incomplete earlier fix still lets a crafted delta backup manifest write files and create directories outside the PostgreSQL data directory. The attacker needs write access to the backup object store (such as S3, GCS, or Azure), and the write happens when a database administrator runs pghoard_restore get-basebackup. Affected versions are stated as up to and including 2.7.1, and the patched version is stated as 2.7.2. The advisory states there are no known workarounds, and it gives CVSS v3.1 vector CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H with a base score of 8.4. Exploitation in the wild, specific detection guidance, and the exact release date of 2.7.2 are not stated. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Aiven-Open/pghoard/security/…/GHSA-rh99-q79h-vvx3 Impact if exploitedConfidentialityHigh IntegrityHigh AvailabilityHigh
How it is exploited
CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:C/C:H/I:H/A:H Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||
| Low | 2.4 | CVE-2026-54711 |
pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores
Aiven-Open, pghoardAiven-Open pghoard, pghoard
|
NVD | |||
|
CVE-2026-54711pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores
Executive summaryThe pghoard PostgreSQL backup tool writes database usernames and passwords to its debug log when it uses a .pgpass file. The advisory rates the issue Low, with a CVSS v4 base score of 2.4, and the vendor recommends upgrading to version 2.7.1 or later. Technical summaryThis is CWE-532, insertion of sensitive information into a log file: when .pgpass is used, the connection username and password are written at debug log level. The attack requires local access with High privileges and passive user interaction, and the CVSS v4 vector is CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N. Affected versions are stated as less than 2.7.1 and the patched version is 2.7.1. The advisory's workaround is to filter out debug-level logs. The advisory does not state whether exploitation has been observed in the wild, and it gives no detection guidance. Summaries are generated by AI from the linked advisory text. Confirm versions and fixes at the source. Summarized from github.com/Aiven-Open/pghoard/security/…/GHSA-mpx4-jmpr-vm8v Impact if exploitedConfidentialityLow IntegrityNone AvailabilityNone
How it is exploited
CVSS:4.0/AV:L/AC:L/AT:N/PR:H/UI:P/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X Affects
NIST National Vulnerability DatabasePublished
Read the advisory
|
|||||||