CVE-2026-116308
Buffer over-read in PostgreSQL dict_int allows a database user to disclose portions of server memory, via a zero-length token. Versions bef
CVSS
4.3
Medium
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Nov 12, 2026 · Last modified: Nov 12, 2026 · CWE-126
Not enough EPSS history yet.
Buffer over-read in PostgreSQL dict_int allows a database user to disclose portions of server memory, via a zero-length token. Versions before PostgreSQL 18.7, 17.12, 16.16, 15.20, and 14.25 are affected.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-1163336.5 MED—
———Buffer over-read in PostgreSQL parallel B-tree scans allows an object creator to read attacker-chosen server-memory addresses, via a function incorrectly marked PARALLEL SAFE or STABLE to make participating workers build different scan-key arrays. Within major versions 17-18, minor versions before PostgreSQL 18.7 and 17.12 are affected. Versions before PostgreSQL 17 are unaffected.4hCVE-2026-65833——
——0iopress is a native HTTP server for Node.js with platform-specific async I/O. Prior to version 1.0.5, the chunked-transfer-encoding HTTP request parser in @iopress/core reads past the end of the input buffer when a request declares a chunk size larger than the body actually received. This results in a heap-buffer-over-read. This issue has been patched in version 1.0.5.1dCVE-2026-958845.3 MED54.2%
——16Buffer over-read in Windows Active Directory Certificate Services allows an authorized attacker to disclose information over a network.2dCVE-2026-882205.5 MED33.2%
——10Buffer over-read in Windows Performance Counters allows an authorized attacker to disclose information locally.2dCVE-2026-836847.5 HIG62.5%
——19Buffer over-read in Windows iSCSI Target Service allows an unauthorized attacker to disclose information over a network.2dCVE-2026-1242336.5 MED53.9%
——16Buffer over-read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.2d