CVE Watch14 ago 2026

CVE-2026-14680

Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running

CVSS

8.8

Alto

EPSS

—

KEV

—

Exploit Today

—

0-100

Publicado: 13 ago 2026 · Última mod.: 14 ago 2026 · CWE-843

EPSS · 30d

Sin historial EPSS suficiente todavía.

Descripción técnica

Type confusion with PostgreSQL "internal" data type arguments allows any user to execute arbitrary code as the operating system user running the database, via calls to functions with that argument type. Type "internal" represents a class of mutually-incompatible data structures not intended for access from SQL. The system intended to prevent such function calls, but this prevention had gaps. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.

Referencias oficiales

www.postgresql.orghttps://www.postgresql.org/support/security/CVE-2026-14680/

CVEs relacionados

CVECVSSEPSSKEVRExplotTítuloVis.

CVE-2026-162398.8 ALT

—

———Type confusion in PostgreSQL "portal"/cursor lifecycle allows a user to execute arbitrary code as the operating system user running the database, via re-creation of a cursor or other portal with different types. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.16h CVE-2026-162388.8 ALT

—

———Type confusion in PostgreSQL pg_restore_attribute_stats() allows an object creator to execute arbitrary code as the operating system user running the database, via conflation of range and multirange values. Within major version 18, minor versions before PostgreSQL 18.5 are affected. Versions before PostgreSQL 18 are unaffected.16h CVE-2026-146718.8 ALT

—

———Type confusion in PostgreSQL module "refint" allows an object creator to execute arbitrary code as the operating system user running the database. The fix for this emerged as a non-security bug report, and the fix appear in the git repository with subject "refint: Remove plan cache.", without a CVE number. Versions before PostgreSQL 18.5, 17.11, 16.15, 15.19, and 14.24 are affected.16h CVE-2026-703395.4 MED

15.2%

——5Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.2d CVE-2026-187016.5 MED

22.7%

——7An issue in MongoDB Server's query subsystem could allow an authenticated user with read privileges to cause the server process to terminate unexpectedly by submitting a specially formed query filter. This could result in a denial of service.3d CVE-2026-688117.8 ALT

22.8%

——7Access of resource using incompatible type ('type confusion') in Microsoft Office Excel allows an unauthorized attacker to execute code locally.1d