Vulnerability database
Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.
14 results
May 8, 2026pgx is a PostgreSQL driver and toolkit for Go.CVE-2026-41889 · Other software · jackc · reported by GitHubLow 2.3
pgx is a PostgreSQL driver and toolkit for Go. Prior to version 5.9.2, SQL injection can occur when the non-default simple protocol is used, a dollar quoted string literal is used in the SQL query, that string literal contains text that would be would be interpreted as a placeholder outside of a string literal, and the value of that placeholder is controllable by the attacker. This issue has been patched in version 5.9.2.
- Product
- pgx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Apr 7, 2026Memory-safety vulnerability in github.com/jackc/pgx/v5.CVE-2026-33816 · Other software · github.com/jackc/pgx/v5 · reported by security@golang.orgCritical 9.8
Memory-safety vulnerability in github.com/jackc/pgx/v5.
- Product
- github.com/jackc/pgx/v5/pgproto3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpkg.go.devaccess.redhat.com
Apr 7, 2026Memory-safety vulnerability in github.com/jackc/pgx/v5.CVE-2026-33815 · Other software · github.com/jackc/pgx/v5 · reported by security@golang.orgCritical 9.8
Memory-safety vulnerability in github.com/jackc/pgx/v5.
- Product
- github.com/jackc/pgx/v5/pgproto3
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordpkg.go.devaccess.redhat.com
Mar 6, 2024pgx is a PostgreSQL driver and toolkit for Go.CVE-2024-27304 · Other software · jackc · reported by GitHubCritical 9.8
pgx is a PostgreSQL driver and toolkit for Go. SQL injection can occur if an attacker can cause a single query or bind message to exceed 4 GB in size. An integer overflow in the calculated message size can cause the one large message to be sent as multiple messages under the attacker's control. The problem is resolved in v4.18.2 and v5.5.4. As a workaround, reject user input large enough to cause a single query or bind message to exceed 4 GB in size.
- Product
- pgx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Mar 6, 2024pgx is a PostgreSQL driver and toolkit for Go.CVE-2024-27289 · Other software · jackc · reported by GitHubHigh 8.1
pgx is a PostgreSQL driver and toolkit for Go. Prior to version 4.18.2, SQL injection can occur when all of the following conditions are met: the non-default simple protocol is used; a placeholder for a numeric value must be immediately preceded by a minus; there must be a second placeholder for a string value after the first placeholder; both must be on the same line; and both parameter values must be user-controlled. The problem is resolved in v4.18.2. As a workaround, do not use the simple protocol or do not place a minus directly before a placeholder.
- Product
- pgx
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
May 19, 2021In the pg_partman (aka PG Partition Manager) extension before 4.5.1 for PostgreSQL, arbitrary code execution can be achieved via SECURITY DEFINER functions becaCVE-2021-33204 · Other software · Pgxn · reported by MITRECritical 9.8
In the pg_partman (aka PG Partition Manager) extension before 4.5.1 for PostgreSQL, arbitrary code execution can be achieved via SECURITY DEFINER functions because an explicit search_path is not set.
- Product
- PG Partman
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 27, 2017In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadPGXImage in coders/pgx.c, which allows attackers to cause a denial of serCVE-2017-17883 · Other software · Imagemagick · reported by MITREMedium 6.5
In ImageMagick 7.0.7-12 Q16, a memory leak vulnerability was found in the function ReadPGXImage in coders/pgx.c, which allows attackers to cause a denial of service via a crafted PGX image file.
- Product
- Imagemagick
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Dec 8, 2017In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtovolume function in jp3d/convert.c.CVE-2017-17480 · Other software · Uclouvain · reported by MITRECritical 9.8
In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtovolume function in jp3d/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
- Product
- Openjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordgithub.comlists.debian.org
Dec 8, 2017In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtoimage function in jpwl/convert.c.CVE-2017-17479 · Other software · Uclouvain · reported by MITRECritical 9.8
In OpenJPEG 2.3.0, a stack-based buffer overflow was discovered in the pgxtoimage function in jpwl/convert.c. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
- Product
- Openjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Aug 30, 2017A stack-based buffer overflow was discovered in the pgxtoimage function in bin/jp2/convert.c in OpenJPEG 2.2.0.CVE-2017-14041 · Other software · Uclouvain · reported by MITREHigh 8.8
A stack-based buffer overflow was discovered in the pgxtoimage function in bin/jp2/convert.c in OpenJPEG 2.2.0. The vulnerability causes an out-of-bounds write, which may lead to remote denial of service or possibly remote code execution.
- Product
- Openjpeg
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recorddebian.orgsecurityfocus.com
Nov 20, 2003Unknown vulnerability in the libraries for the PGX32 frame buffer in Solaris 2.5.1 and 2.6 through 9 allows local users to gain root access.CVE-2003-1059 · Other software · SUN · reported by MITREHigh 7.2
Unknown vulnerability in the libraries for the PGX32 frame buffer in Solaris 2.5.1 and 2.6 through 9 allows local users to gain root access.
- Product
- Solaris
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordsecunia.comsunsolve.sun.com
Oct 20, 2000pgxconfig in the Raptor GFX configuration tool uses a relative path name for a system call to the "cp" program, which allows local users to execute arbitrary coCVE-2000-0693 · Other software · Tech-source · reported by MITREHigh 7.2
pgxconfig in the Raptor GFX configuration tool uses a relative path name for a system call to the "cp" program, which allows local users to execute arbitrary commands by modifying their path to point to an alternate "cp" program.
- Product
- Raptor GFX Pgx32
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org
Oct 20, 2000Buffer overflows in pgxconfig in the Raptor GFX configuration tool allow local users to gain privileges via command line options.CVE-2000-0695 · Other software · Tech-source · reported by MITREHigh 7.2
Buffer overflows in pgxconfig in the Raptor GFX configuration tool allow local users to gain privileges via command line options.
- Product
- Raptor GFX Pgx32
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comarchives.neohapsis.com
Oct 20, 2000pgxconfig in the Raptor GFX configuration tool allows local users to gain privileges via a symlink attack.CVE-2000-0694 · Other software · Tech-source · reported by MITREHigh 7.2
pgxconfig in the Raptor GFX configuration tool allows local users to gain privileges via a symlink attack.
- Product
- Raptor GFX Pgx32
- What to do
- Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD recordarchives.neohapsis.comosvdb.org
Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.
Weekly security brief
The flaws that hit local websites, every Friday.
One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.
Tell us what you're building.
A website, your marketing, a security check, an app, or the thing you've been running out of a spreadsheet for three years. A few lines is plenty.
Not ready to talk yet? Run the free website check and see what Google sees.