CVE•Published 2026-02-12•Modified 2026-06-30•1 article on news•6 live references•NVD data

CVE-2026-2004Postgresql · Postgresql

Vulnerability data via NVD (ingested)

CVSS v3.1

8.8

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

EPSS percentile

—

Weaknesses (CWE)

CWE-1287Improper Validation of Specified Type of Input

Description

Missing validation of type of input in PostgreSQL intarray extension selectivity estimator function allows an object creator to execute arbitrary code as the operating system user running the database. Versions before PostgreSQL 18.2, 17.8, 16.12, 15.16, and 14.21 are affected.

Timeline

Published 2026-02-12

Modified 2026-06-30

External references

NVD MITRE Exploit-DB GitHub PoC Sploitus VulnCheck

Search for exposed instances

Shodan + Censys queries derived from NVD's CPE data. The vuln tag catches assets Shodan has explicitly linked to this CVE; the product / banner fingerprints find exposed instances even when the vuln tag was never applied (which is common).

Shodan · vuln tag0 hosts

vuln:CVE-2026-2004

Hosts Shodan has explicitly fingerprinted as vulnerable.

Shodan · product

product:"Postgresql Postgresql"

All exposed Postgresql Postgresql instances — cross-reference with the CVE's affected-version range.

Shodan · banner/body mention

http.html:"Postgresql"

HTTP body or banner mentions "Postgresql" — catches deploys Shodan didn't identify as a product.

More intel sources (5)

vuln:CVE-2026-2004

Country / ASN / product breakdown for the vuln query.

vulnerabilities.cve_id: CVE-2026-2004

Censys host search filtered to this CVE id.

CVE-2026-2004

Public source-code mentions — fast PoC discovery.

CVE-2026-2004

GitHub code search for direct mentions.

"CVE-2026-2004" exploit -site:nvd.nist.gov

Write-ups and news, NVD excluded.

Known PoCs on GitHub (8)

CVE-2026-20048 repos

Mr-xn/Penetration_Testing_POCHTML

渗透测试有关的POC、EXP、脚本、提权、小工具等---About penetration-testing python-script poc getshell csrf xss cms php-getshell domainmod-xss csrf-webshell cobub-razor cve rce sql sql-poc poc-exp bypas…

★ 7,407·updated 1w ago

xairy/linux-kernel-exploitationunknown

A collection of links related to Linux kernel security and exploitation

★ 6,516·updated 1mo ago

V33RU/awesome-connected-things-secunknown

A Curated list of Security Resources for all connected things

★ 3,398·updated 1mo ago

ycdxsb/PocOrExp_in_GithubPython

Automatically Collect POC or EXP from GitHub by CVE ID.

★ 1,175·updated 2d ago

Ostorlab/KEVunknown

Ostorlab KEV: One-command to detect most remotely known exploitable vulnerabilities. Sourced from CISA KEV, Google's Tsunami, Ostorlab's Asteroid and Bug Bounty programs.

★ 612·updated 3mo ago

edoardottt/missing-cve-nuclei-templatesShell

Weekly updated list of missing CVEs in nuclei templates official repository. Mainly built for bug bounty, but useful for penetration tests and vulnerability assessments too.

★ 438·updated 6d ago

Bombadil-Systems/zombie-zipPython

Malformed ZIP archive that evades antivirus detection by declaring Method=0 (stored) while containing DEFLATE-compressed payload.

★ 195·updated 3mo ago

radgeek/feedwordpressPHP

FeedWordPress: simple and flexible Atom/RSS syndication for WordPress

★ 127·updated 1mo ago