CVE-2026-19633

HighCVSS 8.8/10Last modified Sep 9, 2026

Description

PostgreSQL Anonymizer contains a vulnerability that allows unprivileged masked users to execute arbitrary code by abusing operators, domain casts, or view subqueries that carry untrusted expressions. When these objects are evaluated in the context of the extension’s masking mechanisms, the malicious code can run with elevated privileges. The issue is fixed in PostgreSQL Anonymizer 3.1.4 and later versions

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Sep 6, 2026
Last modified: Sep 9, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-196346.4PostgreSQL Anonymizer contains a SQL injection vulnerability in two import functions. A user can create a malicious JSON document containing CVE-2026-196358.8A local privilege escalation vulnerability exists in Security Center. An attacker with write access to a specific configuration file could a CVE-2026-196365.3An issue was identified in which CSRF tokens were generated using a predictable method, potentially reducing their effectiveness as a securi CVE-2026-196394.3An improper access control vulnerability exists where an authenticated non-administrative application user could potentially view settings o CVE-2026-19645.3A vulnerability was determined in WeKan up to 8.20. This impacts an unknown function of the file models/boards.js of the component REST Endp CVE-2026-196404.2On affected platforms running Arista EOS, an authenticated user with access to the gNMI (gRPC Network Management Interface) may receive inco CVE-2026-196415.3On affected platforms running Arista EOS with password authentication configured, a specially crafted password can create orphan authenticat CVE-2026-196425.9An out-of-bounds write issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862 might allow a remote authenticated user to cause a CVE-2026-196435.3An out-of-bounds read issue in the Base64 decoder in Amazon aws-sdk-cpp before 1.11.862, on some platforms, might allow a remote authenticat CVE-2026-196445.4Adobe Experience Manager is affected by a DOM-based Cross-Site Scripting (XSS) vulnerability. An attacker could exploit this issue by manipu CVE-2026-196456.5IBM MQ Agent CD: v1.0.0, v1.0.1, v2.0.0, v2.0.1 An authenticated user with a valid session cookie can submit arbitrarily large or computatio CVE-2026-196469.1IBM Common Licensing Agent 9.0, Agent 9.0.0.1, Agent 9.0.0.2, ART 9.0, ART 9.0.0.1, and ART 9.0.0.2 could allow a remote attacker to redirec