- CVE-2025-8714: pg_dump, pg_dumpall and pg_restore put plain-text output in psql's new restricted mode (keyed by a random string), so a malicious server cannot inject psql meta-commands into a dump - CVE-2026-18408: psql: do not expand backquotes in the argument of the unrestrict meta-command (shell command execution at restore) - CVE-2026-6471: add output_plugin_libraries; logical decoding loads only the output plugins listed there (code execution by REPLICATION roles); slots using a third-party plugin (e.g. wal2json) stop until it is added to the list - CVE-2026-6473: hstore_plperl, hstore_plpython: declare mul_size(); since els3 its result was truncated to 32 bits, so a hash/dict with more than ~107M entries could get a too-small allocation (heap buffer overflow); hstore_plperl was corrected in els6 - Also announce the els5 and els6 fixes, first shipped in els7: CVE-2026-14662, CVE-2026-14664, CVE-2026-14669, CVE-2026-14679, CVE-2026-14680, CVE-2024-10979, CVE-2026-14670, CVE-2026-14671, CVE-2026-14677, CVE-2026-15742