Vendor
pgEdge
8 known vulnerabilities.
6 results · Clear filters · Feed
-
Medium 5.8
pgEdge Go LLM Library provides a unified Go interface for multiple LLM providers with streaming, tool calling, retries,…
-
Medium 5.8
pgEdge RAG Server discloses part of the configured provider credential through API error messagespgEdge RAG Server discloses part of the configured provider credential through API error messages
pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the unauthenticated query API in internal/server/handlers.go returns err.Error() from failed LLM provider calls, preserving provider-…
-
Medium 5.9
pgEdge RAG Server shared keyword index leaked results between concurrent unauthenticated requests
pgEdge RAG Server is an API server for retrieval-augmented generation over PostgreSQL content using pgvector. Prior to 2.0.0, the BM25 keyword index is a single per-pipeline object shared by the unauthenticated query endpoint, and concurrent requests lock its…
-
Medium 6.5
pgEdge Postgres MCP Server SQL injection in the count_rows where parameter
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, the where parameter of the count_rows tool accepted subqueries against tables other than the table named in the tool…
-
Medium 6.5
pgEdge Postgres MCP Server login rate limiting can be evaded by a caller-supplied header
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible clients. Prior to 1.1.0, deployments exposing the nondefault HTTP transport with authentication enabled used the leftmost caller-supplied X-F…
-
Medium 5.3
pgEdge Postgres MCP Server enables SQL queries against PostgreSQL databases through Model Context Protocol compatible c…