How many CVEs does PostgreSQL have?

PostgreSQL has 232 published CVE records since 2000, including 52 in the last two years.

How many PostgreSQL CVEs are in CISA KEV?

None of PostgreSQL's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.

Which PostgreSQL products have the most CVEs?

The PostgreSQL products with the most published CVEs are postgresql, postgresql jdbc driver, pgadmin_4, pg_dumpall, pg_restore.

What are the most common weakness types in PostgreSQL CVEs?

PostgreSQL's CVEs most often map to these CWE weakness types: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-190 (Integer Overflow or Wraparound), CWE-122 (Heap-based Buffer Overflow), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).

How many critical PostgreSQL vulnerabilities are there?

PostgreSQL has 19 critical and 103 high-severity CVEs.

What is the average severity of PostgreSQL CVEs?

The average CVSS base score across PostgreSQL's scored CVEs is 6.8.

PostgreSQL Vulnerabilities: CVEs, CISA KEV & Security Advisories

Name: PostgreSQL vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

RadicalNotion.AI

Overview

PostgreSQL has 232 published CVE records since 2000, of which 0 are in CISA's Known Exploited Vulnerabilities catalog and 15 have a known public exploit. The average CVSS base score across scored CVEs is 6.8.

This page aggregates every publicly disclosed vulnerability (CVE) affecting PostgreSQL products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on PostgreSQL's vulnerability posture, as a share of its 232 published CVEs.

Average CVSS: 6.8
Critical / high: 53%
Actively exploited (KEV): 0%
Public exploit available: 6%
Patch available: 85%

Severity and exploitation

How the CVSS severity of PostgreSQL's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical19

High103

Medium96

Low14

In CISA’s Known Exploited Vulnerabilities catalog

None of PostgreSQL's CVEs are currently listed in CISA's KEV catalog.

Public exploits

15 of PostgreSQL's CVEs have a known public exploit available.

Most affected products

The PostgreSQL products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in PostgreSQL CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish PostgreSQL CVE records.

Disclosure activity by year

How many PostgreSQL CVEs were published each year.

2019

2020

2021

2022

2023

2024

2025

Latest PostgreSQL CVEs

The most recently disclosed vulnerabilities affecting PostgreSQL.

PostgreSQL refint plan cache type confusion executes arbitrary code
CWE-843
High · CVSS 8.8
EPSS 0.4%2026-08-13
PostgreSQL logical decoding can dlopen arbitrary file
CWE-862
High · CVSS 7.2
EPSS 0.3%2026-08-13
PostgreSQL fails to check type USAGE privilege
CWE-862
Medium · CVSS 4.3
EPSS 0.2%2026-08-13
PostgreSQL ALTER TABLE ALTER TYPE resets extended statistics ownership

Other vendors

Browse vulnerabilities for other tracked vendors.

golang237 CVEs TIBCO237 CVEs Hitachi236 CVEs OpenEMR234 CVEs Linksys233 CVEs H3C232 CVEs HashiCorp228 CVEs amazon227 CVEs

Browse all vendors

Frequently asked questions

Common questions about PostgreSQL vulnerabilities.

How many CVEs does PostgreSQL have?: PostgreSQL has 232 published CVE records since 2000, including 52 in the last two years.
How many PostgreSQL CVEs are in CISA KEV?: None of PostgreSQL's CVEs are currently listed in CISA's Known Exploited Vulnerabilities catalog.
Which PostgreSQL products have the most CVEs?: The PostgreSQL products with the most published CVEs are postgresql, postgresql jdbc driver, pgadmin_4, pg_dumpall, pg_restore.
What are the most common weakness types in PostgreSQL CVEs?: PostgreSQL's CVEs most often map to these CWE weakness types: CWE-89 (Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')), CWE-190 (Integer Overflow or Wraparound), CWE-122 (Heap-based Buffer Overflow), CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor).
Are there public exploits for PostgreSQL vulnerabilities?: Yes — 15 of PostgreSQL's CVEs have a known public exploit.
How many critical PostgreSQL vulnerabilities are there?: PostgreSQL has 19 critical and 103 high-severity CVEs.
What is the average severity of PostgreSQL CVEs?: The average CVSS base score across PostgreSQL's scored CVEs is 6.8.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track PostgreSQL vulnerabilities

Monitor new PostgreSQL vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing