PostgreSQL security vulnerabilities
PostgreSQL version-series exposure with remediation links from public advisories.
Built for DBAs and infrastructure teams.
40 public records · 53 security-fix timeline events.
Version-specific security
High-intent pages for “PostgreSQL {version} security vulnerabilities” queries.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 0
- High 1
- Medium 0
- Low 0
2026-07-211 issues2026-10-18
Known exploited
View all known exploited- Unknownpostgresql postgresql Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')Patch nowKEVEPSS 91.66%Jan 22, 2021
- UnknownPostgreSQL Quoting APIs SQL Injection VulnerabilityPatch nowKEVEPSS 90.03%Feb 13, 2025
- Unknownpostgresql postgresql_jdbc_driver Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 4.81%Oct 30, 2024
- Unknownpostgresql postgresql_jdbc_driver Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')Patch nowKEVEPSS 2.23%Dec 8, 2025
Recently published
Browse catalog- High8.6Payload: SQL injection in SQLite/PostgresCheck if you run itEPSS 0.29%Oct 6, 2026
- Critical9.8Marten is a .NET Transactional Document DB and Event Store on PostgreSQL.Check if you run itEPSS 0.54%May 28, 2026
- Critical9.4CloudNativePG is a platform designed to manage PostgreSQL databases within Kubernetes environments.Check if you run itEPSS 0.52%May 28, 2026
- Medium5.3Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful.Check if you run itEPSS 0.38%May 15, 2026
- Medium5.3Mathesar is a web application that makes working with PostgreSQL databases both simple and powerful.Check if you run itEPSS 0.38%May 15, 2026
- High8.8SQL injection in PostgreSQL logical replication ALTER SUBSCRIPTION ...Check if you run itEPSS 0.18%May 14, 2026
- High8.8Stack buffer overflow in PostgreSQL module "refint" allows an unprivileged database user to execute arbitrary code as the operating system user running the database.Check if you run itEPSS 0.37%May 14, 2026
- Medium4.3Buffer over-read in PostgreSQL function pg_restore_attribute_stats() accepts array values of unmatched length, which causes query planning to read past end of one array.Check if you run itEPSS 0.21%May 14, 2026
- High7.5Uncontrolled recursion in PostgreSQL SSL and GSS negotiation allows an attacker able to connect to a PostgreSQL AF_UNIX socket to achieve sustained denial of service.Check if you run itEPSS 0.60%May 14, 2026
- Medium6.5Covert timing channel in comparison of MD5-hashed password in PostgreSQL authentication allows an attacker to recover user credentials sufficient to authenticate.Check if you run itEPSS 0.56%May 14, 2026