Postgresql
214 CVEs tracked. None of them is in CISA KEV.
This hub aggregates every CVE we track for Postgresql, a product in the databases space. Use it to gauge the current risk picture and drill into individual advisories.
Postgresql CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 4 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 1 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 1 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 3 |
| 2025-09 | 1 |
| 2025-10 | 0 |
| 2025-11 | 2 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 5 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 12 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 28 |
| 2026-09 | 0 |
Severity
How the 214 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical13
- High92
- Medium91
- Low18
Latest CVEs
The 15 most recently published vulnerabilities affecting Postgresql.
- CVE-2026-6471PostgreSQL logical decoding can dlopen arbitrary file7.2
- CVE-2026-14671PostgreSQL refint plan cache type confusion executes arbitrary code8.8
- CVE-2026-6470PostgreSQL fails to check type USAGE privilege4.3
- CVE-2026-6464PostgreSQL psql COPY FROM STDIN early failure processes data lines as psql commands8.1
- CVE-2026-6469PostgreSQL ALTER TABLE ALTER TYPE resets extended statistics ownership3.8
- CVE-2026-19385PostgreSQL pg_dump heap buffer overflow executes arbitrary code8.8
- CVE-2026-18408PostgreSQL psql \unrestrict lets superuser of pg_dump origin server execute arbitrary code in psql client8.8
- CVE-2026-18024PostgreSQL ascii() function reads past end of buffer4.3
- CVE-2026-16241PostgreSQL ECPG integer underflow can crash the client3.8
- CVE-2026-16239PostgreSQL type confusion in cursor CLOSE + DECLARE executes arbitrary code8.8
- CVE-2026-16238PostgreSQL type confusion in pg_restore_attribute_stats() executes arbitrary code8.8
- CVE-2026-15741PostgreSQL expression deparse allows SQL injection via EXTRACT argument8.8
- CVE-2026-15742PostgreSQL fuzzystrmatch writes effectively-arbitrary addresses, via integer wraparound8.8
- CVE-2026-14681PostgreSQL improper enforcement of GSSAPI encryption when coupled with SSL4.2
- CVE-2026-14680PostgreSQL type confusion via "internal" arguments8.8
Product grouping is registry-driven, with AI assist and human review. How it works