VulnTideExploited vulnerabilities, by vendor. Data as of .
Vendor

PostgreSQL vulnerabilities

In CISA's KEV catalog
0 exploited vulnerabilities
CVE records, last 3 years
87 since
Rank 183 of 467 vendors on this site
Critical or high
59.8% of 87 scored records; 0 not scored

Source: CISA KEV 2026.11.10, as of ; CVE List, as of . About the data.

  • PostgreSQL has 87 CVE records published between 12 Nov 2023 and 12 Nov 2026, ranking #183 of 467 vendors on this site by that count.
  • Of the 87 with a CVSS score, 52 (59.8%) are rated critical or high; 0 (0% of all) have no CVSS score.
  • None of the CVE records attributed to PostgreSQL is listed in CISA's KEV catalog as of 12 Nov 2026.

CVE records per year, by severity

CVE records published per year for PostgreSQL
CVE records published per year for PostgreSQLStacked bar chart of CVE records attributed to PostgreSQL per publication year, 2017 to 2026, split by severity. 2026 is not finished.0204060802017: 3 not scored32017020182019: 3 high2019: 2 medium, low or none52019020200202102022020232024: 1 critical2024: 3 high2024: 4 medium, low or none820242025: 5 high2025: 5 medium, low or none1020252026: 43 high2026: 26 medium, low or none692026*CVE records published per year for PostgreSQLStacked bar chart of CVE records attributed to PostgreSQL per publication year, 2017 to 2026, split by severity. 2026 is not finished.0204060802017: 3 not scored3’170’182019: 3 high2019: 2 medium, low or none5’190’200’210’220’232024: 1 critical2024: 3 high2024: 4 medium, low or none8’242025: 5 high2025: 5 medium, low or none10’252026: 43 high2026: 26 medium, low or none69’26*

* 2026 is counted through .

Show data as a table
Severity by publication year
YearRecordsCriticalHighCritical or highNot scored
2026*6904362.3%0%
2025100550%0%
202481350%0%
2023000——
2022000——
2021000——
2020000——
201950360%0%
2018000——
2017300—100%

"Critical or high" is the share of scored records; "Not scored" is the share of all records.

Source: CVE List, as of . About the data.

PostgreSQL vulnerabilities reported exploited, not in CISA KEV

Listed in VulnCheck KEV, which cites public reports of exploitation in the wild. CISA has not confirmed these in its own catalog. Most recently listed first.

Source: VulnCheck KEV, as of ; CISA KEV 2026.11.10, as of ; CVE List, as of . About the data.

Highest exploit-prediction scores (EPSS)

EPSS estimates the probability that a vulnerability is exploited in the next 30 days. The highest-scoring PostgreSQL records today, from 1%.

Source: FIRST EPSS, as of ; CVE List, as of ; CISA KEV 2026.11.10, as of . About the data.

All vendors · KEV catalog overview