PostgreSQL vulnerabilities
We track 92 vulnerabilities in PostgreSQL products across 5 products. 92 are rated high or critical, and none are known to be exploited. The most recent was published on November 12, 2026.
Latest PostgreSQL vulnerabilities
- 9.8 Critical severity
pgAdmin 4: Improper Neutralization of Special Elements used in a Command
pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute arbitrary code on the server hosting PGAdmin, posing a severe risk to the database management system'
- 9.9 Critical severity
pgAdmin 4: Path Traversal: 'dir....filename'
pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Windows, an unauthenticated attacker can load and deserialize remote pickle objects and gain code executi
- 9.8 Critical severity
pgjdbc: Improper Neutralization of Special Elements used in an SQL Command
pgjdbc, the PostgreSQL JDBC Driver, allows attacker to inject SQL if using PreferQueryMode=SIMPLE. Note this is not the default. In the default mode there is no vulnerability. A placeholder for a numeric value must be immediately preceded by a minus. There mus
- 9.8 Critical severity
postgresql: Improper Neutralization of Special Elements used in an SQL Command
Supabase PostgreSQL v15.1 was discovered to contain a SQL injection vulnerability via the component /pg_meta/default/query. NOTE: the vendor's position is that this is an intended feature; also, it exists in the Supabase dashboard product, not the Supabase Pos
- 8.0 High severity
PostgreSQL: Privilege Dropping / Lowering Errors
Late privilege drop in REFRESH MATERIALIZED VIEW CONCURRENTLY in PostgreSQL allows an object creator to execute arbitrary SQL functions as the command issuer. The command intends to run SQL functions as the owner of the materialized view, enabling safe refresh
- 8.8 High severity
Red Hat Advanced Cluster Security 4.2: Integer Overflow or Wraparound
A flaw was found in PostgreSQL that allows authenticated database users to execute arbitrary code through missing overflow checks during SQL array value modification. This issue exists due to an integer overflow during array modification where a remote user ca
- 8.8 High severity
Red Hat Advanced Cluster Security 4.2: Improper Neutralization of Special Elements used in an SQL Command
IN THE EXTENSION SCRIPT, a SQL Injection vulnerability was found in PostgreSQL if it uses @extowner@, @extschema@, or @extschema:...@ inside a quoting construct (dollar quoting, '', or ""). If an administrator has installed files of a vulnerable, trusted, non-
- 7.2 High severity
schema_element defeats protective search_path changes; It was found that certain database…
schema_element defeats protective search_path changes; It was found that certain database calls in PostgreSQL could permit an authed attacker with elevated database-level privileges to execute arbitrary code.
- 8.8 High severity
postgresql: Improper Neutralization of Special Elements used in an SQL Command
A flaw was found in PostgreSQL. There is an issue with incomplete efforts to operate safely when a privileged user is maintaining another user's objects. The Autovacuum, REINDEX, CREATE INDEX, REFRESH MATERIALIZED VIEW, CLUSTER, and pg_amcheck commands activat
- 8.0 High severity
postgresql: Improperly Controlled Modification of Object Prototype Attributes
A vulnerability was found in PostgreSQL. This attack requires permission to create non-temporary objects in at least one schema, the ability to lure or wait for an administrator to create or update an affected extension in that schema, and the ability to lure
- 8.0 High severity
pgjdbc: Improper Neutralization of Special Elements used in an SQL Command
PostgreSQL JDBC Driver (PgJDBC for short) allows Java programs to connect to a PostgreSQL database using standard, database independent Java code. The PGJDBC implementation of the `java.sql.ResultRow.refreshRow()` method is not performing escaping of column na
- 9.8 Critical severity
Postgresql Jdbc Driver: Improper Initialization
pgjdbc is the offical PostgreSQL JDBC Driver. A security hole was found in the jdbc driver for postgresql database while doing security research. The system using the postgresql library will be attacked when attacker control the jdbc url or properties. pgjdbc