{"items":[{"id":"CVE-2026-116252","published":"2026-10-30T19:55:20.208Z","updated":"2026-11-06T16:04:36.639Z","title":"pgAdmin 4: Materialized view refresh redirects its connection through a crafted database name","severity":"HIGH","score":7.1,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00247,"kevAdded":null},{"id":"CVE-2026-116251","published":"2026-10-30T19:55:19.613Z","updated":"2026-11-06T16:05:35.986Z","title":"pgAdmin 4: A user's other sessions survive a change of their password","severity":"LOW","score":2.3,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00109,"kevAdded":null},{"id":"CVE-2026-116250","published":"2026-10-30T19:55:18.713Z","updated":"2026-11-06T16:18:17.858Z","title":"pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment check","severity":"HIGH","score":7.3,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00096,"kevAdded":null},{"id":"CVE-2026-116249","published":"2026-10-30T19:55:18.121Z","updated":"2026-11-06T16:19:45.264Z","title":"pgAdmin 4: Connection file paths and parameter keys escape the user's storage directory","severity":"HIGH","score":7.2,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00183,"kevAdded":null},{"id":"CVE-2026-116248","published":"2026-10-30T19:55:17.531Z","updated":"2026-11-06T16:21:00.349Z","title":"pgAdmin 4: Non-administrators can share a server with every user","severity":"MEDIUM","score":6,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00228,"kevAdded":null},{"id":"CVE-2026-116247","published":"2026-10-30T19:55:16.935Z","updated":"2026-11-06T16:17:02.214Z","title":"pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificate","severity":"HIGH","score":7.1,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00128,"kevAdded":null},{"id":"CVE-2026-116246","published":"2026-10-30T19:55:16.276Z","updated":"2026-11-06T16:16:06.627Z","title":"pgAdmin 4: Server passwords are left in pgAdmin's process environment","severity":"HIGH","score":7,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.0019,"kevAdded":null},{"id":"CVE-2026-116245","published":"2026-10-30T19:55:15.679Z","updated":"2026-11-06T16:15:25.682Z","title":"pgAdmin 4: Connection services are not restricted in server mode","severity":"HIGH","score":7.1,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00158,"kevAdded":null},{"id":"CVE-2026-116244","published":"2026-10-30T19:55:15.101Z","updated":"2026-11-06T16:14:48.433Z","title":"pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentials","severity":"HIGH","score":7.1,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00277,"kevAdded":null},{"id":"CVE-2026-116243","published":"2026-10-30T19:55:14.513Z","updated":"2026-11-06T16:12:28.488Z","title":"pgAdmin 4: Utility binary path can point at a shared storage directory","severity":"HIGH","score":7.7,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00332,"kevAdded":null},{"id":"CVE-2026-116242","published":"2026-10-30T19:55:13.843Z","updated":"2026-11-06T16:11:29.625Z","title":"pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identity","severity":"HIGH","score":7.1,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00232,"kevAdded":null},{"id":"CVE-2026-116241","published":"2026-10-30T19:55:13.194Z","updated":"2026-11-06T16:10:14.464Z","title":"pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifier","severity":"CRITICAL","score":9.4,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.0031,"kevAdded":null},{"id":"CVE-2026-116240","published":"2026-10-30T19:55:12.603Z","updated":"2026-11-06T16:09:09.238Z","title":"pgAdmin 4: File Manager and storage-path tools act on a different path from the one checked","severity":"HIGH","score":7.1,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00252,"kevAdded":null},{"id":"CVE-2026-116239","published":"2026-10-30T19:55:12.002Z","updated":"2026-11-06T16:08:14.320Z","title":"pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same username","severity":"HIGH","score":8.9,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00403,"kevAdded":null},{"id":"CVE-2026-116238","published":"2026-10-30T19:55:11.056Z","updated":"2026-11-06T16:06:41.395Z","title":"pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checks","severity":"CRITICAL","score":9.2,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00404,"kevAdded":null},{"id":"CVE-2026-86864","published":"2026-09-17T15:31:00.492Z","updated":"2026-09-17T16:00:02.215Z","title":"pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool","severity":"HIGH","score":8.7,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00579,"kevAdded":null},{"id":"CVE-2026-86863","published":"2026-09-17T15:30:58.077Z","updated":"2026-09-17T16:01:16.146Z","title":"pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode","severity":"CRITICAL","score":9.3,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00583,"kevAdded":null},{"id":"CVE-2026-86862","published":"2026-09-17T15:30:56.175Z","updated":"2026-09-17T16:02:27.894Z","title":"pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools","severity":"HIGH","score":7.1,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00352,"kevAdded":null},{"id":"CVE-2026-86861","published":"2026-09-17T15:30:51.232Z","updated":"2026-09-17T19:18:18.115Z","title":"pgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment check","severity":"MEDIUM","score":6,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00324,"kevAdded":null},{"id":"CVE-2026-17566","published":"2026-07-31T16:00:22.738Z","updated":"2026-08-01T03:56:13.838Z","title":"pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)","severity":"CRITICAL","score":9.4,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00673,"kevAdded":null},{"id":"CVE-2026-17351","published":"2026-07-31T16:00:19.103Z","updated":"2026-08-01T03:56:14.973Z","title":"pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)","severity":"CRITICAL","score":9.4,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00483,"kevAdded":null},{"id":"CVE-2026-17350","published":"2026-07-31T16:00:03.744Z","updated":"2026-07-31T17:05:44.535Z","title":"pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers","severity":"MEDIUM","score":5.3,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00376,"kevAdded":null},{"id":"CVE-2026-17349","published":"2026-07-31T15:59:47.841Z","updated":"2026-08-01T03:56:26.176Z","title":"pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner","severity":"CRITICAL","score":9.3,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00395,"kevAdded":null},{"id":"CVE-2026-17348","published":"2026-07-31T15:59:18.714Z","updated":"2026-07-31T17:23:08.497Z","title":"pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046)","severity":"MEDIUM","score":6.9,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00422,"kevAdded":null},{"id":"CVE-2026-17347","published":"2026-07-31T15:59:16.588Z","updated":"2026-08-01T03:56:12.755Z","title":"pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution","severity":"HIGH","score":7.7,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00716,"kevAdded":null},{"id":"CVE-2026-17346","published":"2026-07-31T15:59:13.136Z","updated":"2026-08-01T03:56:11.625Z","title":"pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)","severity":"HIGH","score":8.7,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00615,"kevAdded":null},{"id":"CVE-2026-12049","published":"2026-06-18T23:37:43.328Z","updated":"2026-06-22T14:39:56.925Z","title":"pgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated 'next' parameter","severity":"MEDIUM","score":5.3,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00382,"kevAdded":null},{"id":"CVE-2026-12048","published":"2026-06-18T23:37:41.541Z","updated":"2026-06-22T19:15:36.006Z","title":"pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parser","severity":"CRITICAL","score":9.3,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00268,"kevAdded":null},{"id":"CVE-2026-12047","published":"2026-06-18T23:37:39.657Z","updated":"2026-06-22T19:14:24.816Z","title":"pgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception text","severity":"MEDIUM","score":4.8,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00221,"kevAdded":null},{"id":"CVE-2026-12046","published":"2026-06-18T23:37:37.430Z","updated":"2026-06-23T03:55:42.384Z","title":"pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code execution","severity":"CRITICAL","score":9.5,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.01037,"kevAdded":null},{"id":"CVE-2026-12045","published":"2026-06-18T23:37:35.182Z","updated":"2026-06-23T03:55:43.509Z","title":"pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution","severity":"CRITICAL","score":9.4,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00658,"kevAdded":null},{"id":"CVE-2026-12050","published":"2026-06-18T23:37:19.384Z","updated":"2026-06-22T19:10:39.879Z","title":"pgAdmin 4: SQL injection in named restore point endpoint","severity":"MEDIUM","score":5.3,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00426,"kevAdded":null},{"id":"CVE-2026-12044","published":"2026-06-18T23:37:16.202Z","updated":"2026-06-22T18:37:05.999Z","title":"pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates","severity":"HIGH","score":8.7,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00709,"kevAdded":null},{"id":"CVE-2026-7820","published":"2026-05-11T14:35:53.492Z","updated":"2026-05-11T16:04:54.699Z","title":"pgAdmin 4: Account-lockout bypass via Flask-Security default /login view","severity":"MEDIUM","score":6.9,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00211,"kevAdded":null},{"id":"CVE-2026-7819","published":"2026-05-11T14:35:52.747Z","updated":"2026-05-11T16:06:03.147Z","title":"pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file write","severity":"HIGH","score":7.2,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00325,"kevAdded":null},{"id":"CVE-2026-7818","published":"2026-05-11T14:35:52.092Z","updated":"2026-05-11T16:07:11.650Z","title":"pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution","severity":"HIGH","score":7.3,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00131,"kevAdded":null},{"id":"CVE-2026-7817","published":"2026-05-11T14:35:51.384Z","updated":"2026-05-11T16:07:55.788Z","title":"pgAdmin 4: Local file inclusion and server-side request forgery in LLM API configuration endpoints","severity":"HIGH","score":7.1,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00217,"kevAdded":null},{"id":"CVE-2026-7816","published":"2026-05-11T14:35:50.827Z","updated":"2026-05-26T13:39:15.001Z","title":"pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout","severity":"HIGH","score":8.7,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.01444,"kevAdded":null},{"id":"CVE-2026-7815","published":"2026-05-11T14:35:50.081Z","updated":"2026-05-11T16:09:33.147Z","title":"pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution","severity":"HIGH","score":8.7,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00456,"kevAdded":null},{"id":"CVE-2026-7814","published":"2026-05-11T14:35:49.411Z","updated":"2026-05-11T17:31:37.625Z","title":"pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizer","severity":"MEDIUM","score":4.8,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00163,"kevAdded":null},{"id":"CVE-2026-7813","published":"2026-05-11T14:35:48.717Z","updated":"2026-05-11T17:32:49.824Z","title":"pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode","severity":"CRITICAL","score":9.4,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00455,"kevAdded":null},{"id":"CVE-2026-1707","published":"2026-02-05T17:30:05.089Z","updated":"2026-02-26T21:50:19.579Z","title":"Restore restriction bypass via key disclosure vulnerability (pgAdmin 4)","severity":"HIGH","score":7.4,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00439,"kevAdded":null},{"id":"CVE-2025-13780","published":"2025-12-11T18:30:47.812Z","updated":"2026-11-03T22:02:51.373Z","title":"Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)","severity":"CRITICAL","score":9.1,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00943,"kevAdded":null},{"id":"CVE-2025-12765","published":"2025-11-13T13:00:11.448Z","updated":"2025-11-13T14:00:56.314Z","title":"pgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass.","severity":"HIGH","score":7.5,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.0023,"kevAdded":null},{"id":"CVE-2025-12764","published":"2025-11-13T13:00:10.595Z","updated":"2025-11-13T14:02:00.502Z","title":"pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.","severity":"HIGH","score":7.5,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00476,"kevAdded":null},{"id":"CVE-2025-12763","published":"2025-11-13T13:00:08.048Z","updated":"2026-02-26T16:57:06.806Z","title":"Command injection vulnerability allowing arbitrary command execution on Windows","severity":"MEDIUM","score":6.8,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00914,"kevAdded":null},{"id":"CVE-2025-12762","published":"2025-11-13T13:00:02.005Z","updated":"2026-02-26T16:57:07.296Z","title":"Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)","severity":"CRITICAL","score":9.1,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.12705,"kevAdded":null},{"id":"CVE-2025-9636","published":"2025-09-04T16:43:27.710Z","updated":"2026-02-26T17:49:38.292Z","title":"Cross-Origin Opener Policy Vulnerability in pgAdmin 4","severity":"HIGH","score":7.9,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00227,"kevAdded":null},{"id":"CVE-2025-2946","published":"2025-04-03T12:23:30.694Z","updated":"2025-04-03T17:57:18.517Z","title":"Cross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data Tool of pgAdmin 4","severity":"CRITICAL","score":9.1,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00329,"kevAdded":null},{"id":"CVE-2025-2945","published":"2025-04-03T12:23:14.792Z","updated":"2026-02-26T18:28:58.124Z","title":"pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment","severity":"CRITICAL","score":9.9,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.563,"kevAdded":null},{"id":"CVE-2024-9014","published":"2024-09-23T17:04:00.264Z","updated":"2024-09-23T19:21:22.348Z","title":"OAuth2 client id and secret exposed through the web browser in pgAdmin 4","severity":"CRITICAL","score":9.9,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.09685,"kevAdded":null},{"id":"CVE-2024-6238","published":"2024-06-25T16:12:12.960Z","updated":"2024-10-30T15:35:29.424Z","title":"pgAdmin 4 Installation Directory permission issue","severity":"HIGH","score":7.4,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00246,"kevAdded":null},{"id":"CVE-2024-4216","published":"2024-05-02T17:42:59.679Z","updated":"2025-02-13T17:53:31.153Z","title":"XSS vulnerability in /settings/store API response json payload in pgAdmin 4","severity":"HIGH","score":7.4,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00461,"kevAdded":null},{"id":"CVE-2024-4215","published":"2024-05-02T17:42:34.880Z","updated":"2025-02-13T17:53:30.480Z","title":"The Multi Factor Authentication bypass vulnerability in pgAdmin 4","severity":"HIGH","score":7.4,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.00634,"kevAdded":null},{"id":"CVE-2024-3116","published":"2024-04-04T14:59:37.280Z","updated":"2025-03-14T16:35:25.051Z","title":"Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4","severity":"HIGH","score":7.4,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.65815,"kevAdded":null},{"id":"CVE-2024-2044","published":"2024-03-07T20:48:10.066Z","updated":"2025-02-13T17:32:31.782Z","title":"Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4","severity":"CRITICAL","score":9.9,"vendor":"pgadmin.org","product":"pgAdmin 4","kev":false,"epss":0.79465,"kevAdded":null}]}