CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,496 CVEs published, 359 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,496
Show in the list
Critical, last 7 days
359
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product pgadmin:pgadmin_4. Show all products

32 CVEs, showing 1 to 32
CVESeverityTitlePublished
CVE-2025-12762Critical 9.8pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files.Nov 13, 2025
CVE-2025-12763High 8.8pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems.Nov 13, 2025
CVE-2025-12764High 7.5pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and…Nov 13, 2025
CVE-2025-12765High 7.4pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification.Nov 13, 2025
CVE-2025-13780High 8.8pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files.Dec 11, 2025
CVE-2026-1707Medium 6.3pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files.Feb 5, 2026
CVE-2026-7813Critical 9.9Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules.May 11, 2026
CVE-2026-7814Medium 4.8Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules.May 11, 2026
CVE-2026-7815High 8.8SQL injection vulnerability in pgAdmin 4 Maintenance Tool.May 11, 2026
CVE-2026-7816High 8.8OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export.May 11, 2026
CVE-2026-7817Medium 6.5Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints.May 11, 2026
CVE-2026-7818High 7.8Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager.May 11, 2026
CVE-2026-7819High 8.1Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager.May 11, 2026
CVE-2026-7820Medium 6.5Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4.May 11, 2026
CVE-2026-12044High 8.8SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ...Jun 19, 2026
CVE-2026-12045High 8.8Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin u…Jun 19, 2026
CVE-2026-12046Critical 9.0Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_id> and POST /sqleditor/initialize/sqleditor/update_connection/<sgid>/<sid>/<did> -- were the only r…Jun 19, 2026
CVE-2026-12047Medium 5.4HTML injection in pgAdmin 4's cloud deployment module.Jun 19, 2026
CVE-2026-12048Medium 5.4Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths.Jun 19, 2026
CVE-2026-12049Medium 6.1Open redirect in pgAdmin 4's multi-factor authentication flow.Jun 19, 2026
CVE-2026-12050High 8.8SQL injection in pgAdmin 4's named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}).Jun 19, 2026
CVE-2026-17346High 8.8pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)
Assigned by PostgreSQL
Jul 31, 2026
CVE-2026-17347High 7.5pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution
Assigned by PostgreSQL
Jul 31, 2026
CVE-2026-17348Medium 6.5pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046)
Assigned by PostgreSQL
Jul 31, 2026
CVE-2026-17349Critical 9.6pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner
Assigned by PostgreSQL
Jul 31, 2026
CVE-2026-17350Medium 5.4pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers
Assigned by PostgreSQL
Jul 31, 2026
CVE-2026-17351Critical 9.0pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)
Assigned by PostgreSQL
Jul 31, 2026
CVE-2026-17566Critical 9.9pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)
Assigned by PostgreSQL
Jul 31, 2026
CVE-2026-86861Medium 5.9pgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment check
Assigned by PostgreSQL
Sep 17, 2026
CVE-2026-86862Medium 6.5pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools
Assigned by PostgreSQL
Sep 17, 2026
CVE-2026-86863Critical 9.8pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode
Assigned by PostgreSQL
Sep 17, 2026
CVE-2026-86864High 8.8pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool
Assigned by PostgreSQL
Sep 17, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.