CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 09:50 UTC)

What this means for you

This week: 5,463 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,463; Show in the list
Critical, last 7 days: 357; Show in the list
Healthcare-tagged, last 7 days: 4; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product pgadmin.org:pgadmin_4. Show all products

11 CVEs, showing 1 to 11

CVE	Severity	Title	Published
CVE-2026-17346	High 8.8	pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044) Assigned by PostgreSQL	Jul 31, 2026
CVE-2026-17347	High 7.5	pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution Assigned by PostgreSQL	Jul 31, 2026
CVE-2026-17348	Medium 6.5	pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046) Assigned by PostgreSQL	Jul 31, 2026
CVE-2026-17349	Critical 9.6	pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner Assigned by PostgreSQL	Jul 31, 2026
CVE-2026-17350	Medium 5.4	pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers Assigned by PostgreSQL	Jul 31, 2026
CVE-2026-17351	Critical 9.0	pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045) Assigned by PostgreSQL	Jul 31, 2026
CVE-2026-17566	Critical 9.9	pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780) Assigned by PostgreSQL	Jul 31, 2026
CVE-2026-86861	Medium 5.9	pgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment check Assigned by PostgreSQL	Sep 17, 2026
CVE-2026-86862	Medium 6.5	pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools Assigned by PostgreSQL	Sep 17, 2026
CVE-2026-86863	Critical 9.8	pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode Assigned by PostgreSQL	Sep 17, 2026
CVE-2026-86864	High 8.8	pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool Assigned by PostgreSQL	Sep 17, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.