CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,438 CVEs published, 355 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,438
Show in the list
Critical, last 7 days
355
Show in the list
Healthcare-tagged, last 7 days
4
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product pgadmin:pgadmin_4. Show all products

32 CVEs, showing 1 to 32
CVESeverityTitlePublished
CVE-2026-86864High 8.8pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool
Assigned by PostgreSQL
Sep 17, 2026
CVE-2026-86863Critical 9.8pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode
Assigned by PostgreSQL
Sep 17, 2026
CVE-2026-86862Medium 6.5pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance tools
Assigned by PostgreSQL
Sep 17, 2026
CVE-2026-86861Medium 5.9pgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment check
Assigned by PostgreSQL
Sep 17, 2026
CVE-2026-17566Critical 9.9pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the rendered line to psql via --command.Jul 31, 2026
CVE-2026-17351Critical 9.0The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as exactly one non-transaction-control stateme…Jul 31, 2026
CVE-2026-17350Medium 5.4The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3) did not enforce its permission check consistently.Jul 31, 2026
CVE-2026-17349Critical 9.6/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which copies every c…Jul 31, 2026
CVE-2026-17348Medium 6.5In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-mode auto-login and the Kerberos/Webserve…Jul 31, 2026
CVE-2026-17347High 8.8The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by…Jul 31, 2026
CVE-2026-17346High 8.8The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several sinks that had been placed in test_sql_…Jul 31, 2026
CVE-2026-12050High 8.8SQL injection in pgAdmin 4's named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}).Jun 19, 2026
CVE-2026-12049Medium 6.1Open redirect in pgAdmin 4's multi-factor authentication flow.Jun 19, 2026
CVE-2026-12048Medium 5.4Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths.Jun 19, 2026
CVE-2026-12047Medium 5.4HTML injection in pgAdmin 4's cloud deployment module.Jun 19, 2026
CVE-2026-12046Critical 9.0Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_id> and POST /sqleditor/initialize/sqleditor/update_connection/<sgid>/<sid>/<did> -- were the only r…Jun 19, 2026
CVE-2026-12045High 8.8Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin u…Jun 19, 2026
CVE-2026-12044High 8.8SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ...Jun 19, 2026
CVE-2026-7820Medium 6.5Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4.May 11, 2026
CVE-2026-7819High 8.1Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager.May 11, 2026
CVE-2026-7818High 7.8Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager.May 11, 2026
CVE-2026-7817Medium 6.5Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints.May 11, 2026
CVE-2026-7816High 8.8OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export.May 11, 2026
CVE-2026-7815High 8.8SQL injection vulnerability in pgAdmin 4 Maintenance Tool.May 11, 2026
CVE-2026-7814Medium 4.8Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules.May 11, 2026
CVE-2026-7813Critical 9.9Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules.May 11, 2026
CVE-2026-1707Medium 6.3pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files.Feb 5, 2026
CVE-2025-13780High 8.8pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files.Dec 11, 2025
CVE-2025-12765High 7.4pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification.Nov 13, 2025
CVE-2025-12764High 7.5pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and…Nov 13, 2025
CVE-2025-12763High 8.8pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems.Nov 13, 2025
CVE-2025-12762Critical 9.8pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files.Nov 13, 2025

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.