| CVE-2026-116252 |
pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged
|
6.5
Medium
|
Oct 30, 2026 |
| CVE-2026-116251 |
pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own…
|
4.2
Medium
|
Oct 30, 2026 |
| CVE-2026-116249 |
In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file…
|
8.4
High
|
Oct 30, 2026 |
| CVE-2026-116250 |
In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with…
|
6.5
Medium
|
Oct 30, 2026 |
| CVE-2026-116248 |
In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the…
|
6.8
Medium
|
Oct 30, 2026 |
| CVE-2026-116246 |
To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager…
|
6.5
Medium
|
Oct 30, 2026 |
| CVE-2026-116247 |
When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one…
|
8.2
High
|
Oct 30, 2026 |
| CVE-2026-116244 |
When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME…
|
8.2
High
|
Oct 30, 2026 |
| CVE-2026-116245 |
libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an…
|
8.2
High
|
Oct 30, 2026 |
| CVE-2026-116243 |
pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences
|
7.5
High
|
Oct 30, 2026 |
| CVE-2026-116242 |
pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so…
|
8.2
High
|
Oct 30, 2026 |
| CVE-2026-116241 |
pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the…
|
9.9
Critical
|
Oct 30, 2026 |
| CVE-2026-116239 |
In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example,…
|
8.5
High
|
Oct 30, 2026 |
| CVE-2026-116240 |
In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which builds…
|
6.5
Medium
|
Oct 30, 2026 |
| CVE-2026-116238 |
In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default)
|
8.1
High
|
Oct 30, 2026 |
| CVE-2026-86864 |
pgAdmin 4's Backup tool appended the client-supplied 'database' field from the /backup/job//object request to the…
|
8.8
High
|
Sep 17, 2026 |
| CVE-2026-86863 |
pgAdmin 4's Webserver authentication source is intended to accept an identity asserted by the web server or reverse…
|
9.8
Critical
|
Sep 17, 2026 |
| CVE-2026-86862 |
pgAdmin 4's Restore and Maintenance tools passed the client-supplied 'database' field directly as the value of the…
|
6.5
Medium
|
Sep 17, 2026 |
| CVE-2026-86861 |
pgAdmin 4's File Manager save_file endpoint, which backs saving from the Query Tool and ERD, validated the requested…
|
5.9
Medium
|
Sep 17, 2026 |
| CVE-2026-17566 |
pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query…
|
9.9
Critical
|
Jul 31, 2026 |
| CVE-2026-17351 |
The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's…
|
9.0
Critical
|
Jul 31, 2026 |
| CVE-2026-17350 |
The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3) did not enforce…
|
5.4
Medium
|
Jul 31, 2026 |
| CVE-2026-17349 |
/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id…
|
9.6
Critical
|
Jul 31, 2026 |
| CVE-2026-17348 |
In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's…
|
6.5
Medium
|
Jul 31, 2026 |
| CVE-2026-17347 |
The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command…
|
7.5
High
|
Jul 31, 2026 |