[ Vendor · 15 CVEs ]
pgadmin.org
CVEs affecting pgadmin.org published in the last 30 days, plus any pgadmin.org CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-116249 | 30 Oct 2026 | CVSS 8.4 | pgadmin.org pgAdmin 4In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH tunnel identity file relative to the user's storage… | |
| CVE-2026-116250 | 30 Oct 2026 | CVSS 6.5 | pgadmin.org pgAdmin 4In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with check_access_permission() and then opened it by… | |
| CVE-2026-116251 | 30 Oct 2026 | CVSS 5.4 | pgadmin.org pgAdmin 4pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either through the user's own change password dialog or through… | Fix |
| CVE-2026-116252 | 30 Oct 2026 | CVSS 6.5 | pgadmin.org pgAdmin 4pgAdmin 4's materialized view refresh passed the target database's name to psql's --dbname argument unchanged. libpq treats a --dbname value… | Fix |
| CVE-2026-116243 | 30 Oct 2026 | CVSS 8.8 | pgadmin.org pgAdmin 4pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their preferences. In server mode the binary path was… | Fix |
| CVE-2026-116244 | 30 Oct 2026 | CVSS 9.6 | pgadmin.org pgAdmin 4When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin removed KRB5CCNAME from its environment, so the… | Fix |
| CVE-2026-116245 | 30 Oct 2026 | CVSS 9.6 | pgadmin.org pgAdmin 4libpq looks a connection service up in the service file of the operating-system account running pgAdmin 4, and an entry there can hold a password or… | Fix |
| CVE-2026-116246 | 30 Oct 2026 | CVSS 7.6 | pgadmin.org pgAdmin 4To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes, the server manager wrote it into pgAdmin's own… | Fix |
| CVE-2026-116247 | 30 Oct 2026 | CVSS 9.6 | pgadmin.org pgAdmin 4When a server in pgAdmin 4 had no password file, client certificate or client key configured, or the configured one could not be found, pgAdmin left… | Fix |
| CVE-2026-116248 | 30 Oct 2026 | CVSS 6.8 | pgadmin.org pgAdmin 4In pgAdmin 4 server mode only administrators are meant to share a server with all users; the server dialog shows the Shared switch only to them. The… | |
| CVE-2026-116239 | 30 Oct 2026 | CVSS 8.8 | pgadmin.org pgAdmin 4In server mode pgAdmin 4 keeps an account per authentication source, so the same username can exist as, for example, an internal account and an LDAP… | Fix |
| CVE-2026-116240 | 30 Oct 2026 | CVSS 6.5 | pgadmin.org pgAdmin 4In server mode pgAdmin 4 validates a path into the user's storage directory with check_access_permission(), which builds the absolute path with… | Fix |
| CVE-2026-116241 | 30 Oct 2026 | CVSS 8.8 | pgadmin.org pgAdmin 4pgAdmin 4's Import/Export Data tool wraps a user's query export in a psql \copy (...) TO command and checks that the query's parentheses are balanced… | Fix |
| CVE-2026-116242 | 30 Oct 2026 | CVSS 9.6 | pgadmin.org pgAdmin 4pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories nor ssh_config_file, so it always loaded the… | Fix |
| CVE-2026-116238 | 30 Oct 2026 | CVSS 8.1 | pgadmin.org pgAdmin 4In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by default). The limit could be bypassed, giving an… |