P4
Product
Pgadmin 4
46
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 9High 19Medium 18Low 0
Watch
Add Pgadmin 4 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-17566 | 9.9 | Jul 31 | pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780) Affected: before 9.18 |
| CVE-2026-7813 | 9.9 | May 11 | pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode Affected: before 9.15 |
| CVE-2024-2044 | 9.9 | Mar 7 | pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code Affected: before 8.4 |
| CVE-2026-86863 | 9.8 | Sep 17 | pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication mode Affected: 6.2 before 9.18 |
| CVE-2025-12762 | 9.8 | Nov 13 | pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump files Affected: before 9.10 |
| CVE-2024-3116 | 9.8 | Apr 4 | pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API Affected: through 8.4 |
| CVE-2026-17349 | 9.6 | Jul 31 | pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner Affected: 9.0 before 9.17 |
| CVE-2026-17351 | 9.0 | Jul 31 | pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045) Affected: 9.13 before 9.17 |
| CVE-2026-12046 | 9.0 | Jun 18 | pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code execution Affected: 6.9 before 9.16 |
Showing 9