Login Request a demo
P4
Product
Pgadmin 4
by Pgadmin · last CVE Sep 17, 2026
46
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Vulnerabilities46In the news0Timeline
Severity mix
Critical 9High 19Medium 18Low 0
Severity
All severities46Critical9High19Medium18Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Pgadmin 4 to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-86864
8.8
1%
Sep 17
pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool
Affected: before 9.18
CVE-2026-17347
8.8
1%
Jul 31
pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution
Affected: 7.2 before 9.17
CVE-2026-17346
8.8
1%
Jul 31
pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)
Affected: 1.0 before 9.17
CVE-2026-12045
8.8
1%
Jun 18
pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution
Affected: 9.13 before 9.16
CVE-2026-12050
8.8
0%
Jun 18
pgAdmin 4: SQL injection in named restore point endpoint
Affected: 1.0 before 9.16
CVE-2026-12044
8.8
1%
Jun 18
pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates
Affected: 1.0 before 9.16
CVE-2026-7816
8.8
1%
May 11
pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout
Affected: 9.4 before 9.15
CVE-2026-7815
8.8
0%
May 11
pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution
Affected: 7.6 before 9.15
CVE-2025-13780
8.8
1%
Dec 11
pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLAIN-format dump…
Affected: through 9.10
CVE-2025-12763
8.8
1%
Nov 13
pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems
Affected: before 9.10
CVE-2025-2945
8.8
56%
Apr 3
Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules)
Affected: before 9.2
CVE-2024-4215
8.8
1%
May 2
pgAdmin <= 8.5 is affected by a multi-factor authentication bypass vulnerability
Affected: before 8.6
CVE-2023-5002
8.8
2%
Sep 22
A flaw was found in pgAdmin
Affected: before 7.7
CVE-2022-4223
8.8
80%
Dec 13
The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg_restore
Affected: before 6.17
CVE-2026-7819
8.1
0%
May 11
pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file write
Affected: before 9.15
CVE-2025-9636
7.9
0%
Sep 4
pgAdmin <= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potentially leading to…
Affected: through 9.7
CVE-2026-7818
7.8
0%
May 11
pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution
Affected: before 9.15
CVE-2025-12764
7.5
0%
Nov 13
pgAdmin <= 9.9  is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing…
Affected: before 9.10
CVE-2025-12765
7.4
0%
Nov 13
pgAdmin <= 9.9  is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification
Affected: before 9.10
Showing 19