P4
Product
pgAdmin 4
27
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 6High 10Medium 11Low 0
Watch
Add pgAdmin 4 to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-86864 | 8.8 | Sep 17 | pgAdmin 4: Argument and connection-string injection via the database field in the Backup tool Affected: before 9.18 |
| CVE-2026-17347 | 8.8 | Jul 31 | pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution Affected: 7.2 before 9.17 |
| CVE-2026-17346 | 8.8 | Jul 31 | pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044) Affected: 1.0 before 9.17; 5.0 before 9.17 |
| CVE-2026-12045 | 8.8 | Jun 18 | pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution Affected: 9.13 before 9.16 |
| CVE-2026-12050 | 8.8 | Jun 18 | pgAdmin 4: SQL injection in named restore point endpoint Affected: 1.0 before 9.16 |
| CVE-2026-12044 | 8.8 | Jun 18 | pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates Affected: 1.0 before 9.16 |
| CVE-2026-7816 | 8.8 | May 11 | pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout Affected: 9.4 before 9.15 |
| CVE-2026-7815 | 8.8 | May 11 | pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution Affected: 7.6 before 9.15 |
| CVE-2026-7819 | 8.1 | May 11 | pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file write Affected: before 9.15 |
| CVE-2026-7818 | 7.8 | May 11 | pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution Affected: before 9.15 |
Showing 10