CVE-2026-17566 | Critical | 9.9 | 2026-07-31 | pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the ren… |
CVE-2026-17351 | Critical | 9.0 | 2026-07-31 | The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as exa… |
CVE-2026-17350 | Medium | 5.4 | 2026-07-31 | The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3) did not enforce its permission check consistently. In… |
CVE-2026-17349 | Critical | 9.6 | 2026-07-31 | /misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server… |
CVE-2026-17348 | Medium | 6.5 | 2026-07-31 | In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-m… |
CVE-2026-17347 | High | 7.5 | 2026-07-31 | The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with… |
CVE-2026-17346 | High | 8.8 | 2026-07-31 | The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several… |
CVE-2026-12050 | Medium | 4.3 | 2026-06-19 | SQL injection in pgAdmin 4's named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}). The user-supplied 'value' field was interpolated di… |
CVE-2026-12049 | Medium | 4.3 | 2026-06-19 | Open redirect in pgAdmin 4's multi-factor authentication flow. The MFA validate and register endpoints honoured the user-supplied 'next' query/form parameter w… |
CVE-2026-12048 | Critical | 9.3 | 2026-06-19 | Stored cross-site scripting in pgAdmin 4's error-rendering and plan-node-rendering paths. Text returned by a PostgreSQL server (ErrorResponse messages, includi… |
CVE-2026-12047 | Low | 3.5 | 2026-06-19 | HTML injection in pgAdmin 4's cloud deployment module. The verify_credentials, deploy, regions, and update-server endpoints under /rds/, /azure/, /google/, and… |
CVE-2026-12046 | Critical | 9.0 | 2026-06-19 | Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_id> and POST /sqleditor/initialize/sqleditor/update_connecti… |
CVE-2026-12045 | Critical | 9.0 | 2026-06-19 | Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary… |
CVE-2026-12044 | High | 8.8 | 2026-06-19 | SQL injection in pgAdmin 4 across every dialog template that renders ``COMMENT ON ... IS '<description>'`` for a user-supplied description field. The Jinja tem… |
CVE-2026-7820 | Medium | 6.5 | 2026-05-11 | Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4.
pgAdmin enforces MAX_LOGIN_ATTEMPTS only inside its custom /authenticate/log… |
CVE-2026-7819 | High | 8.1 | 2026-05-11 | Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager.
check_access_permission used os.path.abspath, which resolves '..' but does not resolv… |
CVE-2026-7818 | High | 7.0 | 2026-05-11 | Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager.
The session manager performed unsafe deserialization of session-file conten… |
CVE-2026-7817 | Medium | 6.5 | 2026-05-11 | Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints.
User-supplied api_key_file and… |
CVE-2026-7816 | High | 8.8 | 2026-05-11 | OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export.
User-supplied input was interpolated directly into a psql \copy metacomma… |
CVE-2026-7815 | High | 8.8 | 2026-05-11 | SQL injection vulnerability in pgAdmin 4 Maintenance Tool.
Four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_… |
CVE-2026-7814 | Medium | 4.8 | 2026-05-11 | Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules.
User-controlled PostgreSQL object names (database, s… |
CVE-2026-7813 | Critical | 9.9 | 2026-05-11 | Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules.
Multiple en… |
CVE-2026-1707 | High | 7.4 | 2026-02-05 | pgAdmin versions 9.11 are affected by a Restore restriction bypass via key disclosure vulnerability that occurs when running in server mode and performing rest… |
CVE-2025-13780 | Critical | 9.1 | 2025-12-11 | pgAdmin versions up to 9.10 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PL… |
CVE-2025-12765 | High | 7.5 | 2025-11-13 | pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification. |
CVE-2025-12764 | High | 7.5 | 2025-11-13 | pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the… |
CVE-2025-12763 | Medium | 6.8 | 2025-11-13 | pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup… |
CVE-2025-12762 | Critical | 9.1 | 2025-11-13 | pgAdmin versions up to 9.9 are affected by a Remote Code Execution (RCE) vulnerability that occurs when running in server mode and performing restores from PLA… |
CVE-2025-9636 | High | 7.9 | 2025-09-04 | pgAdmin <= 9.7 is affected by a Cross-Origin Opener Policy (COOP) vulnerability. This vulnerability allows an attacker to manipulate the OAuth flow, potential… |
CVE-2025-2946 | Critical | 9.1 | 2025-04-03 | pgAdmin <= 9.1 is affected by a security vulnerability with Cross-Site Scripting(XSS). If attackers execute any arbitrary HTML/JavaScript in a user's browser t… |
CVE-2025-2945 | Critical | 9.9 | 2025-04-03 | Remote Code Execution security vulnerability in pgAdmin 4 (Query Tool and Cloud Deployment modules).
The vulnerability is associated with the 2 POST endpoint… |
CVE-2023-1907 | High | 8.0 | 2025-01-09 | A vulnerability was found in pgadmin. Users logging into pgAdmin running in server mode using LDAP authentication may be attached to another user's session if… |
CVE-2025-0218 | Medium | 5.5 | 2025-01-07 | When batch jobs are executed by pgAgent, a script is created in a temporary directory and then executed. In versions of pgAgent prior to 4.2.3, an insufficient… |
CVE-2024-9014 | Critical | 9.9 | 2024-09-23 | pgAdmin versions 8.11 and earlier are vulnerable to a security flaw in OAuth2 authentication. This vulnerability allows an attacker to potentially obtain the c… |
CVE-2024-6238 | High | 7.4 | 2024-06-25 | pgAdmin <= 8.8 has an installation Directory permission issue. Because of this issue, attackers can gain unauthorised access to the installation directory on t… |
CVE-2024-4216 | High | 7.4 | 2024-05-02 | pgAdmin <= 8.5 is affected by XSS vulnerability in /settings/store API response json payload. This vulnerability allows attackers to execute malicious script a… |
CVE-2024-4215 | High | 7.4 | 2024-05-02 | pgAdmin <= 8.5 is affected by a multi-factor authentication bypass vulnerability. This vulnerability allows an attacker with knowledge of a legitimate account’… |
CVE-2024-3116 | High | 7.4 | 2024-04-04 | pgAdmin <= 8.4 is affected by a Remote Code Execution (RCE) vulnerability through the validate binary path API. This vulnerability allows attackers to execute… |
CVE-2024-2044 | Critical | 9.9 | 2024-03-07 | pgAdmin <= 8.3 is affected by a path-traversal vulnerability while deserializing users’ sessions in the session handling code. If the server is running on Wind… |
CVE-2023-5002 | Medium | 6.0 | 2023-09-22 | A flaw was found in pgAdmin. This issue occurs when the pgAdmin server HTTP API validates the path a user selects to external PostgreSQL utilities such as pg_d… |
CVE-2023-0241 | Medium | 6.5 | 2023-03-27 | pgAdmin 4 versions prior to v6.19 contains a directory traversal vulnerability. A user of the product may change another user's settings or alter the database. |
CVE-2023-22298 | Medium | 6.1 | 2023-01-17 | Open redirect vulnerability in pgAdmin 4 versions prior to v6.14 allows a remote unauthenticated attacker to redirect a user to an arbitrary web site and condu… |
CVE-2022-4223 | High | 8.8 | 2022-12-13 | The pgAdmin server includes an HTTP API that is intended to be used to validate the path a user selects to external PostgreSQL utilities such as pg_dump and pg… |
CVE-2022-0959 | Medium | 6.5 | 2022-03-16 | A malicious, but authorised and authenticated user can construct an HTTP request using their existing CSRF token and session cookie to manually upload files to… |