Read the docs

Vulnerabilities

Filters

Reset all
Threatist priority
Signals
Fix status
Impact type
Attack vector
Requirements
Product

Products as named in CPE, with their records.

Published
Weakness (CWE)
1 selected

7 records

Release: pgadmin.org pgAdmin 4 9.16 Clear all filters
TI-2026-10383 CVE-2026-12046 · GHSA-mmqg-h4qx-g8qv

Missing authentication in pgadmin.org pgAdmin 4

Priority MEDIUM 45

Two state-mutating endpoints in pgAdmin 4's SQL Editor blueprint -- DELETE /sqleditor/close/<trans_id> and POST /sqleditor/initialize/sqleditor/update_connection/<sgid>/<sid>/<did> -- were the only routes in the module m…

CVSS 4.0CRITICAL 9.5 Network No auth No interaction EPSS 0.01037 Published 2026-06-18 Fixed in 9.16 CWE-306
TI-2026-10382 CVE-2026-12045 · GHSA-95q2-vx3p-f723

pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution

Priority MEDIUM 43

Read-only transaction bypass in the pgAdmin 4 AI Assistant allows an attacker who can influence database content that the assistant reads to execute arbitrary SQL with the privileges of the pgAdmin user's database role.

CVSS 4.0CRITICAL 9.4 Network Low privileges User interaction EPSS 0.00658 Published 2026-06-18 Fixed in 9.16 CWE-77
TI-2026-10387 CVE-2026-12050 · GHSA-v395-x24j-4r3g

pgAdmin 4: SQL injection in named restore point endpoint

Priority LOW 24

SQL injection in pgAdmin 4's named restore point endpoint (POST /browser/server/restore_point/{gid}/{sid}).

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00426 Published 2026-06-18 Fixed in 9.16 CWE-89