Vulnerabilities

TI-2026-06882 CVE-2026-7820 · GHSA-hv9p-2pqf-r5w3

pgAdmin 4: Account-lockout bypass via Flask-Security default /login view

LOW 36

Improper restriction of excessive authentication attempts (CWE-307) in pgAdmin 4.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00211 Published 2026-05-11 Fixed in 9.15 CWE-307

TI-2026-06881 CVE-2026-7819 · GHSA-hr4r-fwpv-c95j

LOW 34

Symbolic-link path traversal (CWE-61, CWE-22) in pgAdmin 4 File Manager.

CVSS 4.0HIGH 7.2 Network Low privileges No interaction EPSS 0.00325 Published 2026-05-11 Fixed in 9.15 CWE-61

TI-2026-06880 CVE-2026-7818 · GHSA-4rhg-h8f2-v4jm

LOW 33

Deserialization of untrusted data (CWE-502) in pgAdmin 4 FileBackedSessionManager.

CVSS 4.0HIGH 7.3 Local Low privileges No interaction EPSS 0.00131 Published 2026-05-11 Fixed in 9.15 CWE-502

TI-2026-06879 CVE-2026-7817 · GHSA-p58c-q354-6c4f

LOW 31

Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00217 Published 2026-05-11 Fixed in 9.15 CWE-552

TI-2026-06878 CVE-2026-7816 · GHSA-j74f-g7vx-fh4x

MEDIUM 43

OS command injection (CWE-78) vulnerability in pgAdmin 4 Import/Export query export.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.01444 Published 2026-05-11 Fixed in 9.15 CWE-78

TI-2026-06877 CVE-2026-7815 · GHSA-hp84-p2gq-6fvr

MEDIUM 40

SQL injection vulnerability in pgAdmin 4 Maintenance Tool.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00456 Published 2026-05-11 Fixed in 9.15 CWE-89

TI-2026-06876 CVE-2026-7814 · GHSA-6p2c-69cv-3fxq

MEDIUM 55

Stored cross-site scripting (XSS) vulnerability in pgAdmin 4 Browser Tree and Explain Visualizer modules.

CVSS 4.0MEDIUM 4.8 Network High privileges User interaction EPSS 0.00163 Published 2026-05-11 Fixed in 9.15 CWE-79

TI-2026-06875 CVE-2026-7813 · GHSA-h2x2-q2mc-24gw

HIGH 76

Authorization vulnerability in pgAdmin 4 server mode affecting Server Groups, Servers, Shared Servers, Background Processes, and Debugger modules.

CVSS 4.0CRITICAL 9.4 Network Low privileges No interaction EPSS 0.00455 Published 2026-05-11 Fixed in 9.15 CWE-284