CVE-2026-17566pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780) Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 07/31/2026 Severity Critical CVE-2026-17351pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045) Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 07/31/2026 Severity Critical CVE-2026-17350pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 07/31/2026 Severity Medium CVE-2026-17349pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-owner Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 07/31/2026 Severity Critical CVE-2026-17348pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046) Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 07/31/2026 Severity Medium CVE-2026-17347pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 07/31/2026 Severity High CVE-2026-17346pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044) Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 07/31/2026 Severity High CVE-2026-12049pgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated 'next' parameter Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 06/18/2026 Severity Medium CVE-2026-12048pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parser Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 06/18/2026 Severity Critical CVE-2026-12047pgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception text Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 06/18/2026 Severity Medium CVE-2026-12046pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code execution Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 06/18/2026 Severity Critical CVE-2026-12045pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code execution Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 06/18/2026 Severity Critical CVE-2026-12050pgAdmin 4: SQL injection in named restore point endpoint Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 06/18/2026 Severity Medium CVE-2026-12044pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templates Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 06/18/2026 Severity High CVE-2026-7820pgAdmin 4: Account-lockout bypass via Flask-Security default /login view Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 05/11/2026 Severity Medium CVE-2026-7819pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file write Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 05/11/2026 Severity High CVE-2026-7818pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code execution Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 05/11/2026 Severity High CVE-2026-7817pgAdmin 4: Local file inclusion and server-side request forgery in LLM API configuration endpoints Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 05/11/2026 Severity High CVE-2026-7816pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakout Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 05/11/2026 Severity High CVE-2026-7815pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code execution Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 05/11/2026 Severity High CVE-2026-7814pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizer Exploitation status Public exploit Fix Affected product P pgAdmin 4 Published 05/11/2026 Severity Medium CVE-2026-7813pgAdmin 4: Cross-user data access and shared-server privilege escalation in server mode Exploitation status Public exploit Fix Affected product P pgAdmin 4 Published 05/11/2026 Severity Critical CVE-2026-1707Restore restriction bypass via key disclosure vulnerability (pgAdmin 4) Exploitation status Not known exploited Fix Not confirmed Affected product P pgAdmin 4 Published 02/05/2026 Severity High CVE-2025-13780Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4) Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 12/11/2025 Severity Critical CVE-2025-12765pgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass. Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 11/13/2025 Severity High CVE-2025-12764pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow. Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 11/13/2025 Severity High CVE-2025-12763Command injection vulnerability allowing arbitrary command execution on Windows Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 11/13/2025 Severity Medium CVE-2025-12762Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4) Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 11/13/2025 Severity Critical CVE-2025-9636Cross-Origin Opener Policy Vulnerability in pgAdmin 4 Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 09/04/2025 Severity High CVE-2025-2946Cross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data Tool of pgAdmin 4 Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 04/03/2025 Severity Critical CVE-2025-2945pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deployment Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 04/03/2025 Severity Critical CVE-2024-9014OAuth2 client id and secret exposed through the web browser in pgAdmin 4 Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 09/23/2024 Severity Critical CVE-2024-6238pgAdmin 4 Installation Directory permission issue Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 06/25/2024 Severity High CVE-2024-4216XSS vulnerability in /settings/store API response json payload in pgAdmin 4 Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 05/02/2024 Severity High CVE-2024-4215The Multi Factor Authentication bypass vulnerability in pgAdmin 4 Exploitation status Not known exploited Fix Affected product P pgAdmin 4 Published 05/02/2024 Severity High CVE-2024-3116Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4 Exploitation status Public exploit Fix Affected product P pgAdmin 4 Published 04/04/2024 Severity High CVE-2024-2044Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4 Exploitation status Public exploit Fix Affected product P pgAdmin 4 Published 03/07/2024 Severity Critical 
