Product by Open Source
Pgadmin
14 known vulnerabilities in Pgadmin (Open Source), 0 of them actively exploited (CISA KEV).
Key figures
14
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
6
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-12046 | Pgadmin.org pgAdmin 4: Missing Authentication for Critical Function | 9.0 | |
| Critical | CVE-2026-17566 | Pgadmin.org pgAdmin 4: OS Command Injection | 9.9 | |
| High | CVE-2026-17347 | pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution | 8.8 | |
| Critical | CVE-2026-12045 | Pgadmin.org pgAdmin 4: SQL Injection | 8.8 | |
| High | CVE-2026-12044 | Pgadmin.org pgAdmin 4: SQL Injection | 8.8 | |
| High | CVE-2026-17346 | Pgadmin.org pgAdmin 4: SQL Injection | 8.8 | |
| Critical | CVE-2026-17351 | Pgadmin.org pgAdmin 4: SQL Injection | 9.0 | |
| Critical | CVE-2026-17349 | Pgadmin.org pgAdmin 4: Authorization Bypass Through User-Controlled Key | 9.6 | |
| High | CVE-2026-12050 | pgAdmin 4: SQL injection in named restore point endpoint | 8.8 | |
| Critical | CVE-2026-12048 | pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parser | 5.4 | |
| Medium | CVE-2026-17348 | Pgadmin.org pgAdmin 4: Missing Authentication for Critical Function | 6.5 | |
| Medium | CVE-2026-12049 | pgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated 'next' parameter | 6.1 | |
| Medium | CVE-2026-17350 | pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlers | 5.4 | |
| Medium | CVE-2026-12047 | Pgadmin.org pgAdmin 4: Cross-site Scripting | 5.4 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 30sans-atrisk-mail,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 25sans-atrisk-mail,