{"schema_version":1,"title":"Pgadmin 4 vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 14 vulnerabilities in Pgadmin 4: 0 in the last 7 days and 9 in the last 90 days, 2 of them critical and 0 exploited in the wild. The most recent, CVE-2026-116251, was published on 30 October 2026. 9 vulnerabilities in the last four weeks, up from none in the four before.","url":"https://junglewise.ai/threats/technologies/pgadmin-pgadmin-4","json_url":"https://junglewise.ai/threats/technologies/pgadmin-pgadmin-4.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/pgadmin-pgadmin-4","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","thin":false,"counts":{"high":8,"all_time":14,"critical":2,"exploited":0,"last_7_days":0,"last_30_days":9,"last_90_days":9,"last_365_days":14},"latest":[{"cve":"CVE-2026-116251","cvss":4.2,"slug":"cve-2026-116251-pgadmin-4-did-not-invalidate-a-user-s-existing-sessions-when","title":"pgAdmin 4 session invalidation failure after password change","severity":"medium","exploited":false,"published_at":"2026-10-30T20:17:05.337+00:00","url":"https://junglewise.ai/threats/cve-2026-116251-pgadmin-4-did-not-invalidate-a-user-s-existing-sessions-when"},{"cve":"CVE-2026-116249","cvss":8.4,"slug":"cve-2026-116249-in-server-mode-pgadmin-4-resolves-a-server-s-password-file-ssl","title":"pgAdmin 4 path traversal in server credentials","severity":"high","exploited":false,"published_at":"2026-10-30T20:17:05.027+00:00","url":"https://junglewise.ai/threats/cve-2026-116249-in-server-mode-pgadmin-4-resolves-a-server-s-password-file-ssl"},{"cve":"CVE-2026-116248","cvss":6.8,"slug":"cve-2026-116248-in-pgadmin-4-server-mode-only-administrators-are-meant-to-share","title":"pgAdmin 4 unauthorized server sharing to all users","severity":"medium","exploited":false,"published_at":"2026-10-30T20:17:04.883+00:00","url":"https://junglewise.ai/threats/cve-2026-116248-in-pgadmin-4-server-mode-only-administrators-are-meant-to-share"},{"cve":"CVE-2026-116245","cvss":8.2,"slug":"cve-2026-116245-libpq-looks-a-connection-service-up-in-the-service-file-of-the","title":"pgAdmin credential injection via libpq service file","severity":"high","exploited":false,"published_at":"2026-10-30T20:17:04.467+00:00","url":"https://junglewise.ai/threats/cve-2026-116245-libpq-looks-a-connection-service-up-in-the-service-file-of-the"},{"cve":"CVE-2026-116244","cvss":8.2,"slug":"cve-2026-116244-when-a-pgadmin-4-connection-was-not-meant-to-use-a-kerberos-user","title":"pgAdmin 4 Kerberos credential exposure authentication bypass","severity":"high","exploited":false,"published_at":"2026-10-30T20:17:04.327+00:00","url":"https://junglewise.ai/threats/cve-2026-116244-when-a-pgadmin-4-connection-was-not-meant-to-use-a-kerberos-user"},{"cve":"CVE-2026-116243","cvss":7.5,"slug":"cve-2026-116243-pgadmin-4-runs-pg-dump-pg-restore-pg-dumpall-and-psql-from-the","title":"pgAdmin 4 arbitrary code execution via binary path validation bypass","severity":"high","exploited":false,"published_at":"2026-10-30T20:17:04.16+00:00","url":"https://junglewise.ai/threats/cve-2026-116243-pgadmin-4-runs-pg-dump-pg-restore-pg-dumpall-and-psql-from-the"},{"cve":"CVE-2026-116242","cvss":8.2,"slug":"cve-2026-116242-pgadmin-4-opens-ssh-tunnels-with-the-sshtunnel-library-but-gave","title":"pgAdmin 4 SSH tunnel privilege escalation via service account keys","severity":"high","exploited":false,"published_at":"2026-10-30T20:17:03.983+00:00","url":"https://junglewise.ai/threats/cve-2026-116242-pgadmin-4-opens-ssh-tunnels-with-the-sshtunnel-library-but-gave"},{"cve":"CVE-2026-116240","cvss":6.5,"slug":"cve-2026-116240-in-server-mode-pgadmin-4-validates-a-path-into-the-user-s","title":"pgAdmin 4 path traversal in storage directory access","severity":"medium","exploited":false,"published_at":"2026-10-30T20:17:03.383+00:00","url":"https://junglewise.ai/threats/cve-2026-116240-in-server-mode-pgadmin-4-validates-a-path-into-the-user-s"},{"cve":"CVE-2026-116238","cvss":8.1,"slug":"cve-2026-116238-in-server-mode-pgadmin-4-locks-an-internal-account-after-max","title":"pgAdmin 4 account lockout bypass and unlimited password guessing","severity":"high","exploited":false,"published_at":"2026-10-30T20:17:02.433+00:00","url":"https://junglewise.ai/threats/cve-2026-116238-in-server-mode-pgadmin-4-locks-an-internal-account-after-max"},{"cve":"CVE-2025-13780","cvss":9.1,"epss":0.0094,"slug":"cve-2025-13780-pgadmin4-has-a-meta-command-filter-command-execution","title":"PYSEC-2026-450 - pgadmin4 has a Meta-Command Filter Command Execution","severity":"critical","exploited":false,"published_at":"2025-12-11T19:15:52.857+00:00","url":"https://junglewise.ai/threats/cve-2025-13780-pgadmin4-has-a-meta-command-filter-command-execution"},{"cve":"CVE-2025-12765","cvss":7.5,"epss":0.0022,"slug":"cve-2025-12765-pgadmin-has-vulnerability-in-ldap-authentication-mechanism-that","title":"pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification.","severity":"high","exploited":false,"published_at":"2025-11-13T13:15:45.037+00:00","url":"https://junglewise.ai/threats/cve-2025-12765-pgadmin-has-vulnerability-in-ldap-authentication-mechanism-that"},{"cve":"CVE-2025-12764","cvss":7.5,"epss":0.0045,"slug":"cve-2025-12764-pgadmin-is-affected-by-an-ldap-injection-vulnerability","title":"PYSEC-2026-1772 - pgAdmin is affected by an LDAP injection vulnerability","severity":"high","exploited":false,"published_at":"2025-11-13T13:15:44.91+00:00","url":"https://junglewise.ai/threats/cve-2025-12764-pgadmin-is-affected-by-an-ldap-injection-vulnerability"},{"cve":"CVE-2025-12763","cvss":6.8,"epss":0.0094,"slug":"cve-2025-12763-pgadmin-4-has-command-injection-vulnerability-on-windows-systems","title":"PYSEC-2026-1776 - pgAdmin 4 has command injection vulnerability on Windows systems","severity":"medium","exploited":false,"published_at":"2025-11-13T13:15:44.777+00:00","url":"https://junglewise.ai/threats/cve-2025-12763-pgadmin-4-has-command-injection-vulnerability-on-windows-systems"},{"cve":"CVE-2025-12762","cvss":9.1,"epss":0.1271,"slug":"cve-2025-12762-pgadmin4-vulnerable-to-remote-code-execution-rce-when-running-in","title":"PYSEC-2026-454 - pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode","severity":"critical","exploited":false,"published_at":"2025-11-13T13:15:44.62+00:00","url":"https://junglewise.ai/threats/cve-2025-12762-pgadmin4-vulnerable-to-remote-code-execution-rce-when-running-in"}],"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":9},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"related":[],"technology":{"hub":true,"name":"Pgadmin 4","slug":"pgadmin-pgadmin-4","vendor":{"hub":true,"name":"pgAdmin","slug":"pgadmin","url":"https://junglewise.ai/threats/vendors/pgadmin"},"aliases":[],"category":"web","homepage":"https://www.pgadmin.org","repo_url":"https://github.com/pgadmin-org/pgadmin4","description":"Web-based database administration and management tool for PostgreSQL.","url":"https://junglewise.ai/threats/technologies/pgadmin-pgadmin-4"},"most_severe":[{"cve":"CVE-2025-12762","cvss":9.1,"epss":0.1271,"slug":"cve-2025-12762-pgadmin4-vulnerable-to-remote-code-execution-rce-when-running-in","title":"PYSEC-2026-454 - pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode","severity":"critical","exploited":false,"published_at":"2025-11-13T13:15:44.62+00:00","url":"https://junglewise.ai/threats/cve-2025-12762-pgadmin4-vulnerable-to-remote-code-execution-rce-when-running-in"},{"cve":"CVE-2025-13780","cvss":9.1,"epss":0.0094,"slug":"cve-2025-13780-pgadmin4-has-a-meta-command-filter-command-execution","title":"PYSEC-2026-450 - pgadmin4 has a Meta-Command Filter Command Execution","severity":"critical","exploited":false,"published_at":"2025-12-11T19:15:52.857+00:00","url":"https://junglewise.ai/threats/cve-2025-13780-pgadmin4-has-a-meta-command-filter-command-execution"},{"cve":"CVE-2026-116249","cvss":8.4,"slug":"cve-2026-116249-in-server-mode-pgadmin-4-resolves-a-server-s-password-file-ssl","title":"pgAdmin 4 path traversal in server credentials","severity":"high","exploited":false,"published_at":"2026-10-30T20:17:05.027+00:00","url":"https://junglewise.ai/threats/cve-2026-116249-in-server-mode-pgadmin-4-resolves-a-server-s-password-file-ssl"},{"cve":"CVE-2026-116245","cvss":8.2,"slug":"cve-2026-116245-libpq-looks-a-connection-service-up-in-the-service-file-of-the","title":"pgAdmin credential injection via libpq service file","severity":"high","exploited":false,"published_at":"2026-10-30T20:17:04.467+00:00","url":"https://junglewise.ai/threats/cve-2026-116245-libpq-looks-a-connection-service-up-in-the-service-file-of-the"},{"cve":"CVE-2026-116244","cvss":8.2,"slug":"cve-2026-116244-when-a-pgadmin-4-connection-was-not-meant-to-use-a-kerberos-user","title":"pgAdmin 4 Kerberos credential exposure authentication bypass","severity":"high","exploited":false,"published_at":"2026-10-30T20:17:04.327+00:00","url":"https://junglewise.ai/threats/cve-2026-116244-when-a-pgadmin-4-connection-was-not-meant-to-use-a-kerberos-user"},{"cve":"CVE-2026-116242","cvss":8.2,"slug":"cve-2026-116242-pgadmin-4-opens-ssh-tunnels-with-the-sshtunnel-library-but-gave","title":"pgAdmin 4 SSH tunnel privilege escalation via service account keys","severity":"high","exploited":false,"published_at":"2026-10-30T20:17:03.983+00:00","url":"https://junglewise.ai/threats/cve-2026-116242-pgadmin-4-opens-ssh-tunnels-with-the-sshtunnel-library-but-gave"},{"cve":"CVE-2026-116238","cvss":8.1,"slug":"cve-2026-116238-in-server-mode-pgadmin-4-locks-an-internal-account-after-max","title":"pgAdmin 4 account lockout bypass and unlimited password guessing","severity":"high","exploited":false,"published_at":"2026-10-30T20:17:02.433+00:00","url":"https://junglewise.ai/threats/cve-2026-116238-in-server-mode-pgadmin-4-locks-an-internal-account-after-max"},{"cve":"CVE-2025-12764","cvss":7.5,"epss":0.0045,"slug":"cve-2025-12764-pgadmin-is-affected-by-an-ldap-injection-vulnerability","title":"PYSEC-2026-1772 - pgAdmin is affected by an LDAP injection vulnerability","severity":"high","exploited":false,"published_at":"2025-11-13T13:15:44.91+00:00","url":"https://junglewise.ai/threats/cve-2025-12764-pgadmin-is-affected-by-an-ldap-injection-vulnerability"},{"cve":"CVE-2025-12765","cvss":7.5,"epss":0.0022,"slug":"cve-2025-12765-pgadmin-has-vulnerability-in-ldap-authentication-mechanism-that","title":"pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification.","severity":"high","exploited":false,"published_at":"2025-11-13T13:15:45.037+00:00","url":"https://junglewise.ai/threats/cve-2025-12765-pgadmin-has-vulnerability-in-ldap-authentication-mechanism-that"},{"cve":"CVE-2026-116243","cvss":7.5,"slug":"cve-2026-116243-pgadmin-4-runs-pg-dump-pg-restore-pg-dumpall-and-psql-from-the","title":"pgAdmin 4 arbitrary code execution via binary path validation bypass","severity":"high","exploited":false,"published_at":"2026-10-30T20:17:04.16+00:00","url":"https://junglewise.ai/threats/cve-2026-116243-pgadmin-4-runs-pg-dump-pg-restore-pg-dumpall-and-psql-from-the"}],"generated_at":"2026-11-09T03:07:00.176479+00:00"}