{"schema_version":1,"title":"pgadmin4 (PyPI) vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 28 vulnerabilities in pgadmin4 (PyPI): 0 in the last 7 days and 20 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-1707, was published on 13 July 2026.","url":"https://junglewise.ai/threats/technologies/pgadmin4","json_url":"https://junglewise.ai/threats/technologies/pgadmin4.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/pgadmin4","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":4,"all_time":28,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":20,"last_365_days":28},"latest":[{"cve":"CVE-2026-1707","cvss":3.1,"epss":0.0042,"slug":"cve-2026-1707-pgadmin-4-restore-restriction-bypass-via-key-disclosure","title":"PYSEC-2026-2864 - pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability","severity":"low","exploited":false,"published_at":"2026-07-13T14:36:34.716318+00:00","url":"https://junglewise.ai/threats/cve-2026-1707-pgadmin-4-restore-restriction-bypass-via-key-disclosure"},{"cve":"CVE-2025-12765","cvss":3.1,"epss":0.0022,"slug":"cve-2025-12765-pgadmin-has-vulnerability-in-ldap-authentication-mechanism-that","title":"PYSEC-2026-1773 - pgAdmin has vulnerability in LDAP authentication mechanism that allows bypassing TLS certificate verification","severity":"low","exploited":false,"published_at":"2026-07-07T16:03:10.307459+00:00","url":"https://junglewise.ai/threats/cve-2025-12765-pgadmin-has-vulnerability-in-ldap-authentication-mechanism-that"},{"cve":"CVE-2025-12764","cvss":3.1,"epss":0.0045,"slug":"cve-2025-12764-pgadmin-is-affected-by-an-ldap-injection-vulnerability","title":"PYSEC-2026-1772 - pgAdmin is affected by an LDAP injection vulnerability","severity":"low","exploited":false,"published_at":"2026-07-07T16:03:10.258949+00:00","url":"https://junglewise.ai/threats/cve-2025-12764-pgadmin-is-affected-by-an-ldap-injection-vulnerability"},{"cve":"CVE-2025-12763","cvss":3.1,"epss":0.0094,"slug":"cve-2025-12763-pgadmin-4-has-command-injection-vulnerability-on-windows-systems","title":"PYSEC-2026-1776 - pgAdmin 4 has command injection vulnerability on Windows systems","severity":"low","exploited":false,"published_at":"2026-07-07T16:03:10.21303+00:00","url":"https://junglewise.ai/threats/cve-2025-12763-pgadmin-4-has-command-injection-vulnerability-on-windows-systems"},{"cve":"CVE-2025-9636","cvss":3.1,"epss":0.0022,"slug":"cve-2025-9636-pgadmin4-is-affected-by-a-cross-origin-opener-policy-coop","title":"PYSEC-2026-1769 - pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability","severity":"low","exploited":false,"published_at":"2026-07-07T16:03:03.43354+00:00","url":"https://junglewise.ai/threats/cve-2025-9636-pgadmin4-is-affected-by-a-cross-origin-opener-policy-coop"},{"cve":"CVE-2023-1907","cvss":3.1,"epss":0.0045,"slug":"cve-2023-1907-pgadmin-has-incorrect-default-permissions","title":"PYSEC-2026-1770 - pgAdmin has Incorrect Default Permissions","severity":"low","exploited":false,"published_at":"2026-07-07T14:34:48.738256+00:00","url":"https://junglewise.ai/threats/cve-2023-1907-pgadmin-has-incorrect-default-permissions"},{"cve":"CVE-2024-9014","cvss":3.1,"epss":0.0969,"slug":"cve-2024-9014-oauth2-client-id-and-secret-exposed-through-the-web-browser","title":"PYSEC-2026-1775 - OAuth2 client ID and secret exposed through the web browser","severity":"low","exploited":false,"published_at":"2026-07-07T14:34:42.368977+00:00","url":"https://junglewise.ai/threats/cve-2024-9014-oauth2-client-id-and-secret-exposed-through-the-web-browser"},{"cve":"CVE-2024-4216","cvss":3.1,"epss":0.0046,"slug":"cve-2024-4216-pgadmin-cross-site-scripting-vulnerability-in-settings-store-api","title":"PYSEC-2026-1777 - pgAdmin Cross-site Scripting vulnerability in /settings/store API response json payload","severity":"low","exploited":false,"published_at":"2026-07-07T11:45:40.587232+00:00","url":"https://junglewise.ai/threats/cve-2024-4216-pgadmin-cross-site-scripting-vulnerability-in-settings-store-api"},{"cve":"CVE-2024-4215","cvss":3.1,"epss":0.0063,"slug":"cve-2024-4215-pgadmin-multi-factor-authentication-bypass","title":"PYSEC-2026-1768 - pgAdmin is affected by a multi-factor authentication bypass vulnerability","severity":"low","exploited":false,"published_at":"2026-07-07T11:45:40.517081+00:00","url":"https://junglewise.ai/threats/cve-2024-4215-pgadmin-multi-factor-authentication-bypass"},{"cve":"CVE-2024-3116","cvss":3.1,"epss":0.6557,"slug":"cve-2024-3116-pgadmin-remote-code-execution-in-binary-path-validation","title":"PYSEC-2026-1767 - pgAdmin Remote Code Execution (RCE) vulnerability","severity":"low","exploited":false,"published_at":"2026-07-07T11:45:37.487467+00:00","url":"https://junglewise.ai/threats/cve-2024-3116-pgadmin-remote-code-execution-in-binary-path-validation"},{"cve":"CVE-2023-5002","cvss":3.1,"epss":0.0178,"slug":"cve-2023-5002-pgadmin-failed-to-properly-control-the-server-code","title":"PYSEC-2026-1774 - pgAdmin failed to properly control the server code","severity":"low","exploited":false,"published_at":"2026-07-07T11:45:24.753487+00:00","url":"https://junglewise.ai/threats/cve-2023-5002-pgadmin-failed-to-properly-control-the-server-code"},{"cve":"CVE-2023-0241","cvss":3.1,"epss":0.0883,"slug":"cve-2023-0241-pgadmin-4-vulnerable-to-directory-traversal","title":"PYSEC-2026-1771 - pgAdmin 4 vulnerable to directory traversal","severity":"low","exploited":false,"published_at":"2026-07-07T11:45:17.667092+00:00","url":"https://junglewise.ai/threats/cve-2023-0241-pgadmin-4-vulnerable-to-directory-traversal"},{"cve":"CVE-2023-22298","cvss":3.1,"epss":0.0092,"slug":"cve-2023-22298-pgadmin-4-open-redirect-vulnerability","title":"PYSEC-2026-894 - pgAdmin 4 Open Redirect vulnerability","severity":"low","exploited":false,"published_at":"2026-07-07T10:17:26.876275+00:00","url":"https://junglewise.ai/threats/cve-2023-22298-pgadmin-4-open-redirect-vulnerability"},{"cve":"CVE-2022-4223","cvss":3.1,"epss":0.8007,"slug":"cve-2022-4223-pgadmin4-vulnerable-to-code-injection","title":"PYSEC-2026-893 - pgadmin4 vulnerable to Code Injection","severity":"low","exploited":false,"published_at":"2026-07-07T10:17:25.575476+00:00","url":"https://junglewise.ai/threats/cve-2022-4223-pgadmin4-vulnerable-to-code-injection"},{"cve":"CVE-2022-0959","cvss":3.1,"epss":0.0097,"slug":"cve-2022-0959-pgadmin-4-path-traversal-vulnerability","title":"PYSEC-2026-729 - pgAdmin 4 Path Traversal vulnerability","severity":"low","exploited":false,"published_at":"2026-07-02T14:13:16.698617+00:00","url":"https://junglewise.ai/threats/cve-2022-0959-pgadmin-4-path-traversal-vulnerability"},{"cve":"CVE-2024-2044","cvss":3.1,"epss":0.7947,"slug":"cve-2024-2044-pgadmin-4-vulnerable-to-unsafe-deserialization-and-remote-code","title":"PYSEC-2026-453 - pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user","severity":"low","exploited":false,"published_at":"2026-06-29T11:50:39.082606+00:00","url":"https://junglewise.ai/threats/cve-2024-2044-pgadmin-4-vulnerable-to-unsafe-deserialization-and-remote-code"},{"cve":"CVE-2025-13780","cvss":3.1,"epss":0.0094,"slug":"cve-2025-13780-pgadmin4-has-a-meta-command-filter-command-execution","title":"PYSEC-2026-450 - pgadmin4 has a Meta-Command Filter Command Execution","severity":"low","exploited":false,"published_at":"2026-06-29T11:50:38.596444+00:00","url":"https://junglewise.ai/threats/cve-2025-13780-pgadmin4-has-a-meta-command-filter-command-execution"},{"cve":"CVE-2025-12762","cvss":3.1,"epss":0.1266,"slug":"cve-2025-12762-pgadmin4-vulnerable-to-remote-code-execution-rce-when-running-in","title":"PYSEC-2026-454 - pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode","severity":"low","exploited":false,"published_at":"2026-06-29T11:50:36.720081+00:00","url":"https://junglewise.ai/threats/cve-2025-12762-pgadmin4-vulnerable-to-remote-code-execution-rce-when-running-in"},{"cve":"CVE-2025-2946","cvss":3.1,"epss":0.0032,"slug":"cve-2025-2946-pgadmin-4-cross-site-scripting-in-query-result-rendering","title":"PYSEC-2026-449 - pgAdmin 4 Vulnerable to Cross-Site Scripting (XSS) via Query Result Rendering","severity":"low","exploited":false,"published_at":"2026-06-29T11:50:35.932459+00:00","url":"https://junglewise.ai/threats/cve-2025-2946-pgadmin-4-cross-site-scripting-in-query-result-rendering"},{"cve":"CVE-2025-2945","cvss":3.1,"epss":0.563,"slug":"cve-2025-2945-pgadmin-4-vulnerable-to-remote-code-execution","title":"PYSEC-2026-451 - pgAdmin 4 Vulnerable to Remote Code Execution","severity":"low","exploited":false,"published_at":"2026-06-29T11:50:35.745757+00:00","url":"https://junglewise.ai/threats/cve-2025-2945-pgadmin-4-vulnerable-to-remote-code-execution"},{"cve":"CVE-2026-7820","cvss":6.5,"epss":0.0033,"slug":"cve-2026-7820-postgresql-pgadmin-4-account-lockout-bypass-in-login-views","title":"PostgreSQL pgAdmin 4 account lockout bypass in login views","severity":"medium","exploited":false,"published_at":"2026-05-11T16:17:39.497+00:00","url":"https://junglewise.ai/threats/cve-2026-7820-postgresql-pgadmin-4-account-lockout-bypass-in-login-views"},{"cve":"CVE-2026-7819","cvss":8.1,"epss":0.0049,"slug":"cve-2026-7819-postgresql-pgadmin-4-symbolic-link-path-traversal-in-file-manager","title":"PostgreSQL pgAdmin 4 symbolic-link path traversal in File Manager","severity":"high","exploited":false,"published_at":"2026-05-11T16:17:39.113+00:00","url":"https://junglewise.ai/threats/cve-2026-7819-postgresql-pgadmin-4-symbolic-link-path-traversal-in-file-manager"},{"cve":"CVE-2026-7818","cvss":7,"epss":0.0035,"slug":"cve-2026-7818-postgresql-pgadmin-4-insecure-deserialization-in","title":"PostgreSQL pgAdmin 4 insecure deserialization in FileBackedSessionManager","severity":"high","exploited":false,"published_at":"2026-05-11T16:17:38.847+00:00","url":"https://junglewise.ai/threats/cve-2026-7818-postgresql-pgadmin-4-insecure-deserialization-in"},{"cve":"CVE-2026-7817","cvss":6.5,"epss":0.0035,"slug":"cve-2026-7817-postgresql-pgadmin-4-lfi-and-ssrf-in-llm-api-endpoints","title":"PostgreSQL pgAdmin 4 LFI and SSRF in LLM API endpoints","severity":"medium","exploited":false,"published_at":"2026-05-11T16:17:38.59+00:00","url":"https://junglewise.ai/threats/cve-2026-7817-postgresql-pgadmin-4-lfi-and-ssrf-in-llm-api-endpoints"},{"cve":"CVE-2026-7816","cvss":8.8,"epss":0.0218,"slug":"cve-2026-7816-postgresql-pgadmin-4-os-command-injection-in-import-export-query","title":"PostgreSQL pgAdmin 4 OS command injection in Import/Export query export","severity":"high","exploited":false,"published_at":"2026-05-11T16:17:38.26+00:00","url":"https://junglewise.ai/threats/cve-2026-7816-postgresql-pgadmin-4-os-command-injection-in-import-export-query"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":6},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":13},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"tensorflow (PyPI)","slug":"pypi-tensorflow","vulnerabilities":428,"url":"https://junglewise.ai/threats/technologies/pypi-tensorflow"},{"name":"tensorflow-cpu (PyPI)","slug":"tensorflow-cpu","vulnerabilities":424,"url":"https://junglewise.ai/threats/technologies/tensorflow-cpu"},{"name":"tensorflow-gpu (PyPI)","slug":"tensorflow-gpu","vulnerabilities":421,"url":"https://junglewise.ai/threats/technologies/tensorflow-gpu"},{"name":"open-webui (PyPI)","slug":"open-webui","vulnerabilities":177,"url":"https://junglewise.ai/threats/technologies/open-webui"},{"name":"Django (PyPI)","slug":"django","vulnerabilities":172,"url":"https://junglewise.ai/threats/technologies/django"},{"name":"apache-airflow (PyPI)","slug":"apache-airflow","vulnerabilities":152,"url":"https://junglewise.ai/threats/technologies/apache-airflow"},{"name":"plone (PyPI)","slug":"pypi-plone","vulnerabilities":101,"url":"https://junglewise.ai/threats/technologies/pypi-plone"},{"name":"praisonai (PyPI)","slug":"pypi-praisonai","vulnerabilities":86,"url":"https://junglewise.ai/threats/technologies/pypi-praisonai"},{"name":"exiv2 (PyPI)","slug":"exiv2","vulnerabilities":85,"url":"https://junglewise.ai/threats/technologies/exiv2"},{"name":"nltk (PyPI)","slug":"nltk","vulnerabilities":83,"url":"https://junglewise.ai/threats/technologies/nltk"},{"name":"mlflow (PyPI)","slug":"mlflow","vulnerabilities":82,"url":"https://junglewise.ai/threats/technologies/mlflow"},{"name":"pillow (PyPI)","slug":"pillow","vulnerabilities":79,"url":"https://junglewise.ai/threats/technologies/pillow"}],"technology":{"hub":true,"name":"pgadmin4 (PyPI)","slug":"pgadmin4","vendor":{"name":"PyPI","slug":"pypi","url":"https://junglewise.ai/threats/vendors/pypi"},"aliases":[],"homepage":"https://www.pgadmin.org/","repo_url":"https://github.com/pgadmin-org/pgadmin4","description":"An open-source administration and management tool for the PostgreSQL database.","url":"https://junglewise.ai/threats/technologies/pgadmin4"},"most_severe":[{"cve":"CVE-2026-7813","cvss":9.9,"epss":0.0065,"slug":"cve-2026-7813-postgresql-pgadmin-4-authorization-bypass-and-rce-in-server-mode","title":"PostgreSQL pgAdmin 4 authorization bypass and RCE in server mode","severity":"critical","exploited":false,"published_at":"2026-05-11T16:17:37.47+00:00","url":"https://junglewise.ai/threats/cve-2026-7813-postgresql-pgadmin-4-authorization-bypass-and-rce-in-server-mode"},{"cve":"CVE-2026-7816","cvss":8.8,"epss":0.0218,"slug":"cve-2026-7816-postgresql-pgadmin-4-os-command-injection-in-import-export-query","title":"PostgreSQL pgAdmin 4 OS command injection in Import/Export query export","severity":"high","exploited":false,"published_at":"2026-05-11T16:17:38.26+00:00","url":"https://junglewise.ai/threats/cve-2026-7816-postgresql-pgadmin-4-os-command-injection-in-import-export-query"},{"cve":"CVE-2026-7815","cvss":8.8,"epss":0.0064,"slug":"cve-2026-7815-postgresql-pgadmin-4-sql-injection-in-maintenance-tool","title":"PostgreSQL pgAdmin 4 SQL injection in Maintenance Tool","severity":"high","exploited":false,"published_at":"2026-05-11T16:17:37.873+00:00","url":"https://junglewise.ai/threats/cve-2026-7815-postgresql-pgadmin-4-sql-injection-in-maintenance-tool"},{"cve":"CVE-2026-7819","cvss":8.1,"epss":0.0049,"slug":"cve-2026-7819-postgresql-pgadmin-4-symbolic-link-path-traversal-in-file-manager","title":"PostgreSQL pgAdmin 4 symbolic-link path traversal in File Manager","severity":"high","exploited":false,"published_at":"2026-05-11T16:17:39.113+00:00","url":"https://junglewise.ai/threats/cve-2026-7819-postgresql-pgadmin-4-symbolic-link-path-traversal-in-file-manager"},{"cve":"CVE-2026-7818","cvss":7,"epss":0.0035,"slug":"cve-2026-7818-postgresql-pgadmin-4-insecure-deserialization-in","title":"PostgreSQL pgAdmin 4 insecure deserialization in FileBackedSessionManager","severity":"high","exploited":false,"published_at":"2026-05-11T16:17:38.847+00:00","url":"https://junglewise.ai/threats/cve-2026-7818-postgresql-pgadmin-4-insecure-deserialization-in"},{"cve":"CVE-2026-7817","cvss":6.5,"epss":0.0035,"slug":"cve-2026-7817-postgresql-pgadmin-4-lfi-and-ssrf-in-llm-api-endpoints","title":"PostgreSQL pgAdmin 4 LFI and SSRF in LLM API endpoints","severity":"medium","exploited":false,"published_at":"2026-05-11T16:17:38.59+00:00","url":"https://junglewise.ai/threats/cve-2026-7817-postgresql-pgadmin-4-lfi-and-ssrf-in-llm-api-endpoints"},{"cve":"CVE-2026-7820","cvss":6.5,"epss":0.0033,"slug":"cve-2026-7820-postgresql-pgadmin-4-account-lockout-bypass-in-login-views","title":"PostgreSQL pgAdmin 4 account lockout bypass in login views","severity":"medium","exploited":false,"published_at":"2026-05-11T16:17:39.497+00:00","url":"https://junglewise.ai/threats/cve-2026-7820-postgresql-pgadmin-4-account-lockout-bypass-in-login-views"},{"cve":"CVE-2026-7814","cvss":4.8,"epss":0.0025,"slug":"cve-2026-7814-postgresql-pgadmin-4-stored-xss-in-browser-tree-and-explain","title":"PostgreSQL pgAdmin 4 stored XSS in Browser Tree and Explain Visualizer","severity":"medium","exploited":false,"published_at":"2026-05-11T16:17:37.62+00:00","url":"https://junglewise.ai/threats/cve-2026-7814-postgresql-pgadmin-4-stored-xss-in-browser-tree-and-explain"},{"cve":"CVE-2022-4223","cvss":3.1,"epss":0.8007,"slug":"cve-2022-4223-pgadmin4-vulnerable-to-code-injection","title":"PYSEC-2026-893 - pgadmin4 vulnerable to Code Injection","severity":"low","exploited":false,"published_at":"2026-07-07T10:17:25.575476+00:00","url":"https://junglewise.ai/threats/cve-2022-4223-pgadmin4-vulnerable-to-code-injection"},{"cve":"CVE-2024-2044","cvss":3.1,"epss":0.7947,"slug":"cve-2024-2044-pgadmin-4-vulnerable-to-unsafe-deserialization-and-remote-code","title":"PYSEC-2026-453 - pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user","severity":"low","exploited":false,"published_at":"2026-06-29T11:50:39.082606+00:00","url":"https://junglewise.ai/threats/cve-2024-2044-pgadmin-4-vulnerable-to-unsafe-deserialization-and-remote-code"}],"generated_at":"2026-09-27T03:07:00.185062+00:00"}