# pgadmin4 (PyPI) vulnerabilities Source: https://junglewise.ai/threats/technologies/pgadmin4 Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 13 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/pgadmin4.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 28 vulnerabilities in pgadmin4 (PyPI): 0 in the last 7 days and 0 in the last 90 days, 3 of them critical and 0 exploited in the wild. The most recent, CVE-2026-1707, was published on 13 July 2026. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 0 - All time: 28 (3 critical, 0 exploited in the wild) ## About pgadmin4 (PyPI) An open-source administration and management tool for the PostgreSQL database. ## Latest pgadmin4 (PyPI) vulnerabilities - [CVE-2026-1707: PYSEC-2026-2864 - pgadmin4 affected by a Restore restriction bypass via key disclosure vulnerability](https://junglewise.ai/threats/cve-2026-1707-pgadmin-4-restore-restriction-bypass-via-key-disclosure) (low, CVSS 3.1, published 13 Jul 2026) - [CVE-2025-9636: PYSEC-2026-1769 - pgadmin4 is affected by a Cross-Origin Opener Policy (COOP) vulnerability](https://junglewise.ai/threats/cve-2025-9636-pgadmin4-is-affected-by-a-cross-origin-opener-policy-coop) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2023-1907: PYSEC-2026-1770 - pgAdmin has Incorrect Default Permissions](https://junglewise.ai/threats/cve-2023-1907-pgadmin-has-incorrect-default-permissions) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-9014: PYSEC-2026-1775 - OAuth2 client ID and secret exposed through the web browser](https://junglewise.ai/threats/cve-2024-9014-oauth2-client-id-and-secret-exposed-through-the-web-browser) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-4216: PYSEC-2026-1777 - pgAdmin Cross-site Scripting vulnerability in /settings/store API response json payload](https://junglewise.ai/threats/cve-2024-4216-pgadmin-cross-site-scripting-vulnerability-in-settings-store-api) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-4215: PYSEC-2026-1768 - pgAdmin is affected by a multi-factor authentication bypass vulnerability](https://junglewise.ai/threats/cve-2024-4215-pgadmin-multi-factor-authentication-bypass) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2024-3116: PYSEC-2026-1767 - pgAdmin Remote Code Execution (RCE) vulnerability](https://junglewise.ai/threats/cve-2024-3116-pgadmin-remote-code-execution-in-binary-path-validation) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2023-5002: PYSEC-2026-1774 - pgAdmin failed to properly control the server code](https://junglewise.ai/threats/cve-2023-5002-pgadmin-failed-to-properly-control-the-server-code) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2023-0241: PYSEC-2026-1771 - pgAdmin 4 vulnerable to directory traversal](https://junglewise.ai/threats/cve-2023-0241-pgadmin-4-vulnerable-to-directory-traversal) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2023-22298: PYSEC-2026-894 - pgAdmin 4 Open Redirect vulnerability](https://junglewise.ai/threats/cve-2023-22298-pgadmin-4-open-redirect-vulnerability) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2022-4223: PYSEC-2026-893 - pgadmin4 vulnerable to Code Injection](https://junglewise.ai/threats/cve-2022-4223-pgadmin4-vulnerable-to-code-injection) (low, CVSS 3.1, published 7 Jul 2026) - [CVE-2022-0959: PYSEC-2026-729 - pgAdmin 4 Path Traversal vulnerability](https://junglewise.ai/threats/cve-2022-0959-pgadmin-4-path-traversal-vulnerability) (low, CVSS 3.1, published 2 Jul 2026) - [CVE-2024-2044: PYSEC-2026-453 - pgAdmin 4 vulnerable to Unsafe Deserialization and Remote Code Execution by an Authenticated user](https://junglewise.ai/threats/cve-2024-2044-pgadmin-4-vulnerable-to-unsafe-deserialization-and-remote-code) (low, CVSS 3.1, published 29 Jun 2026) - [CVE-2025-2946: PYSEC-2026-449 - pgAdmin 4 Vulnerable to Cross-Site Scripting (XSS) via Query Result Rendering](https://junglewise.ai/threats/cve-2025-2946-pgadmin-4-cross-site-scripting-in-query-result-rendering) (low, CVSS 3.1, published 29 Jun 2026) - [CVE-2025-2945: PYSEC-2026-451 - pgAdmin 4 Vulnerable to Remote Code Execution](https://junglewise.ai/threats/cve-2025-2945-pgadmin-4-vulnerable-to-remote-code-execution) (low, CVSS 3.1, published 29 Jun 2026) - [CVE-2026-7820: PostgreSQL pgAdmin 4 account lockout bypass in login views](https://junglewise.ai/threats/cve-2026-7820-postgresql-pgadmin-4-account-lockout-bypass-in-login-views) (medium, CVSS 6.5, published 11 May 2026) - [CVE-2026-7819: PostgreSQL pgAdmin 4 symbolic-link path traversal in File Manager](https://junglewise.ai/threats/cve-2026-7819-postgresql-pgadmin-4-symbolic-link-path-traversal-in-file-manager) (high, CVSS 8.1, published 11 May 2026) - [CVE-2026-7818: PostgreSQL pgAdmin 4 insecure deserialization in FileBackedSessionManager](https://junglewise.ai/threats/cve-2026-7818-postgresql-pgadmin-4-insecure-deserialization-in) (high, CVSS 7, published 11 May 2026) - [CVE-2026-7817: PostgreSQL pgAdmin 4 LFI and SSRF in LLM API endpoints](https://junglewise.ai/threats/cve-2026-7817-postgresql-pgadmin-4-lfi-and-ssrf-in-llm-api-endpoints) (medium, CVSS 6.5, published 11 May 2026) - [CVE-2026-7816: PostgreSQL pgAdmin 4 OS command injection in Import/Export query export](https://junglewise.ai/threats/cve-2026-7816-postgresql-pgadmin-4-os-command-injection-in-import-export-query) (high, CVSS 8.8, published 11 May 2026) - [CVE-2026-7815: PostgreSQL pgAdmin 4 SQL injection in Maintenance Tool](https://junglewise.ai/threats/cve-2026-7815-postgresql-pgadmin-4-sql-injection-in-maintenance-tool) (high, CVSS 8.8, published 11 May 2026) - [CVE-2026-7814: PostgreSQL pgAdmin 4 stored XSS in Browser Tree and Explain Visualizer](https://junglewise.ai/threats/cve-2026-7814-postgresql-pgadmin-4-stored-xss-in-browser-tree-and-explain) (medium, CVSS 4.8, published 11 May 2026) - [CVE-2026-7813: PostgreSQL pgAdmin 4 authorization bypass and RCE in server mode](https://junglewise.ai/threats/cve-2026-7813-postgresql-pgadmin-4-authorization-bypass-and-rce-in-server-mode) (critical, CVSS 9.9, published 11 May 2026) - [CVE-2025-13780: PYSEC-2026-450 - pgadmin4 has a Meta-Command Filter Command Execution](https://junglewise.ai/threats/cve-2025-13780-pgadmin4-has-a-meta-command-filter-command-execution) (critical, CVSS 9.1, published 11 Dec 2025) - [CVE-2025-12765: pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate…](https://junglewise.ai/threats/cve-2025-12765-pgadmin-has-vulnerability-in-ldap-authentication-mechanism-that) (high, CVSS 7.5, published 13 Nov 2025) ## Most severe pgadmin4 (PyPI) vulnerabilities - [CVE-2026-7813: PostgreSQL pgAdmin 4 authorization bypass and RCE in server mode](https://junglewise.ai/threats/cve-2026-7813-postgresql-pgadmin-4-authorization-bypass-and-rce-in-server-mode) (critical, CVSS 9.9, published 11 May 2026) - [CVE-2025-12762: PYSEC-2026-454 - pgAdmin4 vulnerable to Remote Code Execution (RCE) when running in server mode](https://junglewise.ai/threats/cve-2025-12762-pgadmin4-vulnerable-to-remote-code-execution-rce-when-running-in) (critical, CVSS 9.1, published 13 Nov 2025) - [CVE-2025-13780: PYSEC-2026-450 - pgadmin4 has a Meta-Command Filter Command Execution](https://junglewise.ai/threats/cve-2025-13780-pgadmin4-has-a-meta-command-filter-command-execution) (critical, CVSS 9.1, published 11 Dec 2025) - [CVE-2026-7816: PostgreSQL pgAdmin 4 OS command injection in Import/Export query export](https://junglewise.ai/threats/cve-2026-7816-postgresql-pgadmin-4-os-command-injection-in-import-export-query) (high, CVSS 8.8, published 11 May 2026) - [CVE-2026-7815: PostgreSQL pgAdmin 4 SQL injection in Maintenance Tool](https://junglewise.ai/threats/cve-2026-7815-postgresql-pgadmin-4-sql-injection-in-maintenance-tool) (high, CVSS 8.8, published 11 May 2026) - [CVE-2026-7819: PostgreSQL pgAdmin 4 symbolic-link path traversal in File Manager](https://junglewise.ai/threats/cve-2026-7819-postgresql-pgadmin-4-symbolic-link-path-traversal-in-file-manager) (high, CVSS 8.1, published 11 May 2026) - [CVE-2025-12764: PYSEC-2026-1772 - pgAdmin is affected by an LDAP injection vulnerability](https://junglewise.ai/threats/cve-2025-12764-pgadmin-is-affected-by-an-ldap-injection-vulnerability) (high, CVSS 7.5, published 13 Nov 2025) - [CVE-2025-12765: pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate…](https://junglewise.ai/threats/cve-2025-12765-pgadmin-has-vulnerability-in-ldap-authentication-mechanism-that) (high, CVSS 7.5, published 13 Nov 2025) - [CVE-2026-7818: PostgreSQL pgAdmin 4 insecure deserialization in FileBackedSessionManager](https://junglewise.ai/threats/cve-2026-7818-postgresql-pgadmin-4-insecure-deserialization-in) (high, CVSS 7, published 11 May 2026) - [CVE-2025-12763: PYSEC-2026-1776 - pgAdmin 4 has command injection vulnerability on Windows systems](https://junglewise.ai/threats/cve-2025-12763-pgadmin-4-has-command-injection-vulnerability-on-windows-systems) (medium, CVSS 6.8, published 13 Nov 2025) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 0 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other PyPI technologies - [tensorflow (PyPI)](https://junglewise.ai/threats/technologies/pypi-tensorflow): 435 vulnerabilities - [tensorflow-cpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-cpu): 430 vulnerabilities - [tensorflow-gpu (PyPI)](https://junglewise.ai/threats/technologies/tensorflow-gpu): 427 vulnerabilities - [open-webui (PyPI)](https://junglewise.ai/threats/technologies/open-webui): 177 vulnerabilities - [Django (PyPI)](https://junglewise.ai/threats/technologies/django): 173 vulnerabilities - [apache-airflow (PyPI)](https://junglewise.ai/threats/technologies/apache-airflow): 159 vulnerabilities - [pillow (PyPI)](https://junglewise.ai/threats/technologies/pillow): 125 vulnerabilities - [praisonai (PyPI)](https://junglewise.ai/threats/technologies/pypi-praisonai): 120 vulnerabilities - [vllm (PyPI)](https://junglewise.ai/threats/technologies/pypi-vllm): 117 vulnerabilities - [plone (PyPI)](https://junglewise.ai/threats/technologies/pypi-plone): 101 vulnerabilities - [mlflow (PyPI)](https://junglewise.ai/threats/technologies/mlflow): 88 vulnerabilities - [picklescan (PyPI)](https://junglewise.ai/threats/technologies/picklescan): 86 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "pgadmin4 (PyPI) vulnerabilities", https://junglewise.ai/threats/technologies/pgadmin4, 13 November 2026.