Pgadminorg

Vulnerabilities related to Pgadminorg 15

• Medium 7.1 pgAdmin 4にマテリアライズドビュー更新で接続先を乗っ取られる脆弱性 pgAdmin 4のマテリアライズドビュー更新機能に、データベース名を細工すると接続先を外部に向けられる脆弱性が見つかりました。CREATEDB権限を持つユーザーが作成したデータベース名によって、利用者の保存済みサーバーパスワードが攻撃者の用意した接続先に送られるおそれがあります。9.19より前の版が対象で、9.19で修正されています。早めに9.19以降へ更新してください。 CVE-2026-116252 04:55
• Medium 4.2 pgAdmin 4 did not invalidate a user's existing sessions when their password changed, either... CVE-2026-116251 04:55
• Medium 7.3 In server mode pgAdmin 4 validates a path a user gives for a file in their storage directory with... CVE-2026-116250 04:55
• High 8.4 In server mode pgAdmin 4 resolves a server's password file, SSL certificate, key, CRL and SSH... CVE-2026-116249 04:55
• Medium 6.8 In pgAdmin 4 server mode only administrators are meant to share a server with all users; the... CVE-2026-116248 04:55
• High 8.2 When a server in pgAdmin 4 had no password file, client certificate or client key configured, or... CVE-2026-116247 04:55
• Medium 7.0 To pass a server's password to psql and to the utilities pgAdmin 4 runs as background processes,... CVE-2026-116246 04:55
• High 8.2 libpq looks a connection service up in the service file of the operating-system account running... CVE-2026-116245 04:55
• High 8.2 When a pgAdmin 4 connection was not meant to use a Kerberos user's delegated credentials, pgAdmin... CVE-2026-116244 04:55
• High 7.7 pgAdmin 4 runs pg_dump, pg_restore, pg_dumpall and psql from the binary path a user sets in their... CVE-2026-116243 04:55
• High 8.2 pgAdmin 4 opens SSH tunnels with the sshtunnel library but gave it neither host_pkey_directories... CVE-2026-116242 04:55
• Critical 9.9 pgAdmin 4にOSコマンド実行の脆弱性、9.19で修正 pgAdmin 4のImport/Export Dataに、一般的なDBロールでもpgAdminを動かすホスト上でOSコマンドを実行できる脆弱性が見つかり、修正版が出ました。pgAdminを複数人で使っている組織は、版を確認して更新し、非管理者の権限も見直してください。 CVE-2026-116241 04:55
• Medium 7.1 In server mode pgAdmin 4 validates a path into the user's storage directory with... CVE-2026-116240 04:55
• High 8.9 In server mode pgAdmin 4 keeps an account per authentication source, so the same username can... CVE-2026-116239 04:55
• High 9.2 In server mode pgAdmin 4 locks an internal account after MAX_LOGIN_ATTEMPTS failed logins (3 by... CVE-2026-116238 04:55