pgAdmin 4

Every one of the 56 is a mark on the map. Named now: 1 to 26, most at risk first.

1. pgAdmin 4 - Authentication BypassCVE-2024-9014pgadmin.org · CVSS 9.9 · 9.7% likely

   CWE-522

2. Unsafe Deserialisation and Remote Code Execution by an Authenticated user in pgAdmin 4CVE-2024-2044pgadmin.org · CVSS 9.9 · 79% likely

   CWE-31

3. Remote Code Execution Vulnerability through the validate binary path API in pgAdmin 4CVE-2024-3116pgadmin.org · CVSS 7.4 · 66% likely

   CWE-77

4. pgAdmin 4: Remote Code Execution in Query Tool and Cloud DeploymentCVE-2025-2945pgadmin.org · CVSS 9.9 · 56% likely

   CWE-94

5. Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)CVE-2025-12762pgadmin.org · CVSS 9.1 · 13% likely

   CWE-94

6. pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakoutCVE-2026-7816pgadmin.org · CVSS 8.8 · 1.4% likely

   CWE-78

7. pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code executionCVE-2026-12046pgadmin.org · CVSS 9 · 1.0% likelycovered by CyberSIXT

   CWE-306

8. Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)CVE-2025-13780pgadmin.org · CVSS 9.1 · 0.9% likely

   CWE-94

9. Command injection vulnerability allowing arbitrary command execution on WindowsCVE-2025-12763pgadmin.org · CVSS 6.8 · 0.9% likely

   CWE-78

10. pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitutionCVE-2026-17347pgadmin.org · CVSS 7.5 · 0.7% likely

    CWE-78

11. pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templatesCVE-2026-12044pgadmin.org · CVSS 8.8 · 0.7% likely

    CWE-89

12. pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)CVE-2026-17566pgadmin.org · CVSS 9.9 · 0.7% likelycovered by CyberSIXT

    CWE-78

13. pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code executionCVE-2026-12045pgadmin.org · CVSS 9 · 0.7% likelycovered by CyberSIXT

    CWE-89

14. The Multi Factor Authentication bypass vulnerability in pgAdmin 4CVE-2024-4215pgadmin.org · CVSS 7.4 · 0.6% likely

    CWE-89

15. pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)CVE-2026-17346pgadmin.org · CVSS 8.8 · 0.6% likely

    CWE-89

16. pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication modeCVE-2026-86863pgadmin.org · CVSS 9.8 · 0.6% likelycovered by CyberSIXT

    CWE-2901 article

17. pgAdmin 4: Argument and connection-string injection via the database field in the Backup toolCVE-2026-86864pgadmin.org · CVSS 8.8 · 0.6% likely

    CWE-88

18. pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)CVE-2026-17351pgadmin.org · CVSS 9 · 0.5% likely

    CWE-89

19. pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.CVE-2025-12764pgadmin.org · CVSS 7.5 · 0.5% likely

    CWE-90

20. XSS vulnerability in /settings/store API response json payload in pgAdmin 4CVE-2024-4216pgadmin.org · CVSS 7.4 · 0.5% likely

    CWE-79

21. pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code executionCVE-2026-7815pgadmin.org · CVSS 8.8 · 0.5% likely

    CWE-89

22. pgAdmin 4: Cross-user data access and shared-server privilege escalation in server modeCVE-2026-7813pgadmin.org · CVSS 9.9 · 0.5% likely

    CWE-284

23. Restore restriction bypass via key disclosure vulnerability (pgAdmin 4)CVE-2026-1707pgadmin.org · CVSS 7.4 · 0.4% likely

    CWE-284

24. pgAdmin 4: SQL injection in named restore point endpointCVE-2026-12050pgadmin.org · CVSS 4.3 · 0.4% likely

    CWE-89

25. pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-…CVE-2026-17348pgadmin.org · CVSS 6.5 · 0.4% likely

    CWE-306

26. pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checksCVE-2026-116238pgadmin.org · CVSS 8.1 · 0.4% likelycovered by CyberSIXT

    CWE-3071 article

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.