Every public CVE, as it is published
The whole CVE List, enriched with NVD scores, CISA's known exploited catalog and EPSS exploit probabilities. Updated every few minutes; last read 4 min ago.
At a glance
Published CVEs; rejected ones are not counted.
- 400,313All CVEsplus 18,889 rejected
- 585Last 24 hours2,951 in the last 7 days
- 17,316Last 30 days1,581 of them critical
- 1,767Known exploitedin the CISA KEV catalog
CVEs published per year
All time, by publication date in UTC; follows the filter above.
- Critical
- High
- Medium
- Low
- Not scored
Show the numbers as a table
| Period | Critical | High | Medium | Low | Not scored | Total | Cumulative |
|---|---|---|---|---|---|---|---|
| 2026 | 10 | 22 | 9 | 1 | 0 | 42 | 56 |
| 2025 | 4 | 3 | 1 | 0 | 0 | 8 | 14 |
| 2024 | 2 | 4 | 0 | 0 | 0 | 6 | 6 |
| Title | ||
|---|---|---|
| CVE-2026-116252 | pgAdmin 4: Materialized view refresh redirects its connection through a crafted database namepgadmin.org · pgAdmin 4 | High7.1 |
| CVE-2026-116251 | pgAdmin 4: A user's other sessions survive a change of their passwordpgadmin.org · pgAdmin 4 | Low2.3 |
| CVE-2026-116250 | pgAdmin 4: Files opened in a storage directory follow a symbolic link, hard link or FIFO planted after the containment checkpgadmin.org · pgAdmin 4 | High7.3 |
| CVE-2026-116249 | pgAdmin 4: Connection file paths and parameter keys escape the user's storage directorypgadmin.org · pgAdmin 4 | High7.2 |
| CVE-2026-116248 | pgAdmin 4: Non-administrators can share a server with every userpgadmin.org · pgAdmin 4 | Medium6.0 |
| CVE-2026-116247 | pgAdmin 4: libpq uses the pgAdmin service account's own password file and client certificatepgadmin.org · pgAdmin 4 | High7.1 |
| CVE-2026-116246 | pgAdmin 4: Server passwords are left in pgAdmin's process environmentpgadmin.org · pgAdmin 4 | High7.0 |
| CVE-2026-116245 | pgAdmin 4: Connection services are not restricted in server modepgadmin.org · pgAdmin 4 | High7.1 |
| CVE-2026-116244 | pgAdmin 4: libpq uses the pgAdmin service account's Kerberos credentialspgadmin.org · pgAdmin 4 | High7.1 |
| CVE-2026-116243 | pgAdmin 4: Utility binary path can point at a shared storage directorypgadmin.org · pgAdmin 4 | High7.7 |
| CVE-2026-116242 | pgAdmin 4: SSH tunnels use the pgAdmin service account's own SSH identitypgadmin.org · pgAdmin 4 | High7.1 |
| CVE-2026-116241 | pgAdmin 4: Import/Export Data query export runs a command through a backslash in a double-quoted identifierpgadmin.org · pgAdmin 4 | Critical9.4 |
| CVE-2026-116240 | pgAdmin 4: File Manager and storage-path tools act on a different path from the one checkedpgadmin.org · pgAdmin 4 | High7.1 |
| CVE-2026-116239 | pgAdmin 4: An LDAP or Kerberos login is logged in to another account with the same usernamepgadmin.org · pgAdmin 4 | High8.9 |
| CVE-2026-116238 | pgAdmin 4: The failed login limit can be bypassed, and Flask-Security's own views skip pgAdmin's login and password checkspgadmin.org · pgAdmin 4 | Critical9.2 |
| CVE-2026-86864 | pgAdmin 4: Argument and connection-string injection via the database field in the Backup toolpgadmin.org · pgAdmin 4 | High8.7 |
| CVE-2026-86863 | pgAdmin 4: Authentication bypass via a client-controlled identity header in Webserver authentication modepgadmin.org · pgAdmin 4 | Critical9.3 |
| CVE-2026-86862 | pgAdmin 4: Connection-string injection via the database field in the Restore and Maintenance toolspgadmin.org · pgAdmin 4 | High7.1 |
| CVE-2026-86861 | pgAdmin 4: File Manager save_file writes through a symbolic link planted after the containment checkpgadmin.org · pgAdmin 4 | Medium6.0 |
| CVE-2026-17566 | pgAdmin 4: RCE via backslash-escape mismatch in Import/Export Data query guard (incomplete defense, sibling gap to CVE-2025-13780)pgadmin.org · pgAdmin 4 | Critical9.4 |
| CVE-2026-17351 | pgAdmin 4: AI Assistant read-only transaction bypass via sqlparse/PostgreSQL lexer disagreement (incomplete fix for CVE-2026-12045)pgadmin.org · pgAdmin 4 | Critical9.4 |
| CVE-2026-17350 | pgAdmin 4: Tool permission bypass via backend routes and Socket.IO handlerspgadmin.org · pgAdmin 4 | Medium5.3 |
| CVE-2026-17349 | pgAdmin 4: Adhoc server clone leaks another user's stored database credentials and ownership to a non-ownerpgadmin.org · pgAdmin 4 | Critical9.3 |
| CVE-2026-17348 | pgAdmin 4: Missing authentication decorator on Constraints, preferences, Debugger and Schema Diff routes allows unauthenticated access in SERVER mode (incomplete fix for CVE-2026-12046)pgadmin.org · pgAdmin 4 | Medium6.9 |
| CVE-2026-17347 | pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitutionpgadmin.org · pgAdmin 4 | High7.7 |
| CVE-2026-17346 | pgAdmin 4: SQL injection via unescaped object names in index Statistics and publication/subscription dependency views (incomplete fix for CVE-2026-12044)pgadmin.org · pgAdmin 4 | High8.7 |
| CVE-2026-12049 | pgAdmin 4: Open redirect in multi-factor authentication flow via unvalidated 'next' parameterpgadmin.org · pgAdmin 4 | Medium5.3 |
| CVE-2026-12048 | pgAdmin 4: Stored XSS via untrusted error and plan-node text rendered through html-react-parserpgadmin.org · pgAdmin 4 | Critical9.3 |
| CVE-2026-12047 | pgAdmin 4: HTML injection in cloud verify_credentials / deploy endpoints via unsanitised SDK exception textpgadmin.org · pgAdmin 4 | Medium4.8 |
| CVE-2026-12046 | pgAdmin 4: Unauthenticated pickle deserialization in SQL Editor close / update_connection routes enables remote code executionpgadmin.org · pgAdmin 4 | Critical9.5 |
| CVE-2026-12045 | pgAdmin 4: AI Assistant read-only transaction bypass allows unauthorised writes and remote code executionpgadmin.org · pgAdmin 4 | Critical9.4 |
| CVE-2026-12050 | pgAdmin 4: SQL injection in named restore point endpointpgadmin.org · pgAdmin 4 | Medium5.3 |
| CVE-2026-12044 | pgAdmin 4: SQL injection in COMMENT ON ... IS '<description>' rendering across dialog templatespgadmin.org · pgAdmin 4 | High8.7 |
| CVE-2026-7820 | pgAdmin 4: Account-lockout bypass via Flask-Security default /login viewpgadmin.org · pgAdmin 4 | Medium6.9 |
| CVE-2026-7819 | pgAdmin 4: Symbolic-link path traversal in File Manager allows arbitrary file writepgadmin.org · pgAdmin 4 | High7.2 |
| CVE-2026-7818 | pgAdmin 4: Unsafe deserialization (CWE-502) in file-backed session manager leads to remote code executionpgadmin.org · pgAdmin 4 | High7.3 |
| CVE-2026-7817 | pgAdmin 4: Local file inclusion and server-side request forgery in LLM API configuration endpointspgadmin.org · pgAdmin 4 | High7.1 |
| CVE-2026-7816 | pgAdmin 4: OS command injection in Import/Export query export via psql metacommand breakoutpgadmin.org · pgAdmin 4 | High8.7 |
| CVE-2026-7815 | pgAdmin 4: SQL injection in Maintenance tool option values leading to remote code executionpgadmin.org · pgAdmin 4 | High8.7 |
| CVE-2026-7814 | pgAdmin 4: Stored XSS via crafted PostgreSQL object names in Browser Tree and Explain Visualizerpgadmin.org · pgAdmin 4 | Medium4.8 |
| CVE-2026-7813 | pgAdmin 4: Cross-user data access and shared-server privilege escalation in server modepgadmin.org · pgAdmin 4 | Critical9.4 |
| CVE-2026-1707 | Restore restriction bypass via key disclosure vulnerability (pgAdmin 4)pgadmin.org · pgAdmin 4 | High7.4 |
| CVE-2025-13780 | Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)pgadmin.org · pgAdmin 4 | Critical9.1 |
| CVE-2025-12765 | pgAdmin 4: LDAP authentication flow vulnerable to TLS certificate verification bypass.pgadmin.org · pgAdmin 4 | High7.5 |
| CVE-2025-12764 | pgAdmin 4: LDAP injection vulnerability in LDAP authentication flow.pgadmin.org · pgAdmin 4 | High7.5 |
| CVE-2025-12763 | Command injection vulnerability allowing arbitrary command execution on Windowspgadmin.org · pgAdmin 4 | Medium6.8 |
| CVE-2025-12762 | Remote Code Execution vulnerability when restoring PLAIN-format SQL dumps in server mode (pgAdmin 4)pgadmin.org · pgAdmin 4 | Critical9.1 |
| CVE-2025-9636 | Cross-Origin Opener Policy Vulnerability in pgAdmin 4pgadmin.org · pgAdmin 4 | High7.9 |
| CVE-2025-2946 | Cross-Site Vulnerability(XSS) due to arbitrary HTML/JavaScript gets executed while query result rendering in Query Tool and View/Edit Data Tool of pgAdmin 4pgadmin.org · pgAdmin 4 | Critical9.1 |
| CVE-2025-2945 | pgAdmin 4: Remote Code Execution in Query Tool and Cloud Deploymentpgadmin.org · pgAdmin 4 | Critical9.9 |