CVE Database

CVE-2026-56569

4.0 MEDIUM

HCL iControl was affected by Sensitive Data Exposure vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application …

Jul 31, 2026

CVE-2026-56568

3.7 LOW

HCL iControl was affected by Information Exposure Through Verbose Client-Side API Error Messages vulnerabilities. It involves application displays raw server/API error messages to users instead …

Jul 31, 2026

CVE-2026-56567

5.1 MEDIUM

HCL iControl v4.3.0 was affected by Security Misconfiguration vulnerabilities. It involves the public exposure of internal configuration files due to improper web server or application …

Jul 31, 2026

CVE-2026-52857

5.5 MEDIUM

Wings is the server control plane for Pterodactyl, a free, open-source game server management panel. Prior to 1.13.0, unbounded json, yaml, and xml configuration-file parsers …

Jul 31, 2026

CVE-2026-18141

8.2 HIGH

A flaw was found in aap-gateway, a component of Ansible Automation Platform's Event-Driven Ansible (EDA). An unauthenticated remote attacker can bypass mutual Transport Layer Security …

Jul 31, 2026

CVE-2026-17566

9.9 CRITICAL

pgAdmin 4's Import/Export Data tool builds a psql \copy (...) command line by interpolating a user-supplied SQL query into a Jinja template and passing the …

Jul 31, 2026

CVE-2026-17351

9.0 CRITICAL

The fix for CVE-2026-12045 in pgAdmin 4 9.16 required the LLM-supplied query passed to the AI Assistant's execute_sql_query tool to parse, via sqlparse, as exactly …

Jul 31, 2026

CVE-2026-17350

5.4 MEDIUM

The per-tool permission system (custom roles / role-based tool permissions, introduced in pgAdmin 4 9.3) did not enforce its permission check consistently. In SERVER mode, …

Jul 31, 2026

CVE-2026-17349

9.6 CRITICAL

/misc/workspace/adhoc_connect_server, part of the Workspaces feature introduced in pgAdmin 4 9.0, when passed the id of an existing server, clones that server via Server.clone(), which …

Jul 31, 2026

CVE-2026-17348

6.5 MEDIUM

In SERVER mode, pgAdmin 4 enforces authentication per route via the @pga_login_required decorator; the application's before_request hook only handles desktop-mode auto-login and the Kerberos/Webserver-auth redirect, …

Jul 31, 2026

CVE-2026-17347

7.5 HIGH

The MASTER_PASSWORD_HOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the …

Jul 31, 2026

CVE-2026-17346

8.8 HIGH

The fix for CVE-2026-12044 in pgAdmin 4 9.16 hardened qtLiteral and switched sixteen COMMENT ON / pgstattuple / pgstatindex templates to it, but missed several …

Jul 31, 2026

CVE-2026-16504

9.8 CRITICAL

Deployment of the VPS.org one-click Zulip template deploys a hardcoded application signing key, a default database password ("zulip"), and DISABLE_HTTPS=True.

Jul 31, 2026

CVE-2026-16503

9.1 CRITICAL

Deployment of the VPS.org one-click Supabase template deploys a PostgreSQL instance that is published on all interfaces (0.0.0.0:5432) with a default database password set to …

Jul 31, 2026

CVE-2026-10686

5.8 MEDIUM

Zephyr's IPv6 forwarding path re-sent routed unicast packets without ever decrementing the IPv6 hop limit. Both routing branches of ipv6_route_packet() (subsys/net/ip) were affected: the explicit-route …

Jul 31, 2026

CVE-2025-62347

4.3 MEDIUM

HCL iControl was affected by Improper Input Validation vulnerability. It is vulnerable to unexpected system behavior and potential security bypasses. This was caused by an …

Jul 31, 2026

CVE-2026-67350

4.3 MEDIUM

Serendipity before 2.6.1 contains an open redirect vulnerability in exit.php that allows unauthenticated attackers to redirect users to arbitrary external sites by supplying a malicious …

Jul 31, 2026

CVE-2026-51301