Skip to content
~/pwn.watch_

Get notified

Get an email when a new major security incident drops. No spam, unsubscribe any time.

Only used for pwn.watch incident emails. Protected by Cloudflare Turnstile.

Become a sponsor

One slot: pwn.watch, gifs.so, flavors.design, kitze.io, every kitze repo, and an X shout-out.

YearlyMonthly

Secure checkout on Polar. Right after paying you set up your ad on kitze.io.

Patch Bypass

Security incidents tagged Patch Bypass. Newest first.

1 Patch Bypass incident in the last 12 months

Critical 4 · High 3 · Med 2 · Low 1 · Update ½LessMore
Incidents
1
Live
1
Patched
1
Days without an incident
0
Longest quiet run: 4 days (Oct 25–Oct 28)
All tags →
  • Patched

    pgAdmin 4 fixes 15 CVEs in 9.19, including command execution through Import/Export (CVE-2026-116241) and a login lockout bypass

    pgAdmin 4 9.19 (released Oct 29 2026) fixes a batch of CVEs published on Oct 30 2026, all affecting versions before 9.19. The worst, CVE-2026-116241 (CVSS 4.0 9.4, CVSS 3.1 9.9), bypasses the earlier fix for CVE-2026-17566: in the Import/Export Data tool a backslash inside a double-quoted identifier lets a query escape psql's \copy wrapper, so a TO PROGRAM clause runs on the pgAdmin host as the operating-system account running pgAdmin. An ordinary database role can trigger it, since it can turn standard_conforming_strings off for itself and the Import/Export permission is granted to non-administrators by default. CVE-2026-116238 (CVSS 4.0 9.2) lets an unauthenticated attacker in server mode bypass the failed-login lockout and guess passwords for any internal account, including the administrator's. Other fixes cover LDAP/Kerberos accounts colliding with same-named users (CVE-2026-116239), pgAdmin's own SSH, Kerberos, password-file and certificate credentials being used for user connections, storage-directory path escapes and symlink races, and sessions that survive a password change. No exploitation has been reported so far.

    pgAdmin 4Since Oct 30, 2026

Sponsored

Buy sponsor slot