pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems. This issue is caused by the use of shell=True during backup and restore operations, enabling attackers to execute arbitrary system command…

▾ Sunlitpgadmin · pgadmin_4EPSS 0.91%via NVD

CVE-2025-12765High· 7.5

12mo ago

pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification.

▾ Twilightpgadmin · pgadmin_4EPSS 0.23%via NVD

CVE-2025-64508High· 7.5

12mo ago

Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input

▾ Twilightbugsink · bugsinkEPSS 0.51%via OSV

CVE-2025-12764High· 7.5

12mo ago

pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amo…

pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amo…

▾ Twilightpgadmin · pgadmin_4EPSS 0.48%via NVD

CVE-2025-12967High· 8.0

12mo ago

AWS Advanced Python Wrapper: Privilege Escalation in Aurora PostgreSQL instance

▾ Twilightaws-advanced-python-wrapper · aws-advanced-python-wrapperEPSS 0.78%via OSV

Tagged “pip”

Modular Max Serve has Unsafe Deserialization vulnerability

OpenStack Keystone allows /v3/ec2tokens or /v3/s3tokens request with valid AWS Signature to provide Keystone authorization.

Malicious code in wallet-tracking (PyPI)

Malicious code in spellcheckers (PyPI)

Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input (via CPU)

pgAdmin 4 versions up to 9.9 are affected by a command injection vulnerability on Windows systems

pgAdmin <= 9.9 is affected by a vulnerability in the LDAP authentication mechanism allows bypassing TLS certificate verification.

Bugsink is vulnerable to unauthenticated remote DoS via crafted Brotli input

pgAdmin <= 9.9 is affected by an LDAP injection vulnerability in the LDAP authentication flow that allows an attacker to inject special LDAP characters in the username, causing the DC/LDAP server and the client to process an unusual amo…

AWS Advanced Python Wrapper: Privilege Escalation in Aurora PostgreSQL instance

AstrBot contains a directory traversal vulnerability

Arbitrary Code Execution in pdfminer.six via Crafted PDF Input

AstrBot has an arbitrary file read vulnerability in function _encode_image_bs64

Insecure Deserialization (pickle) in pdfminer.six CMap Loader — Local Privesc

Django has a denial-of-service vulnerability in HttpResponseRedirect and HttpResponsePermanentRedirect on Windows

LangGraph Checkpoint affected by RCE in "json" mode of JsonPlusSerializer

Apache Doris-MCP-Server: Improper Access Control results in bypassing a "read-only" mode

DSPy does not properly restrict file reads

OctoPrint vulnerable to XSS in Action Commands Notification and Prompt

Dosage vulnerable to a Directory Traversal through crafted HTTP responses

motionEye vulnerable to RCE via unsanitized motion config parameter

Malicious code in speed-testing-nt (PyPI)

Agno session state overwrites between different sessions/users

cryptidy allows code execution via untrusted data due to pickle.loads

Scrapy: python-scrapy: brotli: Python brotli decompression bomb DoS (CVE-2025-6176)

An example dag `example_dag_decorator` had non-validated parameter that allowed the UI user to redirect the example to a malicious server and execute code on worker

Byaidu PDFMathTranslate vulnerable to open redirect

User with CREATE and no UPDATE privilege for Pools, Connections, Variables could update existing records via bulk create API with overwrite action.

API users via `/api/v2/dagReports` could perform Dag code execution in the context of the api-server if the api-server was deployed in the environment where Dag files were available.

Keras is vulnerable to arbitrary local file loading and Server-Side Request Forgery