https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T18:42:37.733340+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/euvd-2026-309960 EUVD-2026-309960 2026-10-02T18:42:37.795997+00:00 EUVD-2026-309960 https://cve.radiocsirt.org/vuln/fkie_cve-2026-7817 fkie_cve-2026-7817 2026-10-02T18:42:37.796033+00:00

Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints.

User-supplied api_key_file and api_url preferences were passed to the LLM provider clients without validation. An authenticated user could read arbitrary server-side files by pointing api_key_file at any path readable by the pgAdmin process, or coerce pgAdmin into making requests to internal targets (e.g. cloud metadata services such as 169.254.169.254) by setting api_url, exploiting the chat path and model-list endpoints.

Fix restricts api_key_file to the user's private storage (server mode) or home directory (desktop mode), enforces a printable-ASCII key shape and a 1024-byte read cap, and gates api_url against a configurable allow-list (config.ALLOWED_LLM_API_URLS) at every entry point.

This issue affects pgAdmin 4: before 9.15.

 https://cve.radiocsirt.org/vuln/ghsa-p58c-q354-6c4f GHSA-p58c-q354-6c4f — pgAdmin 4 contains local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities 2026-10-02T18:42:37.796073+00:00

Affected: PyPI: pgadmin4

Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints.

User-supplied api_key_file and api_url preferences were passed to the LLM provider clients without validation. An authenticated user could read arbitrary server-side files by pointing api_key_file at any path readable by the pgAdmin process, or coerce pgAdmin into making requests to internal targets (e.g. cloud metadata services such as 169.254.169.254) by setting api_url, exploiting the chat path and model-list endpoints.

Fix restricts api_key_file to the user's private storage (server mode) or home directory (desktop mode), enforces a printable-ASCII key shape and a 1024-byte read cap, and gates api_url against a configurable allow-list (config.ALLOWED_LLM_API_URLS) at every entry point.

This issue affects pgAdmin 4: before 9.15.

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:11508-1 openSUSE-SU-2026:11508-1 — pgadmin4-9.17-1.1 on GA media 2026-10-02T18:42:37.796105+00:00

pgadmin4-9.17-1.1 on GA media

 https://cve.radiocsirt.org/vuln/pysec-2026-2871 PYSEC-2026-2871 — pgAdmin 4 contains local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities 2026-10-02T18:42:37.796137+00:00

Affected: PyPI: pgadmin4

Local file inclusion (LFI) and server-side request forgery (SSRF) vulnerabilities in pgAdmin 4 LLM API configuration endpoints.

User-supplied api_key_file and api_url preferences were passed to the LLM provider clients without validation. An authenticated user could read arbitrary server-side files by pointing api_key_file at any path readable by the pgAdmin process, or coerce pgAdmin into making requests to internal targets (e.g. cloud metadata services such as 169.254.169.254) by setting api_url, exploiting the chat path and model-list endpoints.

Fix restricts api_key_file to the user's private storage (server mode) or home directory (desktop mode), enforces a printable-ASCII key shape and a 1024-byte read cap, and gates api_url against a configurable allow-list (config.ALLOWED_LLM_API_URLS) at every entry point.

This issue affects pgAdmin 4: before 9.15.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1462 WID-SEC-W-2026-1462 — pgAdmin: Mehrere Schwachstellen 2026-10-02T18:42:37.796162+00:00

Ein Angreifer kann mehrere Schwachstellen in pgAdmin ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, SQL-Injection- und Cross-Site-Scripting-Angriffe durchzuführen, Daten zu manipulieren oder vertrauliche Informationen offenzulegen.