CVE-2026-17347 pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution

The MASTERPASSWORDHOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the...

EUVD-2026-51560

The MASTERPASSWORDHOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the...

CVE-2026-17347

The CVE describes an OS command injection in pgAdmin 4: a MASTER_PASSWORD_HOOK setting allows an administrator to configure an external command containing %u, which substitutes the current user name (potentially from external sources) into the command string. Previously this could be injected int...

CVE-2026-17347 pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution

The MASTERPASSWORDHOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the...

CVE-2026-17347 pgAdmin 4: OS command injection in MASTER_PASSWORD_HOOK via untrusted username substitution

The MASTERPASSWORDHOOK setting, introduced in pgAdmin 4 7.2, lets an administrator configure an external command that returns a per-user encryption key, with %u in the configured string replaced by the current user's name. The previous implementation substituted the username directly into the...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the GOOSE payload parser. An attacker can cause the subscriber process to terminate by sending a specially crafted unauthenticated Layer 2 multicast frame with an attacker-controlled inner element length that...

Out-of-bounds Read

Overview Affected versions of this package are vulnerable to Out-of-bounds Read via the MMS BER decoder process. An attacker can cause the service to terminate unexpectedly by supplying a crafted length value that is not properly validated, resulting in a read past the end of a heap buffer...

PT-2026-66772

Name of the Vulnerable Software and Affected Versions pgAdmin 4 versions 7.2 through 9.16 Description An issue exists in the MASTER PASSWORD HOOK setting where the application substitutes the username directly into a command string and executes it using subprocess.Popen..., shell=True. Since...

Important: kernel security update

The kernel packages contain the Linux kernel, the core of any Linux operating system. Security Fixes: kernel: rtnetlink: add missing netlinknscapable check for peer netns CVE-2026-31692 kernel: netfilter: ctnetlink: ensure safe access to master conntrack CVE-2026-43116 kernel: fanotify: fix false...

Use After Free

Overview Affected versions of this package are vulnerable to Use After Free in the TransferSubscriptions process. An attacker can cause a denial of service or potentially execute arbitrary code by sending specially crafted requests after authenticating. Remediation Upgrade open62541 to version...

Malicious code in rlp-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc577d1b92381efb525e89481bc661f11dff56bcf0da9180ca63ef67a3d1fd09 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview rlp-master is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package authorship...

MAL-2026-11371 Malicious code in rlp-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware bc577d1b92381efb525e89481bc661f11dff56bcf0da9180ca63ef67a3d1fd09 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious Package

Overview node-fs-extra-master is a malicious package. This package contains malicious code, and its content was removed from the official package manager. While this package might be attempting to impersonate a valid organization, there is no connection between that organization and this package...

Malicious code in fs-extra-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6432be2aefc6715127bc533a383c361b15420316f144dccfc98f1dd4c7d36f06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Malicious code in node-fs-extra-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 3fc78fcfb574c958db27a4d94c79bd1ae87c3d5790fdcc044e47f2f97980cfa1 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

MAL-2026-11312 Malicious code in fs-extra-master (npm)

--- -= Per source details. Do not edit below this line.=- Source: ghsa-malware 6432be2aefc6715127bc533a383c361b15420316f144dccfc98f1dd4c7d36f06 Any computer that has this package installed or running should be considered fully compromised. All secrets and keys stored on that computer should be...

Incorrect Authorization

Overview Affected versions of this package are vulnerable to Incorrect Authorization via the traceevents.createTracing.enable function. An attacker can write trace logs outside the intended file system boundaries by exploiting insufficient enforcement of the permission model. Remediation A fix wa...

Improper Certificate Validation

Overview Affected versions of this package are vulnerable to Improper Certificate Validation due to the HTTPS Agent skipping hostname verification across identity policies. An attacker can intercept or manipulate encrypted communications by exploiting TLS session reuse without proper hostname...

Microsoft Fixes CosmosEscape Flaw That Could Allow Any Cosmos DB Takeover

Cybersecurity researchers at Wiz found CosmosEscape in Azure's Gremlin API, exposing a master key that could access any Cosmos DB account. Microsoft fixed it, with no customer impact found...