https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Mon, 02 Nov 2026 13:20:43 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-116251 <p>pgAdmin 4 did not invalidate a user&#39;s existing sessions when their password changed, either through the user&#39;s own change password dialog or through an administrator resetting it in User Management. A session established before the change, for example on another device or by someone who had obtained the old password or a session cookie, therefore stayed logged in after the change, which is the step a user or administrator takes precisely to cut such access off. It remained usable until it expired.</p> <p>The fix rotates the user&#39;s session identifier (fs_uniquifier) whenever the password is changed, so every other session of that user is logged out. The session that made the change is logged in again and keeps its database connections. Saved server passwords, including those for shared servers, are re-encrypted under the new key; any that cannot be decrypted are cleared and the user is told. If re-encryption fails, the sessions are still revoked and the saved passwords are cleared rather than the change failing.</p> <p>This issue affects pgAdmin 4: before 9.19.</p> <p>pgAdmin 4 did not invalidate a user&#39;s existing sessions when their password changed, either through the user&#39;s own change password dialog or through an administrator resetting it in User Management. A session established before the change, for example on another device or by someone who had obtained the old password or a session cookie, therefore stayed logged in after the change, which is the step a user or administrator takes precisely to cut such access off. It remained usable until it expired.</p> <p>The fix rotates the user&#39;s session identifier (fs_uniquifier) whenever the password is changed, so every other session of that user is logged out. The session that made the change is logged in again and keeps its database connections. Saved server passwords, including those for shared servers, are re-encrypted under the new key; any that cannot be decrypted are cleared and the user is told. If re-encryption fails, the sessions are still revoked and the saved passwords are cleared rather than the change failing.</p> <p>This issue affects pgAdmin 4: before 9.19.</p> https://db.gcve.eu/vuln/fkie_cve-2026-116251 https://db.gcve.eu/vuln/ghsa-wrw6-r8xj-f49j <p>pgAdmin 4 did not invalidate a user&#39;s existing sessions when their password changed, either through the user&#39;s own change password dialog or through an administrator resetting it in User Management. A session established before the change, for example on another device or by someone who had obtained the old password or a session cookie, therefore stayed logged in after the change, which is the step a user or administrator takes precisely to cut such access off. It remained usable until it expired.</p> <p>The fix rotates the user&#39;s session identifier (fs_uniquifier) whenever the password is changed, so every other session of that user is logged out. The session that made the change is logged in again and keeps its database connections. Saved server passwords, including those for shared servers, are re-encrypted under the new key; any that cannot be decrypted are cleared and the user is told. If re-encryption fails, the sessions are still revoked and the saved passwords are cleared rather than the change failing.</p> <p>This issue affects pgAdmin 4: before 9.19.</p> <p>pgAdmin 4 did not invalidate a user&#39;s existing sessions when their password changed, either through the user&#39;s own change password dialog or through an administrator resetting it in User Management. A session established before the change, for example on another device or by someone who had obtained the old password or a session cookie, therefore stayed logged in after the change, which is the step a user or administrator takes precisely to cut such access off. It remained usable until it expired.</p> <p>The fix rotates the user&#39;s session identifier (fs_uniquifier) whenever the password is changed, so every other session of that user is logged out. The session that made the change is logged in again and keeps its database connections. Saved server passwords, including those for shared servers, are re-encrypted under the new key; any that cannot be decrypted are cleared and the user is told. If re-encryption fails, the sessions are still revoked and the saved passwords are cleared rather than the change failing.</p> <p>This issue affects pgAdmin 4: before 9.19.</p> https://db.gcve.eu/vuln/ghsa-wrw6-r8xj-f49j https://db.gcve.eu/vuln/wid-sec-w-2026-4242 <p>Ein Angreifer kann mehrere Schwachstellen in pgAdmin ausnutzen, um erweiterte Berechtigungen, möglicherweise sogar Administratorrechte, zu erlangen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen oder Denial-of-Service-Angriffe zu starten.</p> <p>Ein Angreifer kann mehrere Schwachstellen in pgAdmin ausnutzen, um erweiterte Berechtigungen, möglicherweise sogar Administratorrechte, zu erlangen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen, Daten zu manipulieren und offenzulegen oder Denial-of-Service-Angriffe zu starten.</p> https://db.gcve.eu/vuln/wid-sec-w-2026-4242