Data Management and Analytics

In pgAdmin 4 versions before 9.15 a high severity vulnerability CVE-2026-7816 was detected. This vulnerability allows an authenticated user to achieve arbitrary operating-system command execution on the pgAdmin server or perform arbitrary file writes. This occurs because user-supplied input (including the query, format, on_error, and log_verbosity fields) is interpolated directly into a psql \copy metacommand template without proper sanitization. An attacker can exploit this by injecting strings like “) TO PROGRAM ‘cmd'” to break out of the intended \copy (…) context. To address this issue, users should upgrade pgAdmin 4 to version 9.15. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7816.

In Kibana versions 8.0.0 up a medium severity vulnerability CVE-2026-49094 was detected. This vulnerability allows an authenticated user with viewer-level access to cause a Denial of Service (DoS), rendering the application unavailable to all users until it is manually recovered. This occurs due to uncontrolled resource consumption (excessive CPU and memory allocation) when a request containing an oversized input value is submitted to an analytics collections management endpoint. To address this issue, users should upgrade Kibana to version 8.19.16, 9.3.5, and 9.4.2. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-49094.

In MLflow versions prior to 3.9.0 a high severity vulnerability CVE-2026-2393 was detected. This vulnerability allows an authenticated attacker to perform a Server-Side Request Forgery (SSRF) attack, potentially leading to cloud credential theft, internal network access, and data exfiltration. This occurs because the application fails to validate, sanitize, or filter the user-controlled ‘url’ parameter in the webhook creation and delivery functions, allowing the backend server to be forced into sending HTTP POST requests to arbitrary internal or external destinations. To address this issue, users should upgrade MLflow to version 3.9.0. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-2393.

In Kibana version 9.3.3 a medium severity vulnerability CVE-2026-49093 was detected. This vulnerability allows an authenticated user with connector management privileges to perform a Server-Side Request Forgery (SSRF) attack. This occurs because the application allows the user to bypass the operator-configured connector allowlist, causing the Kibana server to issue outbound requests to destinations that the egress controls were intended to block. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-49093.

In pgAdmin 4 versions prior to 9.15. a high severity vulnerability CVE-2026-7815 was detected. This vulnerability allows an authenticated user with tools_maintenance permissions to execute arbitrary SQL on the connected PostgreSQL server, which can be escalated to operating-system command execution on the database host. This occurs because four user-supplied JSON fields (buffer_usage_limit, vacuum_parallel, vacuum_index_cleanup, reindex_tablespace) are concatenated directly into the rendered VACUUM/ANALYZE/REINDEX command without proper sanitization and passed to psql. To address this issue, users should upgrade pgAdmin 4 to version 9.15 or above. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7815.

In vLLM version 0.19.0 a medium severity vulnerability CVE-2026-9540 was detected. This vulnerability allows a remote attacker to cause a Denial of Service (DoS). This occurs due to a flaw in the OpenAI-compatible Serving Path component when processing certain manipulated data. An exploit for this issue is publicly available. There’s no fix available for this issue at the moment. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-9540.

In Prometheus versions 2.49.0 to before 3.5.3 and 3.11.3 a low severity vulnerability CVE-2026-44903 was detected. This vulnerability allows an attacker who can inject crafted metrics to execute arbitrary JavaScript (XSS) in the browser of any user viewing the metric. This occurs in the legacy web UI (enabled via the –enable-feature=old-ui flag) because the histogram heatmap chart view fails to properly escape ‘le’ label values when inserting them into the HTML for use as axis tick mark labels. To address this issue, users should upgrade Prometheus to versions 3.5.3 or 3.11.3. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-44903.

In JupyterLab versions 4.0.0 through 4.5.6 a high severity vulnerability CVE-2026-42266 was detected. This vulnerability allows an attacker to install malicious third-party extensions via a POST request. This occurs because the allow-list for the PyPI Extension Manager (allowed_extensions_uris) is not correctly enforced, allowing packages outside the default PyPI index to be installed. To address this issue, users should upgrade JupyterLab to version 4.5.7. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-42266.

In pgAdmin 4 versions before 9.15 a medium severity vulnerability CVE-2026-7814 was detected. This vulnerability allows an attacker to execute Stored Cross-Site Scripting (XSS) attacks. This occurs because user-controlled PostgreSQL object names are unsafely assigned to DOM elements via innerHTML in the Browser Tree and Explain Visualizer modules, allowing attacker-supplied JavaScript to execute when a user navigates to or executes EXPLAIN over the malicious object. To address this issue, users should upgrade pgAdmin 4 to version 9.15. For more details, visit https://nvd.nist.gov/vuln/detail/CVE-2026-7814.