[{"data":1,"prerenderedAt":54},["ShallowReactive",2],{"sicherheitsluecke-cve-2026-116241":3},{"l":4,"details":28,"weitere":34,"indexierbar":52,"updated":53},{"cve":5,"status":6,"vendor":7,"product":8,"name":9,"added":10,"due":9,"ransomware":11,"published":10,"cwes":12,"cvss":15,"epss":20,"slug":23,"bereich":24,"schweregrad":25,"art":26,"produktLabel":27},"CVE-2026-116241","gemeldet","pgAdmin","4","","2026-10-30",false,[13,14],"CWE-78","CWE-115",{"version":16,"score":17,"severity":18,"vector":19},"4.0",9.4,"CRITICAL","CVSS:4.0\u002FAV:N\u002FAC:L\u002FAT:N\u002FPR:L\u002FUI:N\u002FVC:H\u002FVI:H\u002FVA:H\u002FSC:H\u002FSI:H\u002FSA:H\u002FE:X\u002FCR:X\u002FIR:X\u002FAR:X\u002FMAV:X\u002FMAC:X\u002FMAT:X\u002FMPR:X\u002FMUI:X\u002FMVC:X\u002FMVI:X\u002FMVA:X\u002FMSC:X\u002FMSI:X\u002FMSA:X\u002FS:X\u002FAU:X\u002FR:X\u002FV:X\u002FRE:X\u002FU:X",{"score":21,"percentile":22},0.0031,0.24077,"cve-2026-116241","web","kritisch","Einschleusen von Betriebssystem-Befehlen (OS Command Injection)","pgAdmin 4",{"description":29,"refs":30},"pgAdmin 4's Import\u002FExport Data tool wraps a user's query export in a psql \\copy (...) TO command and checks that the query's parentheses are balanced so that nothing can escape the wrapper. The check rejected a backslash inside a single-quoted string, but not inside a double-quoted identifier, where it treated the next double quote as closing the identifier. psql's \\copy parser applies the connection's escape character to whichever quote opened a token, so with standard_conforming_strings off a backslash-escaped double quote does not close the identifier. pgAdmin's and psql's view of the quoting then diverged, a closing parenthesis hidden from the check ended the \\copy (...) wrapper, and a following TO PROGRAM clause was executed by psql on the pgAdmin host, as the operating-system account running pgAdmin, before the server rejected the statement. An ordinary database role can turn standard_conforming_strings off for itself, and the Import\u002FExport Data permission is granted to non-administrators by default.\n\nThis is a bypass of the fix for CVE-2026-17566. The fix rejects any backslash inside a double-quoted identifier, as was already done for single-quoted strings, since its meaning depends on a server setting that cannot be known reliably when the query is validated.\n\nThis issue affects pgAdmin 4: before 9.19.",[31],{"url":32,"host":33},"https:\u002F\u002Fgithub.com\u002Fpgadmin-org\u002Fpgadmin4\u002Fcommit\u002F9be31a019f780647fb689c458408c8803263c812","github.com",[35,41,46],{"cve":36,"status":6,"produktLabel":37,"vendor":9,"product":37,"art":38,"bereich":24,"schweregrad":25,"score":39,"epss":-1,"added":40,"ransomware":11},"CVE-2026-126542","WWBN AVideo","Umgehung der Anmeldung durch Vortäuschen einer Identität",9.3,"2026-11-11",{"cve":42,"status":6,"produktLabel":43,"vendor":9,"product":43,"art":44,"bereich":24,"schweregrad":25,"score":45,"epss":-1,"added":40,"ransomware":11},"CVE-2026-126539","Directus","Unsicherer Zustand nach Fehlern",9.2,{"cve":47,"status":6,"produktLabel":48,"vendor":9,"product":48,"art":49,"bereich":24,"schweregrad":50,"score":51,"epss":-1,"added":40,"ransomware":11},"CVE-2026-103883","6Storage Rentals (WordPress-Plugin)","Fehlerhafte Anmeldung (Authentifizierung)","hoch",8.8,true,"2026-11-11T14:28:43.107Z",1794407352743]