pgAdmin 4 Database Management Tool Patches Multiple Vulnerabilities in Version 9.18
The development team for the PostgreSQL management tool pgAdmin 4 has released version 9.18 to address multiple vulnerabilities. The security update was published on September 17, 2026, and resolves four CVEs while delivering 29 total changes that also include new features and bug fixes.
One of the corrected issues, CVE-2026-86863, arises from improper web server authentication. The application trusts HTTP headers supplied by external sources, which can allow authentication bypass when user information cannot be retrieved from the web server. Attackers can supply an arbitrary username and gain administrative privileges without providing a password.
A second vulnerability, CVE-2026-86864, affects the backup functionality. Database names are processed as command-line arguments, creating a command injection risk. Although exploitation requires authentication, successful attacks can write files outside the intended storage area or redirect connections to exfiltrate database credentials to attacker-controlled systems.
Users are strongly encouraged to upgrade to pgAdmin 4 9.18 immediately. The updated release is available through the official GitHub repository maintained by the pgadmin-org project.
Related articles
Cisco Issues Emergency Patches for Critical ISE Zero-Day CVE-2026-76460 Already Exploited in Attacks
Cisco has released emergency patches for Identity Services Engine (ISE) and ISE Passive Identity Connector (ISE-PIC) to address CVE-2026-76460, a maximum-severity zero-day with a CVSS score of 10.0. The vulnerability stems from insufficient authentication controls in an API endpoint, allowing remote attackers to bypass authentication entirely without credentials. Active exploitation has been confirmed, enabling unauthorized access to the API gateway and potential root-level command execution when chained with further actions. The flaw affects all configurations of ISE and ISE-PIC, with no available workarounds, forcing organizations to apply updates immediately. Patches are available for branches 3.1 Patch 12, 3.2 Patch 11, 3.3 Patch 12, 3.4 Patch 7, and 3.5 Patch 4, while version 3.0 has reached end of software maintenance. Administrators are advised to review ise-kong access.log and node access logs for suspicious usernames and cross-reference with perimeter and firewall logs. In cases of confirmed compromise, affected nodes should be reinstalled and restored from backups, with iACLs recommended to restrict management traffic during rollout.
Stored XSS in Telegram Desktop Allows Silent Data Exfiltration via Chat Export
Researchers at ExPatch Vulnerability Research discovered a stored XSS vulnerability in Telegram Desktop that could be triggered when users exported chat history to HTML. The flaw resided in export_output_html.cpp where button text from inline keyboards was not passed through the SerializeString function, allowing arbitrary HTML and JavaScript to execute upon opening the exported file. Attackers could deliver the payload through a bot that never joined the target group, relying on message forwarding to reach victims. Once executed, the script exfiltrated all visible messages, chat metadata, and file paths to an attacker-controlled server while optionally replacing the page with a phishing form. Telegram issued a silent fix in Beta v6.9.4 and Stable v7.0.1 without publishing an advisory or assigning a CVE. The researchers refused the offered bounty and published the details after the patch to inform users about risks from previously exported files.
Cisco Confirms Active Exploitation of Critical Secure Email Gateway Flaw Allowing Root Command Execution
Cisco has confirmed active exploitation of a critical vulnerability in its Secure Email Gateway product that allows attackers to execute arbitrary commands with root privileges. The flaw, tracked as CVE-2026-76461 with a CVSS score of 9.8, stems from insufficient input validation in the message analysis logic of AsyncOS. Attackers can trigger the issue by sending a specially crafted email containing malicious SQL instructions, which leads to arbitrary SQL command execution and full root access on affected appliances. The vulnerability impacts physical and virtual deployments running AsyncOS versions 15.5 and earlier, 16.0, and 16.5. Patches are available in versions 15.5.5-0141, 16.0.4-302, and 16.5.0-780, while the Secure Email and Web Manager and Secure Web Appliance remain unaffected. CISA added the CVE to its Known Exploited Vulnerabilities catalog on September 14 and set a September 17 remediation deadline for federal agencies.
Cisco ISE Affected by 42 Vulnerabilities Including Multiple Critical Flaws with Confirmed Exploitation
Cisco Identity Services Engine (ISE) has been found to contain 42 vulnerabilities across 15 security advisories released by Cisco Systems on September 16, 2026. Six advisories received the highest Critical rating, covering 21 individual vulnerabilities, while three were rated High and six Medium. One standout issue, CVE-2026-76460, allows attackers to bypass authentication on the management API via crafted HTTP requests and execute commands with root privileges. The flaw also impacts the Cisco ISE Passive Identity Connector (ISE-PIC). Cisco has urged immediate application of updates as some vulnerabilities are already being exploited in the wild. The product provides core network authentication and access control functions for enterprise environments.