pgAdmin 4 Issues Critical Security Update Addressing Seven Vulnerabilities Including Prior Patch Failures
The development team behind the widely used database management tool pgAdmin 4 has published a security update that resolves multiple vulnerabilities, including incomplete fixes from the prior release.
On 30 July 2026 the team released version 9.17, which addresses a total of seven vulnerabilities. This includes three issues that were supposed to have been fixed in version 9.16 but remained unresolved, plus two newly identified flaws. Three of the vulnerabilities carry the highest severity rating of Critical.
One newly discovered Critical vulnerability, tracked as CVE-2026-17566, resides in the query-based data export functionality. Insufficient validation of SQL input allows an attacker to perform OS command injection, potentially executing arbitrary commands on the underlying operating system.
A second Critical issue, CVE-2026-17349, affects the server duplication feature. When a shared server is copied, the operation can inadvertently transfer stored database credentials that belong to other users, leading to unauthorized access.
The update also corrects an incomplete remediation of CVE-2026-12045. Because of differences in how the SQL parsing library and PostgreSQL interpret string literals, the read-only restrictions of the AI Assistant can be bypassed, resulting in the new Critical vulnerability CVE-2026-17351.
Related articles
Weekly Roundup: Critical Vulnerabilities Hit VMware ESX, FortiOS, Chrome, fastjson, Cisco FMC and Ruby on Rails
Security NEXT published its list of the ten most-read articles for the week of July 26 to August 1, 2026. The ranking is dominated by high-severity vulnerabilities affecting widely deployed enterprise platforms. VMware released fixes for serious flaws in ESX and vCenter, while Fortinet confirmed active exploitation of vulnerabilities in FortiOS and VeloCloud Orchestrator. Google patched 370 security issues in Chrome, and a data-conversion library fastjson was found vulnerable with observed attacks. Apple shipped iOS 26.6 and iPadOS 26.6 containing fixes for 87 vulnerabilities, and Cisco warned that its Firewall Management Center is already being exploited. Additional patches addressed OpenAM, Node.js, and a critical flaw dubbed KindaRails2Shell in Ruby on Rails. The list also includes a breach at an ANA Group e-commerce site that may have exposed customer data.
Dangerous C++ Traps: Memory Safety Issues, Undefined Behavior, and Code That Betrays Developers
Around 70% of vulnerabilities assigned CVE numbers by Microsoft each year stem from memory safety errors, with Chromium reporting a similar pattern for serious Chrome bugs. The article examines how C++ deliberately permits low-level memory access for performance but demands strict discipline to avoid undefined behavior (UB). It details real-world cases including Heartbleed (CVE-2014-0160) in OpenSSL, use-after-free errors, buffer overflows, and data races. Modern tools such as AddressSanitizer, UndefinedBehaviorSanitizer, and ThreadSanitizer are presented as essential for detection, alongside recommendations for RAII, std::span, and smart pointers. The piece also discusses C++26 changes introducing erroneous behavior for uninitialized variables and advises when to consider memory-safe languages like Rust for new components. Practical migration steps and compiler warning strategies are outlined to reduce risk in existing codebases.
Critical CosmosEscape Flaw Breaks Customer Isolation in Azure Cosmos DB
A critical vulnerability named CosmosEscape allowed attackers to escape the restricted Gremlin API environment and execute arbitrary code on the DB Gateway component of Azure Cosmos DB. The flaw exploited weaknesses in .NET reflection protections, enabling file read/write operations and command execution that ultimately yielded the Cosmos Master Key. With this global signing key, an attacker could retrieve the primary key for any customer account and gain full read/write access. The exploit also exposed the Config Store containing account names, subscription identifiers, tenant details, and network rules. Even network-isolated and private instances remained vulnerable because the DB Gateway itself enforced those restrictions. Internal Microsoft services including Entra ID, Teams, and Copilot rely on Cosmos DB, amplifying the potential impact of the issue.
Critical RCE Vulnerability CVE-2026-66066 Affects Ruby on Rails Active Storage with libvips
A severe vulnerability tracked as CVE-2026-66066 has been identified in the Ruby on Rails web application framework. The flaw, also referred to as KindaRails2Shell by researchers, impacts applications that use Active Storage with the libvips image processing engine. Attackers can exploit the issue by uploading specially crafted files to read arbitrary files without authentication. This exposure may lead to theft of environment variables, secret keys, and external service credentials, enabling remote code execution or further attacks. The vulnerability stems from unsafe operations in the dependent libvips library. It carries a CVSS v4.0 base score of 9.5 and is rated Critical. JPCERT/CC has issued an advisory urging immediate updates.