sosedoff github.com/sosedoff/pgweb vulnerabilities

Latest sosedoff github.com/sosedoff/pgweb CVEs

Newest publication first

1. CVE-2026-91924 pgweb through 0.17.0 Missing Authorization on Direct Connect Endpoint

   Published 2026-09-15

   High·CVSS 8.4 EPSS 0.42%

   pgweb through 0.17.0 leaves the POST /api/connect endpoint unguarded when connect-backend authorization is configured, allowing attackers to supply arbitrary database connection strings. Attackers can bypass the resource-to-database mapping by providing a custom session identifie...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.