pgAdmin 4 Critical RCEs Lead the Day

pgAdmin 4 ships two critical unauthenticated RCE bugs — patch now. CVE-2026-12046 (CVSS 9.0) lets an attacker bypass authentication entirely on critical pgAdmin 4 functions, achieving remote code execution with no credentials required. CVE-2026-12045 (CVSS 9.0) exploits a prompt-injection vector in the AI Assistant feature to achieve the same outcome. Both carry a high risk score (0.59) and affect all deployments that expose the web interface to a network. Administrators should treat this as an emergency upgrade — there is no workaround short of taking the service offline. A third HTML-injection flaw (CVE-2026-12047, CVSS 4.6) and an SQL injection in the restore-point endpoint (CVE-2026-12050, CVSS 4.3) round out the pgAdmin disclosures, along with an open-redirect in MFA (CVE-2026-12049, CVSS 3.5) that could aid phishing campaigns.

Tilt HUD exposes developer secrets and remote resource triggers when bound to a non-loopback address. CVE-2026-55884 (critical, risk 0.52) is the most severe: the HUD HTTP server exposes state-changing and sensitive-read endpoints with zero authentication, allowing a network attacker to trigger any pre-defined Tiltfile resource. CVE-2026-55883 (high, risk 0.38) bypasses the WebSocket CSRF protection because the token is served by an unauthenticated endpoint and the upgrader accepts clients that omit the Origin header. CVE-2026-55882 (high, risk 0.38) exposes Go's net/http/pprof handlers under /debug with no access control, letting an attacker read process memory — including session tokens and apiserver credentials — and hold the profiler mutex to cause denial of service. Any team running Tilt with the HUD on a non-loopback interface should restrict network access immediately and apply the forthcoming patch.

Four libaom AV1 encoder flaws enable heap corruption and remote code execution. CVE-2026-56208 (CVSS 7.6) is a heap-buffer overflow in the first-pass stats buffer when LAP mode is enabled. CVE-2026-56209 (CVSS 7.1) allows arbitrary-address writes via an out-of-bounds SVC layer context combined with a cyclic refresh-map pointer hijack. CVE-2026-56210 (CVSS 7.1) is a heap-buffer over-read from a missing bounds check in ctrl_set_layer_id. CVE-2026-56211 (CVSS 7.1) achieves remote code execution through attacker-controlled SVC layer context frames. All four affect libaom, the reference AV1 codec used by Chrome, Firefox, and many media pipelines. Users should update to the latest libaom release; media libraries that bundle libaom statically must rebuild.

CedarJava policy engine has two high-severity flaws: type confusion and policy injection. CVE-2026-55772 (high, risk 0.45) describes a type confusion across the Java-Rust FFI boundary that could let an attacker bypass authorization decisions. CVE-2026-55773 (high, risk 0.38) is a policy-injection vulnerability that allows an attacker to introduce unauthorized policies into the evaluation engine. CedarJava is used by AWS Verified Permissions and other authorization-as-a-service platforms; any application that accepts user-supplied Cedar policies or input that crosses the Java-Rust boundary should prioritize patching.

AWX GitHub webhook handler has a second-order SSRF that leaks PAT credentials. CVE-2026-12726 (CVSS 6.3, risk 0.41) affects the AWX automation controller. The GitHub webhook integration fails to validate the statuses_url field in incoming webhook payloads, enabling a second-order server-side request forgery that can exfiltrate the Personal Access Token credential configured for the webhook. An attacker who controls a GitHub repository (or can spoof a webhook payload) can pivot from the webhook handler to internal network resources and steal the PAT. Organizations using AWX with GitHub webhooks should audit their webhook configurations and apply the patch.

Joomla extensions from 2017 resurface with unauthenticated SQL injection flaws. CVE-2017-20280 (risk 0.00) affects the Myportfolio component 3.0.2, CVE-2017-20281 affects Extra Search 2.2.8, and CVE-2017-20282 affects jCart for OpenCart 2.0 — all allowing unauthenticated SQL injection via GET parameters (pid, establename, product_id respectively). While these carry no current risk score, their age and the fact they were publicly disclosed years ago means exploit code is likely available. Any Joomla site still running these abandoned extensions should remove them immediately.