Pocketbase vulnerabilities
We track 2 vulnerabilities in Pocketbase products. 2 are rated high or critical, and none are known to be exploited. The most recent was published on September 16, 2026.
2vulnerabilities
0critical
2high
0exploited
8.1average CVSS score
Latest Pocketbase vulnerabilities
- 8.7 High severity
pocketbase: Uncaught Exception
Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not internal child and worker goroutines. A panic in one of these internal goroutines can escape rec
- 7.6 High severity
pocketbase: Improper Authentication
Pocketbase is an open source web backend written in go. Prior to 0.22.42 and 0.37.4, in some situations, if an attacker knows the email address of the victim they can create and link an unverified PocketBase user in advance by authenticating with one of the OA