pocketbase vulnerabilities

2 known vulnerabilities in pocketbase from Pocketbase. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 8.7 High severity

  pocketbase: Uncaught Exception

  CVE-2026-82410Sep 16, 2026Pocketbase

  Pocketbase is an open source web backend written in go. Prior to 0.22.48 and 0.39.7, PocketBase's panic-recovery middleware covers regular request handling but not internal child and worker goroutines. A panic in one of these internal goroutines can escape rec

• 7.6 High severity

  pocketbase: Improper Authentication

  CVE-2026-44166May 12, 2026Pocketbase

  Pocketbase is an open source web backend written in go. Prior to 0.22.42 and 0.37.4, in some situations, if an attacker knows the email address of the victim they can create and link an unverified PocketBase user in advance by authenticating with one of the OA