PatchTheCVECVEs published by Yugabyte, Inc.
CVEs published by Yugabyte, Inc. (CVE Numbering Authority). 12 tracked.
- CVE-2023-0745 MEDIUM 6.7 UPGRADE The High Availability functionality of Yugabyte Anywhere can be abused to write
- CVE-2026-1966 LOW 2.4 YugabyteDB Anywhere displays LDAP bind passwords configured via gflags in cleartext within the web UI
- CVE-2025-8866 MEDIUM 5.1 YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpo
- CVE-2025-8865 MEDIUM 4.1 The YugabyteDB tablet server contains a flaw in its YCQL query handling that can trigger a null pointer derefe
- CVE-2025-8864 MEDIUM 6.8 Shared Access Signature token is not masked in the backup configuration response and is also exposed in the yb
- CVE-2025-8863 HIGH 7.0 YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmis
- CVE-2025-8862 HIGH 7.0 YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gf
- CVE-2024-6908 MEDIUM 6.0 Improper privilege management in Yugabyte Platform allows authenticated admin users to escalate privileges to
- CVE-2024-6895 MEDIUM 6.1 Insufficient authentication in user account management in Yugabyte Platform allows local network attackers wit
- CVE-2024-11193 MEDIUM 6.5 An information disclosure vulnerability exists in Yugabyte Anywhere, where the LDAP bind password is logged in
- CVE-2024-11165 MEDIUM 5.7 An information disclosure vulnerability exists in the backup configuration process where the SAS token is not
- CVE-2024-0006 MEDIUM 5.4 Information exposure in the logging system in Yugabyte Platform allows local attackers with access to applicat