CVE-2026-1966Low 2.4YugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI0.2%
CVE-2025-8866Medium 5.1YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit this flaw to obtain server networking confi0.3%
CVE-2025-8865Medium 4.1The YugabyteDB tablet server contains a flaw in its YCQL query handling that can trigger a null pointer dereference when processing certain malformed inputs. An authenticated attacker could exploit th0.2%
CVE-2025-8864Medium 6.8Shared Access Signature token is not masked in the backup configuration response and is also exposed in the yb_backup logs0.2%
CVE-2025-8863High 7.0YugabyteDB diagnostic information was transmitted over HTTP, which could expose sensitive data during transmission0.3%
CVE-2025-8862High 7.0YugabyteDB has been collecting diagnostics information from YugabyteDB servers, which may include sensitive gflag configurations. To mitigate this, we recommend upgrading the database to a version whe0.4%