CVE-2026-1966Low 2.4YugabyteDB Anywhere Exposes LDAP Credentials in Cleartext in Web UI0.2%
CVE-2025-8866Medium 5.1YugabyteDB Anywhere web server does not properly enforce authentication for the /metamaster/universe API endpoint. An unauthenticated attacker could exploit this flaw to obtain server networking confi0.3%
CVE-2025-8864Medium 6.8Shared Access Signature token is not masked in the backup configuration response and is also exposed in the yb_backup logs0.2%