treeverse lakeFS

• CVE-2026-48026 High 8.7 lakeFS vulnerable to stored XSS in rendered markdown previews via raw HTML 0.4%
• CVE-2026-66006 Medium 5.3 lakeFS Unauthenticated Operator Metadata Overwrite via setup_comm_prefs 0.6%
• CVE-2026-26187 High 8.1 lakeFS vulnerable to path traversal in local block adapter allow cross-namespace and sibling directory access 0.5%
• CVE-2025-68671 Medium 6.5 lakeFS is Missing Timestamp Validation in S3 Gateway Authentication 0.3%
• CVE-2025-64179 Medium 5.3 lakeFS: Unauthenticated access to API usage metrics 0.3%
• CVE-2025-27100 Medium 6.5 An authenticated user can crash lakeFS by exhausting server memory 0.4%
• CVE-2024-43784 Medium 5.7 Re-creating a deleted user in lakeFS will re-enable previous user credentials that existed prior to it's deletion 0.4%