[ Vendor · 5 CVEs ]
bytebase
CVEs affecting bytebase published in the last 30 days, plus any bytebase CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2022-51026 | 22 Oct 2026 | CVSS 9.8 | bytebaseBytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user. The flaw… | |
| CVE-2026-115321 | 22 Oct 2026 | CVSS 4.3 | bytebaseBytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to… | |
| CVE-2026-115322 | 22 Oct 2026 | CVSS 4.3 | bytebaseBytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows… | |
| CVE-2026-61742 | 24 Sep 2026 | CVSS 9.3 | DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL executionDBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Versions prior to 0.22.5 expose an unauthenticated HTTP MCP… | Fix |
| CVE-2026-61788 | 24 Sep 2026 | CVSS 7.4 | @bytebase/dbhub's read-only mode does not prevent database writesDBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite. Prior to version 0.22.6, setting `readonly = true` on the… | Fix |