TI-2026-44186 CVE-2026-61742 · GHSA-fm8p-53ww-hf6w
DBHub HTTP transport DNS rebinding allows unauthenticated browser-origin SQL execution
Priority HIGH 81
DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite.
bytebase
Records8All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high1CVSS 7.0–8.9
Exploited now
bytebase records in CISA KEVNo bytebase vulnerabilities are listed in CISA KEV.
Components
Products in the NVD configurations · select one to filter the recordsRecords
8 records
TI-2026-44228 CVE-2026-61788 · GHSA-mwwr-p57h-56pf
@bytebase/dbhub's read-only mode does not prevent database writes
Priority HIGH 68
DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite.
TI-2026-83204 CVE-2026-61789 · GHSA-j55q-p8qc-f6wg
Read-only bypass in DBHub MySQL and MariaDB connectors via comments
Priority MEDIUM 62
DBHub is a database MCP server for Postgres, MySQL, SQL Server, Oracle, MariaDB, SQLite.
TI-2022-13896 CVE-2022-32170 · GHSA-9mmc-27gw-w6mq
bytebase - Improper Authorization
Priority MEDIUM 53
The “Bytebase” application does not restrict low privilege user to access admin “projects“ for which an unauthorized user can view the “projects“ created by “Admin” and the affected endpoint is “/api/project?user=${userI…
TI-2022-13895 CVE-2022-32169 · GHSA-5rc4-v5mj-g8c4
bytebase - Improper Authorization
Priority MEDIUM 53
The “Bytebase” application does not restrict low privilege user to access “admin issues“ for which an unauthorized user can view the “OPEN” and “CLOSED” issues by “Admin” and the affected endpoint is “/issue”.
TI-2022-26714 CVE-2022-51026 · GHSA-ffpw-wpwq-rh9j
Authentication bypass in Bytebase GitLab self-hosted login
Priority MEDIUM 49
Bytebase 0.12.0 before 1.0.1 contains an authentication bypass vulnerability that allows unauthenticated attackers to log in as any user.
TI-2026-79259 CVE-2026-115322 · GHSA-4vfr-m29p-8gpj
Authorization bypass in Bytebase exposes other projects' task runs
Priority LOW 24
Bytebase before 3.16.0 contains an authorization bypass vulnerability in GetTaskRunLog, GetTaskRunSession and PreviewTaskRunRollback that allows authenticated users to access other projects' task runs by UID.
TI-2026-79258 CVE-2026-115321 · GHSA-27j2-crf8-3w95
Authorization bypass in Bytebase lets users overwrite other projects' comments
Priority LOW 24
Bytebase before 3.16.0 contains an authorization bypass vulnerability in the UpdateIssueComment handler that allows low-privileged project users to modify comments in other projects by supplying a foreign comment UID.