Read the docs

databufflabs

Records2All Threatist records
Exploited (KEV)0None in CISA KEV
CVSS critical2CVSS 9.0–10.0
CVSS high0CVSS 7.0–8.9

Exploited now

databufflabs records in CISA KEV

No databufflabs vulnerabilities are listed in CISA KEV.

Records

2 records

TI-2026-75479 CVE-2026-111693 · GHSA-4hh4-c7m4-34wx

DataBuff ai-apm-web ships hard-coded default admin credentials

Priority HIGH 81

DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00495 Published 2026-10-16 No fix listed CWE-1392
TI-2026-75478 CVE-2026-111692 · GHSA-8xhf-8q7j-9q7q

Authentication bypass in DataBuff ai-apm-web via hardcoded HMAC secret

Priority HIGH 81

DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService.

CVSS 4.0CRITICAL 9.3 Network No auth No interaction EPSS 0.00607 Published 2026-10-16 No fix listed CWE-321
Open these records in search →