Updated 2 h ago

Vulnerability database

Every flaw the U.S. government’s cybersecurity agency (CISA) has confirmed attackers are using, plus the new WordPress plugin and theme bugs published each day, sorted by what they mean for a small business. We refresh it twice a day. If you see something your website or office runs, tell us.

1,762exploited flaws on CISA’s list

34added in the last 30 days

344new WordPress flaws this week

390,080entries in the database

107 results · page 1 of 3

Oct 20, 2026Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _rCVE-2026-90800 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 8.1
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed _user or _replicator database via an unauthorised API endpoint. The use of prefixed system databases is very rare. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Product
Apache CouchDB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Oct 20, 2026Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory CVE-2026-90799 · Websites & servers · Apache Software Foundation · reported by security@apache.orgLow 1.3
Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Product
Apache CouchDB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Oct 20, 2026A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denCVE-2026-90798 · Websites & servers · Apache Software Foundation · reported by security@apache.orgLow 0.6
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to cause a denial of service via creating an infinite HTTP redirect loop. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Product
Apache CouchDB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Oct 20, 2026An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via mCVE-2026-90797 · Websites & servers · Apache Software Foundation · reported by security@apache.orgHigh 7.7
An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of service via memory exhaustion. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Product
Apache CouchDB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Oct 20, 2026An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as tCVE-2026-86471 · Websites & servers · Apache Software Foundation · reported by security@apache.orgCritical 9.3
An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell commands as the CouchDB operating system user. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Product
Apache CouchDB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
Oct 20, 2026Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replicCVE-2026-107755 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 6
Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to read replication credentials of other users’ replications, not just their own. Users are recommended to upgrade to version 3.5.3, which fixes this issue.
Product
Apache CouchDB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record lists.apache.org lists.apache.org
May 16, 2026CouchCMS 2.2.1 contains a cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript by uploading malicious SVG fileCVE-2021-47955 · Other software · CouchCMS · reported by VulnCheckMedium 5.1
CouchCMS 2.2.1 contains a cross-site scripting vulnerability that allows authenticated attackers to execute arbitrary JavaScript by uploading malicious SVG files through the file upload functionality. Attackers can upload SVG files containing embedded script tags to the browse.php endpoint, which are then executed in users' browsers when the files are accessed or previewed.
Product
CouchCMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com exploit-db.com
May 15, 2026CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated attackers to make arbitrary HTTP requests by uploading malicious SCVE-2021-47958 · Other software · CouchCMS · reported by VulnCheckMedium 5.3
CouchCMS 2.2.1 contains a server-side request forgery vulnerability that allows authenticated attackers to make arbitrary HTTP requests by uploading malicious SVG files. Attackers can upload SVG files containing external entity references through the browse.php endpoint to access internal services and resources.
Product
CouchCMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com exploit-db.com
Apr 10, 2026CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the f_k_levelCVE-2026-29002 · Other software · CouchCMS · reported by VulnCheckHigh 8.6
CouchCMS contains a privilege escalation vulnerability that allows authenticated Admin-level users to create SuperAdmin accounts by tampering with the f_k_levels_list parameter in user creation requests. Attackers can modify the parameter value from 4 to 10 in the HTTP request body to bypass authorization validation and gain full application control, circumventing restrictions on SuperAdmin account creation and privilege assignment.
Product
CouchCMS
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com couchcms.com
Mar 5, 2026An observable timing discrepancy in @perfood/couch-auth v0.26.0 allows attackers to access sensitive information via a timing side-channel.CVE-2025-70949 · Other software · reported by MITREHigh 7.5
An observable timing discrepancy in @perfood/couch-auth v0.26.0 allows attackers to access sensitive information via a timing side-channel.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Mar 5, 2026A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and execute an account takeCVE-2025-70948 · Other software · reported by MITRECritical 9.3
A host header injection vulnerability in the mailer component of @perfood/couch-auth v0.26.0 allows attackers to obtain reset tokens and execute an account takeover via spoofing the HTTP Host header.
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Jan 9, 2026** Disputed ** An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin user to read arbitrary files via traversing directories back after back.CVE-2025-67004 · Other software · Couchcms · reported by MITREMedium 6.5
** Disputed ** An Information Disclosure vulnerability in CouchCMS 2.4 allow an Admin user to read arbitrary files via traversing directories back after back. It can Disclosure the source code or any other confidential information if weaponize accordingly. NOTE: A community member states that this is not a CouchCMS vulnerability and that if /\<file> is accessible it is a web-server configuration issue.
Product
Couchcms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record gist.github.com github.com
Dec 21, 2025A security flaw has been discovered in CouchCMS up to 2.4.CVE-2025-15005 · Other software · Couchcms · reported by VulDBLow 2.9
A security flaw has been discovered in CouchCMS up to 2.4. Affected is an unknown function of the file couch/config.example.php of the component reCAPTCHA Handler. The manipulation of the argument K_RECAPTCHA_SITE_KEY/K_RECAPTCHA_SECRET_KEY results in use of hard-coded cryptographic key . It is possible to launch the attack remotely. This attack is characterized by high complexity. The exploitability is told to be difficult. The exploit has been released to the public and may be used for attacks.
Product
Couchcms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record note-hxlab.wetolink.com note-hxlab.wetolink.com
Nov 20, 2025Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707.CVE-2025-60794 · Other software · Perfood · reported by MITREMedium 6.5
Session tokens and passwords in couch-auth 0.21.2 are stored in JavaScript objects and remain in memory without explicit clearing in src/user.ts lines 700-707. This creates a window of opportunity for sensitive data extraction through memory dumps, debugging tools, or other memory access techniques, potentially leading to session hijacking.
Product
Couchauth
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 29, 2025An issue was discovered in Couchbase Sync Gateway before 3.2.6.CVE-2025-52490 · Other software · Couchbase · reported by MITREHigh 7.3
An issue was discovered in Couchbase Sync Gateway before 3.2.6. In sgcollect_info_options.log and sync_gateway.log, there are cleartext passwords in redacted and unredacted output.
Product
Sync Gateway
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jun 18, 2025The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates.CVE-2025-49015 · Other software · Couchbase · reported by MITREMedium 4.9
The Couchbase .NET SDK (client library) before 3.7.1 does not properly enable hostname verification for TLS certificates. In fact, the SDK was also using IP addresses instead of hostnames due to a configuration option that was incorrectly enabled by default.
Product
.net SDK
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Apr 30, 2025A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthorized access to sensiCVE-2025-46619 · Other software · Couchbase · reported by MITREHigh 7.6
A security issue has been discovered in Couchbase Server before 7.6.4 and fixed in v.7.6.4 and v.7.2.7 for Windows that could allow unauthorized access to sensitive files. Depending on the level of privileges, this vulnerability may grant access to files such as /etc/passwd or /etc/shadow.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 10, 2025A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2.CVE-2024-57177 · Other software · reported by MITREHigh 7.3
A host header injection vulnerability exists in the NPM package of perfood/couch-auth <= 0.21.2. By sending a specially crafted host header in the email change confirmation request, it is possible to trigger a SSTI which can be leveraged to run limited commands or leak server-side information
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jan 27, 2025An issue was discovered in Couchbase Server 7.6.x through 7.6.3.CVE-2024-56178 · Other software · Couchbase · reported by MITREMedium 6.5
An issue was discovered in Couchbase Server 7.6.x through 7.6.3. A user with the security_admin_local role can create a new user in a group that has the admin role.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record couchbase.com
Sep 19, 2024Couchbase Server 7.6.x before 7.6.2, 7.2.x before 7.2.6, and all earlier versions allows HTTP Host header injection.CVE-2024-25673 · Other software · Couchbase · reported by MITREMedium 6.1
Couchbase Server 7.6.x before 7.6.2, 7.2.x before 7.2.6, and all earlier versions allows HTTP Host header injection.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jul 26, 2024An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1.CVE-2024-37034 · Other software · Couchbase · reported by MITREMedium 5.9
An issue was discovered in Couchbase Server before 7.2.5 and 7.6.0 before 7.6.1. It does not ensure that credentials are negotiated with the Key-Value (KV) service using SCRAM-SHA when remote link encryption is configured for Half-Secure.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record couchbase.com couchbase.com
Mar 27, 2024An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1.CVE-2023-43768 · Other software · couchbase · reported by MITREHigh 7.5
An issue was discovered in Couchbase Server 6.6.x through 7.2.0, before 7.1.5 and 7.2.1. Unauthenticated users may cause memcached to run out of memory via large commands.
Product
couchbase_server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 28, 2024Couchbase Server before 7.2.4 has a private key leak in goxdcr.log.CVE-2024-23302 · Other software · couchbase · reported by MITREHigh 7.5
Couchbase Server before 7.2.4 has a private key leak in goxdcr.log.
Product
couchbase_server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 28, 2024An issue was discovered in Couchbase Server before 7.2.x before 7.2.4.CVE-2023-50437 · Other software · couchbase · reported by MITREHigh 8.6
An issue was discovered in Couchbase Server before 7.2.x before 7.2.4. otpCookie is shown with full admin on pools/default/serverGroups and engageCluster2.
Product
couchbase_server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 28, 2024An issue was discovered in Couchbase Server before 7.2.4.CVE-2023-50436 · Other software · Couchbase · reported by MITREMedium 5.3
An issue was discovered in Couchbase Server before 7.2.4. ns_server admin credentials are leaked in encoded form in the diag.log file. The earliest affected version is 7.1.5.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 28, 2024An issue was discovered in Couchbase Server before 7.2.4.CVE-2023-49932 · Other software · Couchbase · reported by MITREMedium 5.4
An issue was discovered in Couchbase Server before 7.2.4. An attacker can bypass SQL++ N1QL cURL host restrictions.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 28, 2024An issue was discovered in Couchbase Server before 7.2.4.CVE-2023-49931 · Other software · couchbase · reported by MITRECritical 9.8
An issue was discovered in Couchbase Server before 7.2.4. SQL++ cURL calls to /diag/eval are not sufficiently restricted.
Product
couchbase_server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 28, 2024An issue was discovered in Couchbase Server before 7.2.4.CVE-2023-49930 · Other software · Couchbase · reported by MITRECritical 9.8
An issue was discovered in Couchbase Server before 7.2.4. cURL calls to /diag/eval are not sufficiently restricted.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 28, 2024An issue was discovered in Couchbase Server through 7.2.2.CVE-2023-45874 · Other software · Couchbase · reported by MITREMedium 4.3
An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (outage of reader threads).
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 28, 2024An issue was discovered in Couchbase Server through 7.1.4 before 7.1.5 and before 7.2.1.CVE-2023-43769 · Other software · Couchbase · reported by MITREMedium 6.3
An issue was discovered in Couchbase Server through 7.1.4 before 7.1.5 and before 7.2.1. There are Unauthenticated RMI Service Ports Exposed in Analytics.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 28, 2024Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost.CVE-2023-49338 · Other software · couchbase · reported by MITREHigh 7.5
Couchbase Server 7.1.x and 7.2.x before 7.2.4 does not require authentication for the /admin/stats and /admin/vitals endpoints on TCP port 8093 of localhost.
Product
server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 28, 2024An issue was discovered in Couchbase Server through 7.2.2.CVE-2023-45873 · Other software · Couchbase · reported by MITREMedium 6.5
An issue was discovered in Couchbase Server through 7.2.2. A data reader may cause a denial of service (application exist) because of the OOM killer.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jan 3, 2024A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0.CVE-2023-39655 · Other software · Perfood · reported by MITRECritical 9.6
A host header injection vulnerability exists in the NPM package @perfood/couch-auth versions <= 0.20.0. By sending a specially crafted host header in the forgot password request, it is possible to send password reset links to users which, once clicked, lead to an attacker-controlled server and thus leak the password reset token. This may allow an attacker to reset other users' passwords and take over their accounts.
Product
Couchauth
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com npmjs.com
Dec 13, 2023Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document.CVE-2023-45725 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 5.7
Design document functions which receive a user http request object may expose authorization or session cookie headers of the user who accesses the document. These design document functions are: * list * show * rewrite * update An attacker can leak the session component using an HTML-like output, insert the session as an external resource (such as an image), or store the credential in a _local document with an "update" function. For the attack to succeed the attacker has to be able to insert the design documents into the database, then manipulate a user to access a function from that design document. Workaround: Avoid using design documents from untrusted sources which may attempt to access or manipulate request object's headers
Product
Apache CouchDB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchdb.org lists.apache.org
Nov 8, 2023Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal.CVE-2023-36667 · Other software · Couchbase · reported by MITREHigh 7.5
Couchbase Server 7.1.4 before 7.1.5 and 7.2.0 before 7.2.1 allows Directory Traversal.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com couchbase.com
Nov 8, 2023An issue was discovered in Couchbase Server 7.2.0.CVE-2023-45875 · Other software · Couchbase · reported by MITREHigh 7.5
An issue was discovered in Couchbase Server 7.2.0. There is a private key leak in debug.log while adding a pre-7.0 node to a 7.2 cluster.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Sep 11, 2023An open redirect vulnerability in the sanitize_url() parameter of CouchCMS v2.3 allows attackers to redirect a victim user to an arbitrary web site via a crafteCVE-2023-41609 · Other software · Couchcms · reported by MITREMedium 6.1
An open redirect vulnerability in the sanitize_url() parameter of CouchCMS v2.3 allows attackers to redirect a victim user to an arbitrary web site via a crafted URL.
Product
Couchcms
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record github.com github.com
Jul 18, 2023IBM Planning Analytics Cartridge for Cloud Pak for Data 4.0 connects to a CouchDB server.CVE-2023-27877 · Other software · IBM · reported by psirt@us.ibm.comMedium 5.3
IBM Planning Analytics Cartridge for Cloud Pak for Data 4.0 connects to a CouchDB server. An attacker can exploit an insecure password policy to the CouchDB server and collect sensitive information from the database. IBM X-Force ID: 247905.
Product
Planning Analytics Cartridge for Cloud Pak for Data
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record exchange.xforce.ibmcloud.com ibm.com
May 2, 2023Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document funCVE-2023-26268 · Websites & servers · Apache Software Foundation · reported by security@apache.orgMedium 4.4
Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript environment when using these design document functions: * validate_doc_update * list * filter * filter views (using view functions as filters) * rewrite * update This doesn't affect map/reduce or search (Dreyfus) index functions. Users are recommended to upgrade to a version that is no longer affected by this issue (Apache CouchDB 3.3.2 or 3.2.3). Workaround: Avoid using design documents from untrusted sources which may attempt to cache or store data in the Javascript environment.
Product
Apache CouchDB
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchdb.org lists.apache.org
Mar 22, 2023In Couchbase Server 5 through 7 before 7.1.4, the nsstats endpoint is accessible without authentication.CVE-2023-28470 · Other software · Couchbase · reported by MITREMedium 5.3
In Couchbase Server 5 through 7 before 7.1.4, the nsstats endpoint is accessible without authentication.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 6, 2023Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor.CVE-2023-25016 · Other software · Couchbase · reported by MITREHigh 7.5
Couchbase Server before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2 exposes Sensitive Information to an Unauthorized Actor.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 6, 2023An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2.CVE-2022-42951 · Other software · Couchbase · reported by MITREHigh 8.1
An issue was discovered in Couchbase Server 6.5.x and 6.6.x before 6.6.6, 7.x before 7.0.5, and 7.1.x before 7.1.2. During the start-up of a Couchbase Server node, there is a small window of time (before the cluster management authentication has started) where an attacker can connect to the cluster manager using default credentials.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Feb 6, 2023An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2.CVE-2022-42950 · Other software · Couchbase · reported by MITREMedium 4.9
An issue was discovered in Couchbase Server 7.x before 7.0.5 and 7.1.x before 7.1.2. A crafted HTTP REST request from an administrator account to the Couchbase Server Backup Service can exhaust memory resources, causing the process to be killed, which can be used for denial of service.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jul 21, 2022An issue was discovered in Couchbase Server before 7.0.4.CVE-2022-32556 · Other software · Couchbase · reported by MITREHigh 7.5
An issue was discovered in Couchbase Server before 7.0.4. A private key is leaked to the log files with certain crashes.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jul 15, 2022In Couchbase Server 7.1.x before 7.1.1, an encrypted Private Key passphrase may be leaked in the logs.CVE-2022-34826 · Other software · Couchbase · reported by MITREMedium 5.9
In Couchbase Server 7.1.x before 7.1.1, an encrypted Private Key passphrase may be leaked in the logs.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record couchbase.com couchbase.com
Jul 12, 2022An issue was discovered in Couchbase Server 7.x before 7.0.4.CVE-2022-33911 · Other software · Couchbase · reported by MITREMedium 5.3
An issue was discovered in Couchbase Server 7.x before 7.0.4. Field names are not redacted in logged validation messages for Analytics Service. An Unauthorized Actor may be able to obtain Sensitive Information.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jul 12, 2022An algorithm-downgrade issue was discovered in Couchbase Server before 7.0.4.CVE-2022-33173 · Other software · Couchbase · reported by MITREHigh 7.5
An algorithm-downgrade issue was discovered in Couchbase Server before 7.0.4. Analytics Remote Links may temporarily downgrade to non-TLS connection to determine the TLS port number, using SCRAM-SHA instead.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jun 14, 2022An issue was discovered in Couchbase Server before 6.6.5 and 7.x before 7.0.4.CVE-2022-32561 · Other software · Couchbase · reported by MITREMedium 4.9
An issue was discovered in Couchbase Server before 6.6.5 and 7.x before 7.0.4. Previous mitigations for CVE-2018-15728 were found to be insufficient when it was discovered that diagnostic endpoints could still be accessed from the network.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jun 14, 2022An issue was discovered in Couchbase Server before 7.0.4.CVE-2022-32559 · Other software · Couchbase · reported by MITRECritical 9.1
An issue was discovered in Couchbase Server before 7.0.4. Random HTTP requests lead to leaked metrics.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com
Jun 14, 2022An issue was discovered in Couchbase Server before 7.0.4.CVE-2022-32557 · Other software · Couchbase · reported by MITREHigh 7.5
An issue was discovered in Couchbase Server before 7.0.4. The Index Service does not enforce authentication for TCP/TLS servers.
Product
Couchbase Server
What to do
Apply the vendor’s update. The NVD record links to the advisory.
Full record and what to do →NVD record docs.couchbase.com forums.couchbase.com

Where this comes from: the exploited list is CISA’s Known Exploited Vulnerabilities catalog. Everything else is the whole National Vulnerability Database, where each record is published by the team that found the bug (Wordfence, Patchstack, WPScan, the vendors themselves and others); we show who. Exploit odds are FIRST’s EPSS, updated daily. Titles and categories are ours, so check the linked record before acting on a detail. For a write-up of the big ones, see our advisories. Every vendor, and every WordPress plugin and theme with a recorded flaw, also has its own page. All of it is free to reuse as JSON, CSV or RSS.

Weekly security brief

The flaws that hit local websites, every Friday.

One short email: what got exploited this week, which WordPress plugins broke, and what to check. Unsubscribe in one click.

Vulnerability database

The flaws that hit local websites, every Friday.

Tell us what you're building.