Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-8339

SQL Injection in Coverity Connect SOAP API

A SQL injection vulnerability exists in the Coverity Connect SOAP API for versions between 2024.6.0 and 2026.3.0 (inclusive). A malicious, authenticated threat actor who sends a specially crafted payload can achieve full read access to database contents and other unauthorized commands.

CVSS 4.0 · 8.7 High EPSS < 1% KEV · Not listed
Vendors
Black Duck
Products
Coverity
CVE-2026-8338

Authentication and Authorization Bypass in Coverity Connect

A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoints to access data within Coverity.

CVSS 4.0 · 9.2 Critical EPSS < 1% KEV · Not listed
Vendors
Black Duck
Products
Coverity
CVE-2026-1496

Coverity CLI Authentication Bypass

Vulnerable versions of Coverity Connect lack an error handler in the authentication logic for command line tooling that makes it vulnerable to an authentication bypass. A malicious actor with access to the /token API endpoint that either knows or guesses a valid username, can use this in a specially crafted HTTP request to bypass authentication. Successful exploitation allows the malicious actor to assume all roles and privileges granted to the valid user’s Coverity Connect account.

CVSS 4.0 · 9.3 Critical EPSS < 1% KEV · Not listed
Vendors
Black Duck
Products
Coverity