Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 3

Export CSV
CVE-2026-108742

CloudBeaver through 25.3.5 Missing Authorization via initConnection GraphQL Mutation

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in the initConnection GraphQL mutation that lets view-only shared-project members persist credentials without datasource-edit permission. Attackers can set saveCredentials and sharedCredentials flags with chosen authProperties so other users connect to the shared connection under the attacker's database identity.

CVSS 4.0 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Dbeaver
Products
Dbeaver
CVE-2026-108745

CloudBeaver through 25.3.5 Missing Authorization via /api/sql-result-value Servlet

CloudBeaver through 25.3.5 contains a missing authorization vulnerability in WebSQLResultServlet that allows any web session holder to read other users' LOB export files from a shared folder. Attackers can guess table and column names and enumerate second-resolution timestamps to download victims' LOB values, including data from connections they cannot query.

CVSS 4.0 · 2.3 Low EPSS < 1% KEV · Not listed
Vendors
Dbeaver
Products
Dbeaver
CVE-2021-3836

Improper Restriction of XML External Entity Reference in dbeaver/dbeaver

dbeaver is vulnerable to Improper Restriction of XML External Entity Reference

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed
Vendors
Dbeaver
Products
Dbeaver