| CVE-2026-107755 |
Insufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms…
|
6.0
Medium
|
Oct 20, 2026 |
| CVE-2026-90800 |
Missing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the…
|
8.1
High
|
Oct 20, 2026 |
| CVE-2026-90799 |
Unsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated…
|
1.3
Low
|
Oct 20, 2026 |
| CVE-2026-90798 |
A missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a…
|
0.6
Low
|
Oct 20, 2026 |
| CVE-2026-90797 |
An unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote…
|
7.7
High
|
Oct 20, 2026 |
| CVE-2026-86471 |
An unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server…
|
9.3
Critical
|
Oct 20, 2026 |
| CVE-2023-45725 |
Design document functions which receive a user http request object may expose authorization or session cookie headers of…
|
Not rated
|
Dec 13, 2023 |
| CVE-2023-26268 |
Design documents with matching document IDs, from databases on the same cluster, may share a mutable Javascript…
|
4.4
Medium
|
May 2, 2023 |
| CVE-2022-24706 |
Exploited
Apache CouchDB Insecure Default Initialization of Resource Vulnerability
|
Not rated
|
Apr 26, 2022 |
| CVE-2021-38295 |
In Apache CouchDB, a malicious user with permission to create documents in a database is able to attach a HTML…
|
Not rated
|
Oct 14, 2021 |
| CVE-2018-17188 |
Prior to CouchDB version 2.3.0, CouchDB allowed for runtime-configuration of key components of the database
|
Not rated
|
Jan 2, 2019 |
| CVE-2018-11769 |
CouchDB administrative users before 2.2.0 can configure the database server via HTTP(S)
|
Not rated
|
Aug 8, 2018 |
| CVE-2018-8007 |
Apache CouchDB administrative users can configure the database server via HTTP(S)
|
Not rated
|
Jul 11, 2018 |
| CVE-2016-8742 |
The Windows installer that the Apache CouchDB team provides was vulnerable to local privilege escalation
|
Not rated
|
Feb 12, 2018 |
| CVE-2017-12636 |
CouchDB administrative users can configure the database server via HTTP(S)
|
Not rated
|
Nov 14, 2017 |
| CVE-2017-12635 |
Due to differences in the Erlang-based JSON parser and JavaScript-based JSON parser, it is possible in Apache CouchDB…
|
Not rated
|
Nov 14, 2017 |