databuff vulnerabilities
CVEs whose affected-version data names the databuff package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2 CVEsRSS
CVE-2026-111693Critical· 9.8DataBuff ai-apm-web through 0.1.10 Hard-Coded Default Admin Credentials
DataBuff ai-apm-web through 0.1.10 contains a hard-coded default credentials vulnerability that allows unauthenticated attackers to gain administrator access using the built-in admin/Databuff@123 account. Attackers can POST these credent…
▾ Midnightdatabufflabs · databuffvia CVEORG
CVE-2026-111692Critical· 9.8PoCDataBuff ai-apm-web through 0.1.10 Authentication Bypass via Hardcoded HMAC Secret
DataBuff ai-apm-web through 0.1.10 contains an authentication bypass vulnerability that allows unauthenticated attackers to forge admin session tokens by using the hardcoded HMAC secret in JwtTokenService. Attackers can sign a payload of…
▾ Abyssaldatabufflabs · databuffvia CVEORG