CVE search
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
Every published CVE plus open-source advisories (NVD, OSV, GitHub), with CVSS, EPSS and whether it is being exploited in the wild (CISA KEV). Updated every few hours. Our scans match these against the technologies they detect.
| 06/11/2025 |
| CVE-2025-27100 | 中危6.5 | lakeFS is an open-source tool that transforms your object storage into a Git-like repository. In affected versions an authenticated user can crash lakeFS by exhausting server memory. This is an authenticated denial-of-service issue. This problem has been patched in version 1.50.0. Users on versions 1.49.1 and below ar | 21/02/2025 |
| CVE-2024-43784 | 中危5.7 | lakeFS is an open-source tool that transforms object storage into a Git-like repository. Existing lakeFS users who have issued credentials to users who have been deleted are affected by this vulnerability. When creating a new user with the same username as a deleted user, that user will inherit all of the previous user | 26/11/2024 |
| GO-2022-1019 | lakeFS vulnerable to authenticated users deleting files they are not authorized to delete in github.com/treeverse/lakefs | 21/08/2024 |
| GO-2022-0375 | Improper Access Control in github.com/treeverse/lakefs | 21/08/2024 |
| GO-2023-2398 | lakeFS logs S3 credentials in plain text in github.com/treeverse/lakefs | 21/08/2024 |
| GO-2023-2397 | User with permission to write actions can impersonate another user when auth token is configured in environment variable in github.com/treeverse/lakefs | 21/08/2024 |
| GO-2023-2012 | lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files in github.com/treeverse/lakefs | 21/08/2024 |
| GO-2024-2581 | User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository in github.com/treeverse/lakefs | 04/06/2024 |
| GHSA-fvv5-h29g-f6w5 | 中危5.3 | User with ci:ReadAction permissions and write permissions to one path in a repository may copy objects from any path in the repository | 22/02/2024 |
| GHSA-4rgc-5g6r-2rjf | 高危8.4 | lakeFS logs S3 credentials in plain text | 12/12/2023 |
| GHSA-26hr-q2wp-rvc5 | 中危6.2 | User with permission to write actions can impersonate another user when auth token is configured in environment variable | 12/12/2023 |
| GHSA-9phh-r37v-34wh | 中危5.8 | lakeFS vulnerable to Arbitrary JavaScript Injection via Direct Link to HTML Files | 14/08/2023 |
| GHSA-28q9-9c3g-v3f9 | 高危 | lakeFS vulnerable to authenticated users deleting files they are not authorized to delete | 23/09/2022 |
| GHSA-m836-gxwq-j2pm | 中危5.7 | Improper Access Control in github.com/treeverse/lakefs | 28/10/2021 |