vitessio vitess
8 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-104252 | < 23.0.5 ; >= 24.0.0, < 24.0.2 | Vitess vttablet /twopcz reflected XSS | CRITICAL 9.8 | 1.2 % | ||
| CVE-2026-65959 | <= 24.0.2 | Vitess: Missing authorization on vttablet /debug/vrlog exposes live VReplication SQL data | MEDIUM 5.3 | 0.4 % | ||
| CVE-2026-27969 | < 22.0.4 ; >= 23.0.0, < 23.0.3 | Vitess users with backup storage access can write to arbitrary file paths on restore | CRITICAL 9.3 | 0.5 % | ||
| CVE-2026-27965 | < 22.0.4 ; >= 23.0.0, < 23.0.3 | Vitess users with backup storage access can gain unauthorized access to production deployment environments | HIGH 8.4 | 0.5 % | ||
| CVE-2024-53257 | >= 0.21.0-rc1, < 21.0.1 ; >= 0.20.0-rc1, < 20.0.4 ; < 19.0.8 | Vitess allows HTML injection in /debug/querylogz & /debug/env | MEDIUM 4.9 | 0.4 % | ||
| CVE-2024-32886 | < 17.0.7 ; >= 18.0.0, < 18.0.5 ; >= 19.0.0, < 19.0.4 | Vitess vulnerable to infinite memory consumption and vtgate crash | MEDIUM 4.9 | 0.8 % | ||
| CVE-2023-29195 | < 16.0.2 | Vitess VTAdmin users that can create shards can deny access to other functions | MEDIUM 4.3 | 1.0 % | ||
| CVE-2023-29194 | < 0.16.1 | vitess allows users to create keyspaces that can deny access to already existing keyspaces | MEDIUM 4.1 | 0.8 % |