Threats affecting pkg:maven/com.blackducksoftware/coverity-connect

1 threat

Severity	CVSS	Signals	Threat	Source	Published	Score and star
Critical	9.2	EPSS 0.5%	CVE-2026-8338Black Duck Coverity Connect · Authentication Bypass Using an Alternate Path or Channel Critical9.2EPSS 0.5%2026-07-29CVE Database V5CVE-2026-8338 A Spring Security authentication and authorization bypass exists in Coverity Connect versions between 2023.6.0 and 2026.3.0. An unauthenticated malicious threat actor that can send a specially crafted HTTP request is able to bypass authentication and authorization controls on certain API endpoints to access data within Coverity. EPSS 0.5%Vulnerability CWE-288 #ghsa-f3gv-992v-c3v5	CVE Database V5	2026-07-29

Page 1 of 1