Apache

Records4054All Threatist records

Exploited (KEV)47In CISA KEV

CVSS critical776CVSS 9.0–10.0

CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV

TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability CRITICAL 99KEV 2026-10-27 TI-2016-02580 Apache Struts Command Injection Vulnerability CRITICAL 94KEV 2026-10-08 TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability CRITICAL 90KEV 2026-08-04 TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability CRITICAL 97KEV 2026-04-16 TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability CRITICAL 98KEV 2025-05-01 TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records

Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

34 records in Dolphinscheduler · all components

TI-2022-22673 CVE-2022-45875 · GHSA-3xh5-8hvq-rc8x

Apache DolphinScheduler: Remote command execution Vulnerability in script alert plugin

MEDIUM 54

Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02754 Published 2023-01-04 Fixed in 3.0.2, 3.1.1 CWE-20

TI-2022-22425 CVE-2022-45462 · GHSA-wqg7-mx6p-2rw3

Apache DolphinScheduler prior to 2.0.5 have command execution vulnerability

MEDIUM 54

Alarm instance management has command injection when there is a specific command configured.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02886 Published 2022-11-23 Fixed in 2.0.6 CWE-77

TI-2024-28858 CVE-2024-43202 · GHSA-2fm6-mv57-p2qh

Apache DolphinScheduler: Remote Code Execution Vulnerability

MEDIUM 53

Exposure of Remote Code Execution in Apache Dolphinscheduler.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02149 Published 2024-08-20 Fixed in 3.2.2 CWE-94

TI-2023-26774 CVE-2023-49109 · GHSA-qwxx-xww6-8q8m

Remote Code Execution in Apache Dolphinscheduler

MEDIUM 53

Exposure of Remote Code Execution in Apache Dolphinscheduler.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02301 Published 2024-02-20 Fixed in 3.2.1 CWE-94

TI-2020-09634 CVE-2020-11974 · GHSA-jpj4-5xwp-cv23

Deserialization of untrusted data in Apache DolphinScheduler

MEDIUM 53

In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.08124 Published 2020-12-18 Fixed in 1.3.0 CWE-502

TI-2024-28837 CVE-2024-43166 · GHSA-rrpj-r8h7-rm7r

Incorrect default permissions in Apache DolphinScheduler

MEDIUM 50

Incorrect Default Permissions vulnerability in Apache DolphinScheduler.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00533 Published 2025-09-03 Fixed in 3.2.2, 3.3.1 CWE-276

TI-2024-19934 CVE-2024-30188 · GHSA-4vv4-crw4-8pcw

Apache DolphinScheduler: Resource File Read And Write Vulnerability

MEDIUM 49

File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.05987 Published 2024-08-09 Fixed in 3.2.2 CWE-20

TI-2026-25414 CVE-2026-32966 · GHSA-r989-cjhx-3v49

Apache DolphinScheduler: DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure

MEDIUM 48

DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0039 Published 2026-06-17 Fixed in 3.4.2 CWE-863

TI-2026-25415 CVE-2026-32967 · GHSA-85g9-8j9g-p486

Apache DolphinScheduler: The `/v2` experimental interface lacks permission checks

MEDIUM 45

Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.00337 Published 2026-06-17 Fixed in 3.4.2 CWE-863

TI-2024-15422 CVE-2024-23320 · GHSA-rc6h-qwj9-2c53

Apache DolphinScheduler: Arbitrary js execution as root for authenticated users

MEDIUM 43

Improper Input Validation vulnerability in Apache DolphinScheduler.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01388 Published 2024-02-23 Fixed in 3.2.1 CWE-20

TI-2023-26935 CVE-2023-49299 · GHSA-v7hg-77v9-2445

Apache DolphinScheduler: Arbitrary js execute as root for authenticated users

MEDIUM 43

Improper Input Validation vulnerability in Apache DolphinScheduler.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0143 Published 2023-12-30 Fixed in 3.1.9 CWE-20

TI-2024-19607 CVE-2024-29831 · GHSA-m9q4-p56m-mc6q

Apache DolphinScheduler: RCE by arbitrary js execution

MEDIUM 42

Improper Input Validation vulnerability in Apache DolphinScheduler.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01175 Published 2024-08-09 Fixed in 3.2.2 CWE-20

TI-2022-10122 CVE-2022-26885 · GHSA-jvc3-wjf6-7c6c

Apache DolphinScheduler config file read by task risk

MEDIUM 42

When using tasks to read config files, there is a risk of database password disclosure.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01362 Published 2022-11-24 Fixed in 2.0.6 CWE-200

TI-2021-09095 CVE-2021-27644 · GHSA-93g4-3phc-g4xw

DolphinScheduler mysql jdbc connector parameters deserialize remote code execution

MEDIUM 42

In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01922 Published 2021-11-01 Fixed in 1.3.6 CWE-264

TI-2026-36276 CVE-2026-49050 · GHSA-9pwm-6667-rfcm

Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens

MEDIUM 41

General user can mint admin access tokens via /access-tokens This issue affects Apache DolphinScheduler: before 3.4.2.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00576 Published 2026-08-25 Fixed in 3.4.2 CWE-863

TI-2024-28786 CVE-2024-43115 · GHSA-3vcp-r62v-xpvg

Apache DolphinScheduler: Alert Script Attack

MEDIUM 41

Improper Input Validation vulnerability in Apache DolphinScheduler.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00592 Published 2025-09-03 Fixed in 3.2.2 CWE-20

TI-2025-38506 CVE-2025-62188 · GHSA-3cjc-vhfm-ffp2

Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint.

MEDIUM 40

An Exposure of Sensitive Information to an Unauthorized Actor vulnerability exists in Apache DolphinScheduler.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00541 Published 2026-04-09 Fixed in 3.2.0 CWE-200

TI-2026-19258 CVE-2026-23902 · GHSA-72mv-wwvm-vgp5

Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution.

LOW 38

Incorrect Authorization vulnerability in Apache DolphinScheduler allows authenticated users with system login permissions to use tenants that are not defined on the platform during workflow execution.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.00446 Published 2026-04-24 Fixed in 3.4.1 CWE-863

TI-2023-27497 CVE-2023-50270 · GHSA-vjqc-g788-f378

Apache DolphinScheduler: Session do not expire after password change

LOW 37

Session Fixation Apache DolphinScheduler before version 3.2.0, which session is still valid after the password change.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01306 Published 2024-02-20 Fixed in 3.2.1 CWE-613

TI-2022-09188 CVE-2022-25598 · GHSA-qg5x-66hp-cw5p

Apache DolphinScheduler user registration is vulnerable to ReDoS attacks

LOW 37

Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or higher.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01981 Published 2022-03-30 Fixed in 2.0.5 CWE-1333

TI-2023-28398 CVE-2023-51770 · GHSA-ff2w-wm48-jhqj

Apache DolphinScheduler: Arbitrary File Read Vulnerability

LOW 35

Arbitrary File Read Vulnerability in Apache Dolphinscheduler.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01239 Published 2024-02-20 Fixed in 3.2.1 CWE-94

TI-2023-26735 CVE-2023-49068 · GHSA-c6cg-73p3-973h

Apache DolphinScheduler: Information Leakage Vulnerability

LOW 35

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01052 Published 2023-11-27 Fixed in 3.2.1 CWE-200

TI-2023-26624 CVE-2023-48796 · GHSA-4vvc-r4p4-qgrr

Apache dolphinscheduler sensitive information disclosure

LOW 35

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01191 Published 2023-11-24 Fixed in 3.0.2 CWE-200

TI-2023-26892 CVE-2023-49250 · GHSA-37gx-jqx9-fwmg

Apache DolphinScheduler: Insecure TLS TrustManager used in HttpUtil

LOW 33

Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the server.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.00704 Published 2024-02-20 Fixed in 3.2.1 CWE-295

TI-2022-15481 CVE-2022-34662 · GHSA-fp35-xrrr-3gph

Apache DolphinScheduler prior to 3.0.0 allows path traversal

LOW 32

When users add resources to the resource center with a relation path will cause path traversal issues and only for logged-in users.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01728 Published 2022-11-01 Fixed in 3.0.0 CWE-22

Open these records in search →

Critical	776
High	1543
Medium	1572
Low	112
No CVSS	51