Read the docs

Apache

Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability Priority CRITICAL 97KEV 2026-04-16TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability Priority CRITICAL 98KEV 2025-05-01TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability Priority CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records
Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

24 records in Kylin · all components

TI-2020-01880 CVE-2020-1956 · GHSA-gprm-xqrc-c2j3

OS command injection in Apache Kylin

Priority CRITICAL 97KEV

Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a user is likely to be able to execute any os command without any protection or v…

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.97389 Published 2020-05-22 Fixed in 2.6.6, 3.0.2 CWE-78
TI-2022-08515 CVE-2022-24697 · GHSA-ppxx-m926-g569

OS command injection in Apache Kylin

Priority CRITICAL 90

Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.84777 Published 2022-10-13 Fixed in 2.6.6, 4.0.2 CWE-78
TI-2021-20543 CVE-2021-45456 · GHSA-hw3m-8h25-8frw

Command injection in Apache Kylin

Priority HIGH 84

Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.88887 Published 2022-01-06 Fixed in 4.0.1 CWE-77
TI-2020-10914 CVE-2020-13937 · GHSA-2hpg-vwqj-6h6w

Insecure storage of sensitive information in Apache Kylin

Priority MEDIUM 64

Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6, 3.0.0-alpha, 3.0.0-alpha2, 3.0.0-beta, 3.0.0, 3.0.1, 3.0.2, 3.1.0, 4.0.0-alpha ha…

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.78331 Published 2020-10-19 Fixed in 3.1.1, 4.0.0-beta CWE-922
TI-2020-10903 CVE-2020-13925 · GHSA-qwfw-gxx2-mmv2

OS command injection in Apache Kylin

Priority MEDIUM 61

Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.20013 Published 2020-07-14 Fixed in 3.1.0 CWE-78
TI-2025-38136 CVE-2025-61734 · GHSA-p86w-w5rh-m3hx

Apache Kylin: improper restriction of file read

Priority MEDIUM 55

Files or Directories Accessible to External Parties vulnerability in Apache Kylin.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.26124 Published 2025-10-02 Fixed in 5.0.3 CWE-552
TI-2022-21940 CVE-2022-44621 · GHSA-w9rv-xmf7-x3gh

Apache Kylin: Command injection by Diagnosis Controller

Priority MEDIUM 54

Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.03052 Published 2022-12-30 Fixed in 4.0.3 CWE-77
TI-2026-44531 CVE-2026-62392 · GHSA-vv75-pcv7-p758

Apache Kylin: OS Command Injection via Async Query API

Priority MEDIUM 48

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02481 Published 2026-07-14 No fix listed CWE-78
TI-2021-11651 CVE-2021-31522 · GHSA-q656-g2x3-8cgh

Apache Kylin unsafe class loading

Priority MEDIUM 48

Kylin can receive user input and load any class through Class.forName(...).

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.02998 Published 2022-01-06 Fixed in 3.1.3, 4.0.1 CWE-470
TI-2020-10904 CVE-2020-13926 · GHSA-hx5g-8hq2-8x4w

SQL injection in Apache Kylin

Priority MEDIUM 46

Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which mak…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.0195 Published 2020-07-14 Fixed in 3.1.0 CWE-89
TI-2020-01861 CVE-2020-1937 · GHSA-7hmh-8gwv-mfvq

SQL injection in Apache Kylin

Priority MEDIUM 44

Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0307 Published 2020-02-24 Fixed in 2.6.5, 3.0.1 CWE-89
TI-2025-38135 CVE-2025-61733 · GHSA-mr9j-4j48-xcm2

Apache Kylin: Authentication bypass

Priority MEDIUM 43

Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01301 Published 2025-10-02 Fixed in 5.0.3 CWE-288
TI-2023-13505 CVE-2023-29055 · GHSA-3vvc-v8c2-43r7

Apache Kylin: Insufficiently protected credentials in config file

Priority MEDIUM 41

In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that may contain serverside credentials.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01149 Published 2024-01-29 Fixed in 4.0.4 CWE-522
TI-2021-20544 CVE-2021-45457 · GHSA-mgpf-hhgf-cxg4

Overly broad CORS configuration

Priority LOW 38

In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02462 Published 2022-01-06 Fixed in 3.1.3, 4.0.1 CWE-863
TI-2021-09147 CVE-2021-27738 · GHSA-wrx7-qgmj-mf2q

Improper Access Control to Streaming Coordinator & SSRF

Priority LOW 38

All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security checks, which allowed an unauthenticated user to issue arbitrary…

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02641 Published 2022-01-06 Fixed in 3.1.2, 3.1.3 CWE-918
TI-2021-20545 CVE-2021-45458 · GHSA-9fj5-jg6f-qg5r

Hardcoded credentials in Apache Kylin

Priority LOW 37

Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.02148 Published 2022-01-06 Fixed in 3.1.3, 4.0.1 CWE-798
TI-2025-21428 CVE-2025-30067 · GHSA-29m8-wh9p-5wc4

Apache Kylin: The remote code execution via jdbc url

Priority LOW 35

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin.

CVSS 3.1HIGH 7.2 Network High privileges No interaction EPSS 0.00927 Published 2025-03-27 Fixed in 5.0.2 CWE-94
TI-2025-38137 CVE-2025-61735 · GHSA-f6m8-qm7j-fh65

Apache Kylin: Server-Side Request Forgery

Priority LOW 34

Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin.

CVSS 3.1HIGH 7.3 Network No auth No interaction EPSS 0.01042 Published 2025-10-02 Fixed in 5.0.3 CWE-918
TI-2021-14895 CVE-2021-36774 · GHSA-5429-pjww-7675

Mysql JDBC Connector Deserialize RCE

Priority LOW 33

Apache Kylin allows users to read data from other database systems using JDBC.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.02013 Published 2022-01-06 Fixed in 3.1.3 CWE-668
Open these records in search →