Read the docs

Apache

Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability Priority CRITICAL 97KEV 2026-04-16TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability Priority CRITICAL 98KEV 2025-05-01TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability Priority CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records
Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

26 records in Zeppelin · all components

TI-2019-07420 CVE-2019-10095 · GHSA-4qw8-pgpr-p9mq

bash command injection in spark interpreter

Priority MEDIUM 51

bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter settings.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05747 Published 2021-09-02 Fixed in 0.10.0 CWE-77
TI-2018-01220 CVE-2018-1317 · GHSA-9x2h-hvg6-4r5p

Improper authentication in Apache Zeppelin

Priority MEDIUM 45

In Apache Zeppelin prior to 0.8.0 the cron scheduler was enabled by default and could allow users to run paragraphs as other users without authentication.

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.0458 Published 2019-04-23 Fixed in 0.8.0 CWE-287
TI-2017-09344 CVE-2017-12619 · GHSA-c538-924g-99q4

Session fixation in Apache Zeppelin

Priority MEDIUM 43

Apache Zeppelin prior to 0.7.3 was vulnerable to session fixation which allowed an attacker to hijack a valid user session.

CVSS 3.0HIGH 8.1 Network No auth User interaction EPSS 0.04946 Published 2019-04-23 Fixed in 0.7.3 CWE-384
TI-2024-34680 CVE-2024-51775 · GHSA-xg8j-j6vp-6h5w

Apache Zeppelin: Command Injection via CSWSH

Priority LOW 39

Missing Origin Validation in WebSockets vulnerability in Apache Zeppelin.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00289 Published 2025-08-03 Fixed in 0.12.0 CWE-1385
TI-2020-10907 CVE-2020-13929 · GHSA-87p2-cvhq-q4mv

Notebook permissions bypass

Priority LOW 39

Authentication bypass vulnerability in Apache Zeppelin allows an attacker to bypass Zeppelin authentication mechanism to act as another user.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.03258 Published 2021-09-02 Fixed in 0.10.0 CWE-287
TI-2021-09724 CVE-2021-28655 · GHSA-gm67-h5wr-w3cv

Apache Zeppelin: Arbitrary file deletion vulnerability

Priority LOW 38

The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to delete the arbitrary files.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.01641 Published 2022-12-16 Fixed in 0.10.0 CWE-20
TI-2018-01230 CVE-2018-1328 · GHSA-r2v5-5vcr-h3vq

Cross-site scripting in Apache Zeppelin

Priority LOW 36

Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.06015 Published 2019-04-23 Fixed in 0.8.0 CWE-79
TI-2024-20980 CVE-2024-31862 · GHSA-6623-c6mr-6737

Apache Zeppelin: Denial of service with invalid notebook name

Priority LOW 33

Improper Input Validation vulnerability in Apache Zeppelin when creating a new note from Zeppelin's UI.This issue affects Apache Zeppelin: from 0.10.1 before 0.11.0.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.01365 Published 2024-04-09 Fixed in 0.11.0 CWE-20
TI-2021-09031 CVE-2021-27578 · GHSA-mf7q-gw5f-q8jj

Cross Site Scripting in markdown interpreter

Priority LOW 33

Cross Site Scripting vulnerability in markdown interpreter of Apache Zeppelin allows an attacker to inject malicious scripts.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.03232 Published 2021-09-02 Fixed in 0.9.0 CWE-79
TI-2024-20979 CVE-2024-31860 · GHSA-g64r-xf39-q4p5

Apache Zeppelin: Path traversal vulnerability

Priority LOW 32

Improper Input Validation vulnerability in Apache Zeppelin.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01386 Published 2024-04-09 Fixed in 0.11.0 CWE-22
TI-2024-27523 CVE-2024-41177 · GHSA-p288-459w-jxj6

Apache Zeppelin: XSS in the Helium module

Priority LOW 29

Incomplete Blacklist to Cross-Site Scripting vulnerability in Apache Zeppelin.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.0073 Published 2025-08-03 Fixed in 0.12.0 CWE-79
TI-2022-23214 CVE-2022-46870 · GHSA-9p8j-hrgf-jc2g

Apache Zeppelin: Stored XSS in note permissions

Priority LOW 27

An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Zeppelin allows logged-in users to execute arbitrary javascript in other users' browsers.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.01192 Published 2022-12-16 Fixed in 0.8.2 CWE-79
Load more
Open these records in search →