Search vulnerabilities

Use the Query Builder to create your own search query, or check out the documentation to learn the search syntax.

Results 22

Export CSV
CVE-2026-108833

Apache Kylin: default startup profile miss security settings

Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on does not impact. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin
CVE-2026-108837

Apache Kylin: Potential computed-column resource exhaustion

Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin
CVE-2026-108823

Apache Kylin: Potential unauthenticated job metadata replacement

Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin
CVE-2026-108780

Apache Kylin: Potential JDBC source configuration validation issue

Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the kylin backend services are open to public network. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin
CVE-2026-108776

Apache Kylin: tables/names SparkSQL injection

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode, which is the default and most common mode. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 5.3 Medium EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin
CVE-2026-108771

Apache Kylin: unauthenticated broadcast API and polymorphic deserialization

Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin
CVE-2026-108766

Apache Kylin: missing JDBC-config authorization

Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin
CVE-2026-108764

Apache Kylin: job-driver UI proxy SSRF

Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job service that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin
CVE-2026-108762

Apache Kylin: delete metadata backup path-confinement bypass

Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin
CVE-2026-64610

Apache Kylin: Redis unsafe Java deserialization

Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin
CVE-2026-64959

Apache Kylin: Missing authentication on certain cache API endpoints

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API misses required authentication and can cause execution of injected SQL. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin
CVE-2026-108743

Apache Kylin: spark job OS command injection

Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 8.8 High EPSS 1.4% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin
CVE-2026-69080

Apache Kylin: Broken Access Control in QuerySQLBlacklistController

Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin
CVE-2026-69077

Apache Kylin: JobController allows unauthorized cross-project manipulation

Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin
CVE-2026-108709

Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)

Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin
CVE-2026-68573

Apache Kylin: Unauthenticated Metastore Cleanup

Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 9.8 Critical EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin
CVE-2026-68572

Apache Kylin: Unauthorized SQL execution to Spark SQL env

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin
CVE-2026-69076

Apache Kylin: Unauthorized cross-project job discard

Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 7.5 High EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin
CVE-2026-63619

Apache Kylin: Missing authorization and path-confinement on system meta dump

Missing Authorization vulnerability in Apache Kylin. A backend metadata dump API misses the enough authorization and the path-confinement. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin
CVE-2026-68571

Apache Kylin: JDBC URL Whitelist Verification Bypass

Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection.  Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed
Vendors
Apache Apache Software Foundation
Products
Apache Kylin Apache Kylin