Apache Software Foundation Apache Calcite Avatica

• CVE-2026-70410 High 8.8 Apache Calcite Avatica: Unrestricted class initialization when instantiating plugins 0.6%
• CVE-2022-36364 Unrated Apache Calcite Avatica JDBC driver `httpclient_impl` connection property can be used as an RCE vector 3.2%