Apache Software Foundation Apache IoTDB

• CVE-2026-59229 High 8.8 Apache IoTDB: Legacy Pipe Privilege Escalation 0.4%
• CVE-2026-59562 Critical 9.8 Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC 0.6%
• CVE-2026-58663 Critical 9.8 Apache IoTDB: Auth Bypass in pipeTransfer() interface 0.6%
• CVE-2026-44630 High 7.5 Apache IoTDB: RPC service denial of service via unchecked Thrift string length 0.6%
• CVE-2026-40452 High 7.5 Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users 0.4%
• CVE-2026-40009 Medium 6.5 Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor 0.4%
• CVE-2026-40008 Critical 9.8 Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC 0.6%
• CVE-2026-40007 High 7.5 Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per-connection StackOverflowError 0.5%
• CVE-2026-40006 High 7.5 Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver 0.6%
• CVE-2026-40005 Critical 9.1 Apache IoTDB: Path Traversal in Pipe File Transfer Receiver 0.5%
• CVE-2026-28564 Critical 9.8 Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials 0.7%
• CVE-2026-24013 Critical 9.1 Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC 0.6%
• CVE-2026-24012 High 7.5 Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query 0.7%
• CVE-2026-24014 Critical 9.8 Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write 0.7%
• CVE-2025-64152 Critical 9.1 Apache IoTDB: Path Traversal Vulnerability 0.5%
• CVE-2025-55017 Critical 9.1 Apache IoTDB: Path Traversal Vulnerability 0.5%
• CVE-2026-24713 Critical 9.8 Apache IoTDB: JEXL Expression Injection Vulnerability 0.7%
• CVE-2026-24015 Critical 9.8 Apache IoTDB: Insecure Default Configuration Vulnerability 0.6%
• CVE-2025-48392 High 7.5 Apache IoTDB: DoS Vulnerability 0.6%
• CVE-2025-48459 Medium 5.3 Apache IoTDB: Deserialization of untrusted Data 0.5%
• CVE-2025-26864 High 7.5 Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID Authentication 0.7%
• CVE-2024-24780 Critical 9.8 Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function 1.4%
• CVE-2023-46226 Critical 9.8 Apache IoTDB: Remote Code Execution (RCE) risk via the UDF 1.9%
• CVE-2023-51656 Unrated Apache IoTDB: Unsafe deserialize map in Sync Tool 1.0%
• CVE-2023-24831 Critical 9.8 Apache IoTDB grafana-connector Login Bypass Vulnerability 1.2%
• CVE-2022-43766 High 7.5 Apache IoTDB prior to 0.13.3 allows DoS 1.6%
• CVE-2022-38370 Unrated No authorization of DatabaseConnectController in grafana-connector. 1.4%
• CVE-2022-38369 Unrated Login check vulnerability by session Id 1.3%