Apache Software Foundation Apache Kylin

• CVE-2026-108837 High 7.5 Apache Kylin: Potential computed-column resource exhaustion 0.4%
• CVE-2026-108833 High 7.5 Apache Kylin: default startup profile miss security settings 0.3%
• CVE-2026-108823 High 7.5 Apache Kylin: Potential unauthenticated job metadata replacement 0.3%
• CVE-2026-108780 Medium 6.5 Apache Kylin: Potential JDBC source configuration validation issue 0.2%
• CVE-2026-108776 Medium 5.3 Apache Kylin: tables/names SparkSQL injection 0.3%
• CVE-2026-108771 Critical 9.8 Apache Kylin: unauthenticated broadcast API and polymorphic deserialization 0.5%
• CVE-2026-108766 Medium 6.5 Apache Kylin: missing JDBC-config authorization 0.2%
• CVE-2026-108764 Medium 6.5 Apache Kylin: job-driver UI proxy SSRF 0.2%
• CVE-2026-108762 High 7.3 Apache Kylin: delete metadata backup path-confinement bypass 0.3%
• CVE-2026-108743 High 8.8 Apache Kylin: spark job OS command injection 1.4%
• CVE-2026-108709 Critical 9.8 Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network) 0.4%
• CVE-2026-69080 High 7.5 Apache Kylin: Broken Access Control in QuerySQLBlacklistController 0.4%
• CVE-2026-69077 High 7.5 Apache Kylin: JobController allows unauthorized cross-project manipulation 0.4%
• CVE-2026-69076 High 7.5 Apache Kylin: Unauthorized cross-project job discard 0.4%
• CVE-2026-68573 Critical 9.8 Apache Kylin: Unauthenticated Metastore Cleanup 0.5%
• CVE-2026-68572 High 7.5 Apache Kylin: Unauthorized SQL execution to Spark SQL env 0.3%
• CVE-2026-68571 High 8.8 Apache Kylin: JDBC URL Whitelist Verification Bypass 0.4%
• CVE-2026-64959 Critical 9.8 Apache Kylin: Missing authentication on certain cache API endpoints 0.4%
• CVE-2026-64610 Critical 9.8 Apache Kylin: Redis unsafe Java deserialization 0.4%
• CVE-2026-63619 Critical 9.1 Apache Kylin: Missing authorization and path-confinement on system meta dump 0.3%
• CVE-2026-63618 High 7.5 Apache Kylin: Low-Privilege Config Exposure 0.3%
• CVE-2026-62393 Medium 4.3 Apache Kylin: Improper authorization in job information retrieval 0.5%
• CVE-2026-62392 High 8.8 Apache Kylin: OS Command Injection via Async Query API 2.5%
• CVE-2026-62390 Critical 9.8 Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API 0.7%
• CVE-2025-61735 High 7.3 Apache Kylin: Server-Side Request Forgery 1.0%
• CVE-2025-61733 High 7.5 Apache Kylin: Authentication bypass 1.3%
• CVE-2025-61734 High 7.5 Apache Kylin: improper restriction of file read 26.1%
• CVE-2025-30067 High 7.2 Apache Kylin: The remote code execution via jdbc url 0.9%
• CVE-2024-48944 Medium 6.5 Apache Kylin: SSRF vulnerability in the diagnosis api 0.6%
• CVE-2024-23590 Critical 9.1 Apache Kylin: Session fixation in web interface 0.7%
• CVE-2023-29055 High 7.5 Apache Kylin: Insufficiently protected credentials in config file 1.1%
• CVE-2022-44621 Critical 9.8 Apache Kylin: Command injection by Diagnosis Controller 3.1%
• CVE-2022-43396 High 8.8 Apache Kylin: Command injection by Useless configuration 55.3%
• CVE-2022-24697 Critical 9.8 Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters 84.8%
• CVE-2021-45458 Unrated Hardcoded credentials 2.1%
• CVE-2021-45457 Unrated Overly broad CORS configuration 2.5%
• CVE-2021-45456 Unrated Command injection 88.9%
• CVE-2021-36774 Unrated Mysql JDBC Connector Deserialize RCE 2.0%
• CVE-2021-31522 Unrated Apache Kylin unsafe class loading 3.0%
• CVE-2021-27738 Unrated Improper Access Control to Streaming Coordinator & SSRF 2.6%