Apache Software Foundation Apache Spark

• CVE-2022-33891 High 8.8 Exploited Apache Spark shell command injection vulnerability via Spark UI 93.2%
• CVE-2026-32773 Medium 6.1 Apache Spark: XSS Vulnerability in Spark Web 3.5.4 0.4%
• CVE-2025-54920 High 8.8 Apache Spark: Spark History Server Code Execution Vulnerability 5.4%
• CVE-2025-55039 Medium 6.5 Apache Spark, Apache Spark: RPC encryption defaults to unauthenticated AES-CTR mode, enabling man-in-the-middle ciphertext modification attacks 0.2%
• CVE-2024-23945 Medium 5.9 Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails 1.6%
• CVE-2023-32007 High 8.8 Apache Spark: Shell command injection via Spark UI 76.0%
• CVE-2023-22946 Medium 6.4 Apache Spark proxy-user privilege escalation from malicious configuration class 1.1%
• CVE-2022-31777 Medium 5.4 Apache Spark XSS vulnerability in log viewer UI Javascript 1.8%
• CVE-2021-38296 Unrated Apache Spark Key Negotiation Vulnerability 1.8%
• CVE-2020-9480 Unrated In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication (spark.authenticate) via a shared secret. When enabled, however, a specially-craft 29.4%