Apache Software Foundation Apache Storm Nimbus

• CVE-2026-82427 High 7.8 Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name 0.2%
• CVE-2026-82433 Medium 6.5 Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Daemon Configuration via Nimbus and the UI 0.3%
• CVE-2026-82432 High 8.1 Apache Storm Nimbus: Blobstore Authorization Bypass via Rebalance Configuration Overrides 0.4%
• CVE-2026-82434 Medium 6.5 Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs 0.5%
• CVE-2026-82426 Medium 6.5 Apache Storm Nimbus: Arbitrary File Read on Nimbus via Unvalidated Uploaded Jar Location 0.4%
• CVE-2026-82441 Critical 9.1 Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys 0.3%
• CVE-2026-84179 Medium 6.5 Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page 0.4%