Apache Software Foundation Apache Zeppelin

CVE-2026-44615 Medium 6.5 Path traversal in NotebookRepo note and folder path composition 0.8%
CVE-2026-44617 Medium 6.5 Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867 0.8%
CVE-2026-44616 Medium 6.5 Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction 0.8%
CVE-2026-44613 Medium 6.1 Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling 0.4%
CVE-2024-51775 High 7.5 Apache Zeppelin: Command Injection via CSWSH 0.3%
CVE-2024-41177 Medium 6.1 Apache Zeppelin: XSS in the Helium module 0.7%
CVE-2024-52279 High 7.5 Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string 1.1%
CVE-2024-41169 High 7.5 Apache Zeppelin: raft directory listing and file read 0.7%
CVE-2024-31867 Medium 6.5 Apache Zeppelin: LDAP search filter query Injection Vulnerability 1.2%
CVE-2024-31868 Medium 6.1 Apache Zeppelin: XSS vulnerability in the helium module 1.3%
CVE-2024-31866 Critical 9.8 Apache Zeppelin: Interpreter download command does not escape malicious code injection 1.6%
CVE-2024-31865 Medium 6.5 Apache Zeppelin: Cron arbitrary user impersonation with improper privileges 1.7%
CVE-2024-31864 Critical 9.8 Apache Zeppelin: Remote code execution by adding malicious JDBC connection string 1.3%
CVE-2024-31863 Medium 5.3 Apache Zeppelin: Replacing other users notebook, bypassing any permissions 1.0%
CVE-2024-31862 Medium 5.3 Apache Zeppelin: Denial of service with invalid notebook name 1.4%
CVE-2021-28656 Medium 5.4 Apache Zeppelin: CSRF vulnerability in the Credentials page 0.5%
CVE-2024-31860 Medium 6.5 Apache Zeppelin: Path traversal vulnerability 1.4%
CVE-2022-46870 Medium 5.4 Apache Zeppelin: Stored XSS in note permissions 1.2%
CVE-2021-28655 Medium 6.5 Apache Zeppelin: Arbitrary file deletion vulnerability 1.6%
CVE-2020-13929 Unrated Notebook permissions bypass 3.3%
CVE-2021-27578 Unrated Cross Site Scripting in markdown interpreter 3.2%