1235 matches found
Hadoop-Yarn-ResourceManager-RCE
Vuln Impact There was an unauthorized access vulnerability in Hadoop yarn ResourceManager. This vulnerability existed in Hadoop yarn, the core component of Hadoop. Because Hadoop yarn opened the RPC service to the public by default, a remote attacker could take advantage of this unauthorized...
apache_kylin
Apache Kylin Codacy Badge Extreme OLAP Engine for Big Data Apache Kylin is an open source Distributed Analytics Engine, contributed by eBay Inc., provides SQL interface and multi-dimensional analysis OLAP on Hadoop supporting extremely large datasets. For more details, see the website...
Apache CarbonData 2.3.2 Index Server Java Deserialization
Apache CarbonData version 2.3.2 contains a Java deserialization vulnerability in the Distributed Index Server Hadoop IPC endpoint that may allow remote code execution when a suitable gadget class is available on the server classpath. !/usr/bin/env bash Apache CarbonData 2.3.2 Index Server Java...
com.hazelcast.jet:hazelcast-jet-core (4.5.4), com.hazelcast.jet:hazelcast-jet-hadoop-core (4.5.4) +24 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (4.2.6)
com.hazelcast:hazelcast MAVEN version 4.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast.jet:hazelcast-jet-core 4.5.4 - com.hazelcast.jet:hazelcast-jet-hadoop-core 4.5.4 -...
com.hazelcast.jet:hazelcast-jet-core (4.5.2), com.hazelcast.jet:hazelcast-jet-hadoop-core (4.5.2) +5 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (4.2.3)
com.hazelcast:hazelcast MAVEN version 4.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast.jet:hazelcast-jet-core 4.5.2 - com.hazelcast.jet:hazelcast-jet-hadoop-core 4.5.2 -...
com.hazelcast.jet:hazelcast-jet-core (4.5.4), com.hazelcast.jet:hazelcast-jet-hadoop-core (4.5.4) +24 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (4.2.6)
com.hazelcast:hazelcast MAVEN version 4.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast.jet:hazelcast-jet-core 4.5.4 - com.hazelcast.jet:hazelcast-jet-hadoop-core 4.5.4 -...
CVE-2026-106449 vulnerabilities
Vulnerabilities for packages: hadoop-fips, traccar-fips, kafka-fips, apicurio-registry-fips, datahub-frontend, knative-kafka-broker, nuxeo, thingsboard, kayenta, strimzi-kafka-operator, wazuh-indexer, seata, apache-hop-fips, kafbat-ui, apache-polaris-fips, apache-polaris, opensearch,...
GHSA-343H-94H5-C4WR vulnerabilities
Vulnerabilities for packages: hadoop-fips, traccar-fips, kafka-fips, apicurio-registry-fips, datahub-frontend, knative-kafka-broker, nuxeo, thingsboard, kayenta, strimzi-kafka-operator, wazuh-indexer, seata, apache-hop-fips, kafbat-ui, apache-polaris-fips, apache-polaris, opensearch,...
Hadoop-YARN-RCE
Unauthenticated RCE in Apache Hadoop YARN ResourceManager An unauthorized access vulnerability exists in Apache Hadoop YARN ResourceManager when its REST API default port 8088 or RPC ports are exposed without authentication enabled. By default, Hadoop leaves HTTP web consoles and RPC services...
CVE-2026-73334 Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation
Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps encrypts data keys via a Key Management Service KMS. On the reader side, the...
ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10), ai.catboost:catboost-spark_3.2_2.13 (>=1.0.6, <=1.2.10) +2451 more potentially affected by CVE-2026-73334 via org.apache.parquet:parquet-hadoop (>=1.12.0, <=1.18.0)
org.apache.parquet:parquet-hadoop MAVEN version =1.12.0, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =0.20.0, =0.21.0 and more Source cves: CVE-2026-73334 Source...
ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10), ai.catboost:catboost-spark_3.2_2.13 (>=1.0.6, <=1.2.10) +2451 more potentially affected by CVE-2026-73334 via org.apache.parquet:parquet-hadoop (>=1.12.0, <=1.18.0)
org.apache.parquet:parquet-hadoop MAVEN version =1.12.0, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =0.20.0, =0.21.0 and more Source cves: CVE-2026-73334 Source...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through FileKeyUnwrapper in parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/FileKeyUnwrapper.java. An attacker can make a reader send its KMS access token to an attacker-controlled host b...
CVE-2024-31573 vulnerabilities
Vulnerabilities for packages: hadoop-fips...
GHSA-668Q-QRV7-99FM vulnerabilities
Vulnerabilities for packages: hadoop-fips...
GHSA-CHFM-68VV-PVW5 vulnerabilities
Vulnerabilities for packages: hadoop-fips...
GHSA-P66X-2CV9-QQ3V vulnerabilities
Vulnerabilities for packages: hadoop-fips...
GHSA-VMFG-RJJM-RJRJ vulnerabilities
Vulnerabilities for packages: hadoop-fips...