GHSA-M452-Q8C9-RG2F vulnerabilities

Vulnerabilities for packages: pinot, tez, pinot-fips, apache-pulsar-fips, druid, apache-pulsar...

CVE-2026-55688 vulnerabilities

Vulnerabilities for packages: pinot, tez, pinot-fips, apache-pulsar-fips, druid, apache-pulsar...

GHSA-P9JM-Q85P-7MCP vulnerabilities

Vulnerabilities for packages: hadoop-fips, tinkerpop, pinot...

CVE-2026-56818 vulnerabilities

Vulnerabilities for packages: hadoop-fips, tinkerpop, pinot...

Apache Pinot - Exposure Detection

Detects if path Appconfigs of Apache Pinot web application is exposed, getting internal information about the configuration made. !/usr/bin/env python3 -- coding: utf-8 -- """Detects if path Appconfigs of Apache Pinot web application is exposed, getting internal information about the .""" from...

Apache Pinot - Detect

Detects a Apache Pinot web application, A realtime distributed OLAP datastore. !/usr/bin/env python3 -- coding: utf-8 -- """Detects a Apache Pinot web application, A realtime distributed OLAP datastore.""" from kittysploit import from lib.protocols.http.httpclient import Httpclient class...

Apache Pinot < 1.3.0 - Authentication Bypass Detection

This vulnerability allows remote attackers to bypass authentication on affected installations of Apache Pinot. Authentication is not required to exploit this vulnerability.The specific flaw exists within the AuthenticationFilter class. The issue results from insufficient neutralization of special...

CVE-2026-56820 vulnerabilities

Vulnerabilities for packages: hadoop-fips, cassandra, management-api-for-apache-cassandra-5.0, pinot, tez, seata, thingsboard, pinot-fips, cassandra-fips, apache-hop, tinkerpop, apache-hop-fips...

CVE-2026-56821 vulnerabilities

Vulnerabilities for packages: hadoop-fips, cassandra, management-api-for-apache-cassandra-5.0, pinot, tez, seata, thingsboard, pinot-fips, cassandra-fips, apache-hop, tinkerpop, apache-hop-fips...

GHSA-272M-GCWP-MPWG vulnerabilities

Vulnerabilities for packages: hadoop-fips, cassandra, management-api-for-apache-cassandra-5.0, pinot, tez, seata, thingsboard, pinot-fips, cassandra-fips, apache-hop, tinkerpop, apache-hop-fips...

CVE-2026-56822 vulnerabilities

Vulnerabilities for packages: hadoop-fips, cassandra, management-api-for-apache-cassandra-5.0, pinot, tez, seata, thingsboard, pinot-fips, cassandra-fips, apache-hop, tinkerpop, apache-hop-fips...

GHSA-G7HG-VRCF-MVMR vulnerabilities

Vulnerabilities for packages: hadoop-fips, cassandra, management-api-for-apache-cassandra-5.0, pinot, tez, seata, thingsboard, pinot-fips, cassandra-fips, apache-hop, tinkerpop, apache-hop-fips...

GHSA-WC96-39FC-566F vulnerabilities

Vulnerabilities for packages: hadoop-fips, cassandra, management-api-for-apache-cassandra-5.0, pinot, tez, seata, thingsboard, pinot-fips, cassandra-fips, apache-hop, tinkerpop, apache-hop-fips...

CVE-2026-56740 vulnerabilities

Vulnerabilities for packages: hadoop-fips, kafka-fips, kafka, apache-pulsar-fips, spark-kubernetes-operator-fips, spark-fips, apache-hop-fips, apache-camel-karavan-devmode, hadoop-client-modules, pinot, spark-kubernetes-operator, tez, ranger, spark, apache-nifi, zookeeper, pinot-fips, scala,...

CVE-2026-56741 vulnerabilities

Vulnerabilities for packages: hadoop-fips, kafka-fips, kafka, apache-pulsar-fips, spark-kubernetes-operator-fips, spark-fips, apache-hop-fips, apache-camel-karavan-devmode, hadoop-client-modules, pinot, spark-kubernetes-operator, tez, ranger, spark, apache-nifi, zookeeper, pinot-fips, scala,...

CVE-2026-44891 vulnerabilities

Vulnerabilities for packages: hadoop-fips, management-api-for-apache-cassandra-5.0, pinot, celeborn, tez, seata, management-api-for-apache-cassandra-4.0, thingsboard, pinot-fips, trino, apache-hop, tinkerpop, apache-hop-fips, management-api-for-apache-cassandra-4.1...

GHSA-VHCH-2WF3-M8RP vulnerabilities

Vulnerabilities for packages: hadoop-fips, management-api-for-apache-cassandra-5.0, pinot, celeborn, tez, seata, management-api-for-apache-cassandra-4.0, thingsboard, pinot-fips, trino, apache-hop, tinkerpop, apache-hop-fips, management-api-for-apache-cassandra-4.1...

PYSEC-2026-410 mcp-pinot: Unauthenticated tool invocation via default oauth_enabled=False + host 0.0.0.0 bind

Resolution Fixed in v3.1.0, released 2026-05-25. The fix was merged in PR 95 at commit 1c7d3f9. The fix changes the default HTTP bind host to 127.0.0.1, refuses non-loopback HTTP/HTTPS exposure unless OAuth is enabled, makes Helm exposure opt-in and OAuth-gated, and adds parser-backed...

OS Command Injection in Apache Airflow

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Apache Airfl...

PYSEC-2026-267 OS Command Injection in Apache Airflow

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Apache Airfl...