CVE-2026-44248 vulnerabilities

Vulnerabilities for packages: hadoop-fips, hono, management-api-for-apache-cassandra-5.0, apache-activemq-artemis, pinot, tinkerpop, celeborn, tez, seata, management-api-for-apache-cassandra-4.0, thingsboard, pinot-fips, trino, apache-hop, druid, apache-hop-fips,...

GHSA-JFG9-48MV-9QGX vulnerabilities

Vulnerabilities for packages: hadoop-fips, hono, management-api-for-apache-cassandra-5.0, apache-activemq-artemis, pinot, tinkerpop, celeborn, tez, seata, management-api-for-apache-cassandra-4.0, thingsboard, pinot-fips, trino, apache-hop, druid, apache-hop-fips,...

CVE-2026-42586 vulnerabilities

Vulnerabilities for packages: hadoop-fips, management-api-for-apache-cassandra-5.0, tinkerpop, pinot, celeborn, tez, seata, management-api-for-apache-cassandra-4.0, thingsboard, pinot-fips, trino, apache-hop, druid, apache-hop-fips, management-api-for-apache-cassandra-4.1...

GHSA-RGRR-P7GP-5XJ7 vulnerabilities

Vulnerabilities for packages: hadoop-fips, management-api-for-apache-cassandra-5.0, tinkerpop, pinot, celeborn, tez, seata, management-api-for-apache-cassandra-4.0, thingsboard, pinot-fips, trino, apache-hop, druid, apache-hop-fips, management-api-for-apache-cassandra-4.1...

CVE-2026-34480 vulnerabilities

Vulnerabilities for packages: hadoop-fips, apache-tika, kafka-fips, kafka, apache-pulsar-fips, spark-kubernetes-operator-fips, spark-fips, flink, apache-hop-fips, commercial-elasticsearch, camunda-zeebe, wavefront-proxy, zipkin, apache-camel-karavan-devmode, geoserver, apache-activemq-artemis,...

GHSA-3PXV-7CMR-FJR4 vulnerabilities

Vulnerabilities for packages: hadoop-fips, apache-tika, kafka-fips, kafka, apache-pulsar-fips, spark-kubernetes-operator-fips, spark-fips, flink, apache-hop-fips, commercial-elasticsearch, camunda-zeebe, wavefront-proxy, zipkin, apache-camel-karavan-devmode, geoserver, apache-activemq-artemis,...

CVE-2026-33871 vulnerabilities

Vulnerabilities for packages: hadoop-fips, tinkerpop, apicurio-registry, knative-kafka-broker-fips, thingsboard, keycloak, apache-pulsar-fips, kayenta-fips, spark-fips, apache-hop-fips, commercial-elasticsearch, camunda-zeebe, wavefront-proxy, zipkin, keycloak-fips, apache-camel-karavan-devmode,...

GHSA-W9FJ-CFPG-GRVV vulnerabilities

Vulnerabilities for packages: hadoop-fips, tinkerpop, apicurio-registry, knative-kafka-broker-fips, thingsboard, keycloak, apache-pulsar-fips, kayenta-fips, spark-fips, apache-hop-fips, commercial-elasticsearch, camunda-zeebe, wavefront-proxy, zipkin, keycloak-fips, apache-camel-karavan-devmode,...

CVE-2026-33870 vulnerabilities

Vulnerabilities for packages: hadoop-fips, tinkerpop, apicurio-registry, knative-kafka-broker-fips, thingsboard, keycloak, apache-pulsar-fips, kayenta-fips, spark-fips, commercial-elasticsearch, camunda-zeebe, wavefront-proxy, zipkin, keycloak-fips, apache-camel-karavan-devmode,...

GHSA-RP46-R563-JRC7 vulnerabilities

Vulnerabilities for packages: hadoop-fips, pinot, celeborn, kafbat-ui-fips, spark, akhq, kafbat-ui, apache-hop, druid, apache-hop-fips, wavefront-proxy, spark-fips, logstash...

CVE-2025-33042 vulnerabilities

Vulnerabilities for packages: hadoop-fips, pinot, celeborn, kafbat-ui-fips, spark, akhq, kafbat-ui, apache-hop, druid, apache-hop-fips, wavefront-proxy, spark-fips, logstash...

CVE-2022-26112

In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See...

EUVD-2022-1594

Malicious code in bioql PyPI...

EUVD-2022-6919

Malicious code in bioql PyPI...

EUVD-2022-7272

Malicious code in bioql PyPI...

EUVD-2025-9317

Malicious code in bioql PyPI...

CVE-2024-39676

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Pinot. This issue affects Apache Pinot: from 0.1 before 1.0.0. Users are recommended to upgrade to version 1.0.0 and configure RBAC, which fixes the issue. Details: When using a request to path “/appconfigs” to the...

CVE-2022-38649

Improper Neutralization of Special Elements used in an OS Command 'OS Command Injection' vulnerability in Apache Airflow Pinot Provider, Apache Airflow allows an attacker to control commands executed in the task execution context, without write access to DAG files. This issue affects Apache Airfl...

CVE-2022-23974

In 0.9.3 or older versions of Apache Pinot segment upload path allowed segment directories to be imported into pinot tables. In pinot installations that allow open access to the controller a specially crafted request can potentially be exploited to cause disruption in pinot service. Pinot release...

Apache Pinot Path Traversal Disclosure

The vulnerability of the Apache Pinot OLAP data store is related to incorrect restrictions on the path name to the restricted catalog. Exploiting this vulnerability could allow an attacker, operating remotely, to expose protected information by sending a specially crafted GET request...