Apache Spark UI - Cross-Site Scripting

Apache Spark UI before 2.3.2 is vulnerable to XSS via unsanitized query string parameters in the /jobs/ endpoint. id: CVE-2018-8024 info: name: Apache Spark UI - Cross-Site Scripting author: ritikchaddha severity: medium description: | Apache Spark UI before 2.3.2 is vulnerable to XSS via...

Apache Spark - Authentication Bypass

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication spark.authenticate via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even...

Apache Spark UI - Remote Command Injection

Apache Spark UI is susceptible to remote command injection. ACLs can be enabled via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilte...

CVE-2026-73508 vulnerabilities

Vulnerabilities for packages: apache-nifi, spark, strimzi-kafka-operator, management-api-for-apache-cassandra-5.0, apicurio-registry, thingsboard, celeborn, keycloak, apache-pulsar, akhq, druid, opensearch, tez, zipkin...

GO-2021-0066 vulnerabilities

Vulnerabilities for packages: spark-operator...

GO-2021-0064 vulnerabilities

Vulnerabilities for packages: newrelic-nri-statsd, gostatsd, kubeflow-pipelines, spark-operator...

GO-2024-2746 vulnerabilities

Vulnerabilities for packages: local-static-provisioner, ip-masq-agent, aws-efs-csi-driver, kubeflow-pipelines, kubernetes-csi-driver-hostpath, argocd-image-updater-fips, nodetaint, aws-efs-csi-driver-fips, spark-operator, kubernetes-dns-node-cache, kubernetes, argocd-image-updater,...

GO-2025-3521 vulnerabilities

Vulnerabilities for packages: longhorn-share-manager-fips, longhorn-share-manager, rke2-runtime-fips, spark-operator-fips, longhorn-manager, harvester-fips, longhorn-manager-fips, harvester, azure-container-networking, kubernetes, argo-cd-fips, vcluster...

GO-2023-2341 vulnerabilities

Vulnerabilities for packages: ip-masq-agent, aws-efs-csi-driver, nodetaint, aws-efs-csi-driver-fips, spark-operator, prometheus-adapter, kubernetes-dns-node-cache, aws-ebs-csi-driver...

GO-2025-3787 vulnerabilities

Vulnerabilities for packages: dataplaneapi-fips, amazon-cloudwatch-agent-operator-fips, atlantis, kyverno-policy-reporter-ui, aws-iam-authenticator-fips, filebrowser, ko-fips, trivy-fips, splunk-otel-collector, wolfictl, timestamp-authority, falcoctl, kube-bench, seaweedfs, opa, cloud-sql-proxy,...

GO-2021-0066 vulnerabilities

Vulnerabilities for packages: spark-operator...

GO-2021-0064 vulnerabilities

Vulnerabilities for packages: newrelic-nri-statsd, kubeflow-pipelines, gostatsd, spark-operator...

GO-2024-2994 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, local-static-provisioner, ip-masq-agent, aws-efs-csi-driver, spark-operator, k8s-device-plugin, kubeflow-pipelines, nodetaint, cri-tools, kubernetes-csi-driver-hostpath, kubernetes-dns-node-cache...

GO-2023-2341 vulnerabilities

Vulnerabilities for packages: prometheus-adapter, ip-masq-agent, aws-efs-csi-driver, spark-operator, nodetaint, kubernetes-dns-node-cache...

GO-2024-2746 vulnerabilities

Vulnerabilities for packages: argocd-image-updater, local-static-provisioner, ip-masq-agent, aws-efs-csi-driver, spark-operator, kubeflow-pipelines, nodetaint, kubernetes-csi-driver-hostpath, kubernetes, kubernetes-dns-node-cache...

GO-2025-3465 vulnerabilities

Vulnerabilities for packages: emissary, yunikorn-k8shim, argocd-image-updater, local-static-provisioner, kubernetes-csi-driver-nfs, rancher-webhook, ip-masq-agent, aws-efs-csi-driver, spark-operator, rancher-fleet, kapp, nodetaint, vcluster, argo-rollouts, kubernetes-csi-driver-hostpath,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: kots, sops, cloud-provider-azure, harbor, ingress-nginx-controller, net-kourier, litestream, aws-efs-csi-driver, crossplane-provider-family-azure, neuvector-scanner, rancher-helm, gitlab-runner, k9s, cass-operator, spqr, emissary, kubescape, argocd-image-updater,...

GO-2023-2153 vulnerabilities

Vulnerabilities for packages: kubescape, kubevela, spark-operator, k3d, buildkitd, aactl, slsa-verifier, src, terraform-provider-sendgrid, kubeflow, scorecard, cortex, up, dgraph...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: wave, sops, ingress-nginx-controller, thanos-operator, bom, gitleaks, mc, ip-masq-agent, litestream, nri-f5, x509-certificate-exporter, rancher-helm, nri-mongodb, gitlab-runner, cass-operator, spqr, vault-secrets-webhook, mesosphere-vsphere-csi,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: thanos-operator, bom, ip-masq-agent, nri-f5, kind, emissary, nri-apache, spire-controller-manager, kubernetes-dashboard, aws-otel-collector, oauth2-proxy, migrate, kubernetes-csi-driver-hostpath, kubernetes-dashboard-api, aws-application-networking-k8s, eksctl,...