org.apache.dolphinscheduler:dolphinscheduler-dist (>=3.3.2, <=3.4.0), org.apache.dolphinscheduler:dolphinscheduler-standalone-server (>=3.0.0-alpha, <=3.0.6) potentially affected by CVE-2026-23902 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.0.0-alpha, <=3.4.0)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.0.0-alpha, =3.3.2, =3.0.0-alpha, =3.0.6 Source cves: CVE-2026-23902 Source advisory: SNYK:JAVA-ORGAPACHEDOLPHINSCHEDULER-16431736...

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0, <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-dist (>=2.0.0-alpha, <=3.4.0) +2 more potentially affected by CVE-2026-23902 via org.apache.dolphinscheduler:dolphinscheduler-api (>=1.3.9, <=3.4.0)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =1.3.9, =1.1.0, =2.0.0-alpha, =2.0.2, =1.3.9, =3.0.6 Source cves: CVE-2026-23902 Source advisory: MEND:CVE-2026-23902...

org.apache.dolphinscheduler:dolphinscheduler-standalone-server (>=3.0.0, <=3.0.1) potentially affected by CVE-2025-62188 via org.apache.dolphinscheduler:dolphinscheduler-api (>=3.0.0, <=3.0.1)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version =3.0.0, =3.0.0, =3.0.1 Source cves: CVE-2025-62188 Source advisory: MEND:CVE-2025-62188...

Improper Input Validation

Overview Affected versions of this package are vulnerable to Improper Input Validation via the resource file handling mechanism. An attacker can use resource API to access and modify all files in the machine even if they are not under resource path. Remediation Upgrade...

org.apache.dolphinscheduler:dolphinscheduler-alert (1.3.5), org.apache.dolphinscheduler:dolphinscheduler-api (1.3.5) +4 more potentially affected by CVE-2023-49620 via org.apache.dolphinscheduler:dolphinscheduler-common (1.3.5)

org.apache.dolphinscheduler:dolphinscheduler-common MAVEN version 1.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-common and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-alert 1.3.5 ...

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0, <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-alert (1.3.9) +7 more potentially affected by CVE-2023-49620 via org.apache.dolphinscheduler:dolphinscheduler-common (1.3.9)

org.apache.dolphinscheduler:dolphinscheduler-common MAVEN version 1.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-common and may be impacted: - com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics...

org.apache.dolphinscheduler:dolphinscheduler-alert (2.0.0-alpha), org.apache.dolphinscheduler:dolphinscheduler-api (2.0.0-alpha) +6 more potentially affected by CVE-2023-49620 via org.apache.dolphinscheduler:dolphinscheduler-common (2.0.0-alpha)

org.apache.dolphinscheduler:dolphinscheduler-common MAVEN version 2.0.0-alpha is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-common and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-alert...

org.apache.dolphinscheduler:dolphinscheduler-alert-server (2.0.3), org.apache.dolphinscheduler:dolphinscheduler-api (2.0.3) +7 more potentially affected by CVE-2023-49620 via org.apache.dolphinscheduler:dolphinscheduler-common (2.0.3)

org.apache.dolphinscheduler:dolphinscheduler-common MAVEN version 2.0.3 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-common and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-alert-server...

org.apache.dolphinscheduler:dolphinscheduler-alert-server (2.0.9), org.apache.dolphinscheduler:dolphinscheduler-api (2.0.9) +7 more potentially affected by CVE-2023-49620 via org.apache.dolphinscheduler:dolphinscheduler-common (2.0.9)

org.apache.dolphinscheduler:dolphinscheduler-common MAVEN version 2.0.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-common and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-alert-server...

org.apache.dolphinscheduler:dolphinscheduler-alert (1.3.7), org.apache.dolphinscheduler:dolphinscheduler-api (1.3.7) +3 more potentially affected by CVE-2023-49620 via org.apache.dolphinscheduler:dolphinscheduler-dao (1.3.7)

org.apache.dolphinscheduler:dolphinscheduler-dao MAVEN version 1.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-dao and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-alert 1.3.7 -...

org.apache.dolphinscheduler:dolphinscheduler-api (1.3.0), org.apache.dolphinscheduler:dolphinscheduler-server (1.3.0) potentially affected by CVE-2023-49620 via org.apache.dolphinscheduler:dolphinscheduler-service (1.3.0)

org.apache.dolphinscheduler:dolphinscheduler-service MAVEN version 1.3.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-service and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-api 1.3.0 ...

org.apache.dolphinscheduler:dolphinscheduler-api (1.3.4), org.apache.dolphinscheduler:dolphinscheduler-server (1.3.4) potentially affected by CVE-2023-49620 via org.apache.dolphinscheduler:dolphinscheduler-service (1.3.4)

org.apache.dolphinscheduler:dolphinscheduler-service MAVEN version 1.3.4 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-service and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-api 1.3.4 ...

org.apache.dolphinscheduler:dolphinscheduler-api (1.3.5), org.apache.dolphinscheduler:dolphinscheduler-server (1.3.5) potentially affected by CVE-2023-49620 via org.apache.dolphinscheduler:dolphinscheduler-service (1.3.5)

org.apache.dolphinscheduler:dolphinscheduler-service MAVEN version 1.3.5 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-service and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-api 1.3.5 ...

org.apache.dolphinscheduler:dolphinscheduler-api (1.3.7), org.apache.dolphinscheduler:dolphinscheduler-server (1.3.7) +1 more potentially affected by CVE-2023-49620 via org.apache.dolphinscheduler:dolphinscheduler-service (1.3.7)

org.apache.dolphinscheduler:dolphinscheduler-service MAVEN version 1.3.7 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-service and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-api 1.3.7 ...

org.apache.dolphinscheduler:dolphinscheduler-api (2.0.2), org.apache.dolphinscheduler:dolphinscheduler-dist (2.0.2) +3 more potentially affected by CVE-2023-49620 via org.apache.dolphinscheduler:dolphinscheduler-service (2.0.2)

org.apache.dolphinscheduler:dolphinscheduler-service MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-service and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-api 2.0.2 ...

org.apache.dolphinscheduler:dolphinscheduler-api (1.3.1), org.apache.dolphinscheduler:dolphinscheduler-server (1.3.1) potentially affected by CVE-2023-49620 via org.apache.dolphinscheduler:dolphinscheduler-service (1.3.1)

org.apache.dolphinscheduler:dolphinscheduler-service MAVEN version 1.3.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-service and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-api 1.3.1 ...

org.apache.dolphinscheduler:dolphinscheduler-api (1.3.2), org.apache.dolphinscheduler:dolphinscheduler-server (1.3.2) potentially affected by CVE-2023-49620 via org.apache.dolphinscheduler:dolphinscheduler-service (1.3.2)

org.apache.dolphinscheduler:dolphinscheduler-service MAVEN version 1.3.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-service and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-api 1.3.2 ...

com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics (>=1.1.0, <=1.2.2), org.apache.dolphinscheduler:dolphinscheduler-standalone-server (1.3.9) potentially affected by CVE-2023-49620 via org.apache.dolphinscheduler:dolphinscheduler-api (1.3.9)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version 1.3.9 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-api and may be impacted: - com.webank.wedatasphere.dss:dolphinscheduler-prod-metrics =1.1....

org.apache.dolphinscheduler:dolphinscheduler-dist (2.0.1), org.apache.dolphinscheduler:dolphinscheduler-standalone-server (2.0.1) potentially affected by CVE-2023-49620 via org.apache.dolphinscheduler:dolphinscheduler-api (2.0.1)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version 2.0.1 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-api and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-dist 2.0.1 -...

org.apache.dolphinscheduler:dolphinscheduler-dist (2.0.2), org.apache.dolphinscheduler:dolphinscheduler-python (2.0.2) +1 more potentially affected by CVE-2023-49620 via org.apache.dolphinscheduler:dolphinscheduler-api (2.0.2)

org.apache.dolphinscheduler:dolphinscheduler-api MAVEN version 2.0.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.dolphinscheduler:dolphinscheduler-api and may be impacted: - org.apache.dolphinscheduler:dolphinscheduler-dist 2.0.2 -...