1242 matches found
Hadoop-Yarn-ResourceManager-RCE
Vuln Impact There was an unauthorized access vulnerability in Hadoop yarn ResourceManager. This vulnerability existed in Hadoop yarn, the core component of Hadoop. Because Hadoop yarn opened the RPC service to the public by default, a remote attacker could take advantage of this unauthorized...
apache_kylin
Apache Kylin Codacy Badge Extreme OLAP Engine for Big Data Apache Kylin is an open source Distributed Analytics Engine, contributed by eBay Inc., provides SQL interface and multi-dimensional analysis OLAP on Hadoop supporting extremely large datasets. For more details, see the website...
GHSA-4X29-79GH-6V8Q vulnerabilities
Vulnerabilities for packages: nuxeo, hadoop-fips...
CVE-2026-53434 vulnerabilities
Vulnerabilities for packages: nuxeo, hadoop-fips...
Apache CarbonData 2.3.2 Index Server Java Deserialization
Apache CarbonData version 2.3.2 contains a Java deserialization vulnerability in the Distributed Index Server Hadoop IPC endpoint that may allow remote code execution when a suitable gadget class is available on the server classpath. !/usr/bin/env bash Apache CarbonData 2.3.2 Index Server Java...
Apache CarbonData 2.3.2 Index Server Java Deserialization
Summary Apache CarbonData is an open-source, indexed columnar data storage format and database management system designed for fast interactive analytics on petabyte-scale big data platforms like Apache Hadoop and Apache Spark. Description Apache CarbonData suffer from a Java deserialization...
ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10), ai.catboost:catboost-spark_3.2_2.13 (>=1.0.6, <=1.2.10) +5574 more potentially affected by CVE-2026-76184 via org.eclipse.jetty:jetty-client (>=9.4.0.m0, <=9.4.58.v20250814)
org.eclipse.jetty:jetty-client MAVEN version =9.4.0.m0, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =0.13.0, =0.17.0, =0.15.0, =0.1.9, =0.1.9, =3.46.0.12 and more Source cves: CVE-2026-76184 Source advisory: SNYK:JAVA-ORGECLIPSEJETTY-21243510...
ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10), ai.catboost:catboost-spark_3.2_2.13 (>=1.0.6, <=1.2.10) +7670 more potentially affected by CVE-2026-19864 via org.eclipse.jetty:jetty-security (>=9.4.0.v20161208, <=9.4.58.v20250814)
org.eclipse.jetty:jetty-security MAVEN version =9.4.0.v20161208, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =0.13.0, =0.1.7, =0.1.7, =0.17.0, =0.15.0, =0.16.0 and more Source cves: CVE-2026-19864 Source advisory: MEND:CVE-2026-19864...
com.hazelcast.jet:hazelcast-jet-core (4.5.2), com.hazelcast.jet:hazelcast-jet-hadoop-core (4.5.2) +5 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (4.2.3)
com.hazelcast:hazelcast MAVEN version 4.2.3 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast.jet:hazelcast-jet-core 4.5.2 - com.hazelcast.jet:hazelcast-jet-hadoop-core 4.5.2 -...
com.hazelcast.jet:hazelcast-jet-core (4.5.4), com.hazelcast.jet:hazelcast-jet-hadoop-core (4.5.4) +24 more potentially affected by CVE-2026-107726 via com.hazelcast:hazelcast (4.2.6)
com.hazelcast:hazelcast MAVEN version 4.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast.jet:hazelcast-jet-core 4.5.4 - com.hazelcast.jet:hazelcast-jet-hadoop-core 4.5.4 -...
com.hazelcast.jet:hazelcast-jet-core (4.5.4), com.hazelcast.jet:hazelcast-jet-hadoop-core (4.5.4) +24 more potentially affected by CVE-2026-107725 via com.hazelcast:hazelcast (4.2.6)
com.hazelcast:hazelcast MAVEN version 4.2.6 is affected by a known vulnerability. The following packages have a transitive dependency on com.hazelcast:hazelcast and may be impacted: - com.hazelcast.jet:hazelcast-jet-core 4.5.4 - com.hazelcast.jet:hazelcast-jet-hadoop-core 4.5.4 -...
CVE-2026-106449 vulnerabilities
Vulnerabilities for packages: opensearch, knative-kafka-broker-fips, apache-nifi, akhq, seata, kayenta-fips, apache-hop-fips, pinot, knative-kafka-broker, spark, spark-fips, wazuh-indexer, kafka, solr-fips, hono, dd-trace-java, flink-kubernetes-operator-fips, apache-polaris-fips,...
GHSA-343H-94H5-C4WR vulnerabilities
Vulnerabilities for packages: opensearch, knative-kafka-broker-fips, apache-nifi, akhq, seata, kayenta-fips, apache-hop-fips, pinot, knative-kafka-broker, spark, spark-fips, wazuh-indexer, kafka, solr-fips, hono, dd-trace-java, flink-kubernetes-operator-fips, apache-polaris-fips,...
Hadoop-YARN-RCE
Unauthenticated RCE in Apache Hadoop YARN ResourceManager An unauthorized access vulnerability exists in Apache Hadoop YARN ResourceManager when its REST API default port 8088 or RPC ports are exposed without authentication enabled. By default, Hadoop leaves HTTP web consoles and RPC services...
CVE-2026-73334 Apache Parquet Hadoop: File-controlled KMS URL is forwarded to pluggable KmsClient that skips host validation
Potential problem for users of the org.apache.parquet.crypto.keytools package in Apache Parquet, versions 1.12 to 1.18. This package enables users to encrypt Parquet files via an envelope encryption mechanism that wraps encrypts data keys via a Key Management Service KMS. On the reader side, the...
ai.h2o:h2o-orc-parser (>=3.10.0.5, <=3.10.3.6), co.cask.hydrator:hive-plugins (1.2.0) +76 more potentially affected by CVE-2026-73334 via org.apache.parquet:parquet-hadoop-bundle (>=1.12.2, <=1.17.1)
org.apache.parquet:parquet-hadoop-bundle MAVEN version =1.12.2, =3.10.0.5, =1.0.9, =0.1.1, =0.2.7, =4.1.4, =4.1.4, =6.0.0, =6.0.0, =2.7.0, =2.8.0 and more Source cves: CVE-2026-73334 Source advisory: MEND:CVE-2026-73334...
ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10), ai.catboost:catboost-spark_3.2_2.13 (>=1.0.6, <=1.2.10) +2472 more potentially affected by CVE-2026-73334 via org.apache.parquet:parquet-hadoop (>=1.12.0, <=1.18.0)
org.apache.parquet:parquet-hadoop MAVEN version =1.12.0, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =0.20.0, =0.21.0 and more Source cves: CVE-2026-73334 Source...
ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10), ai.catboost:catboost-spark_3.2_2.13 (>=1.0.6, <=1.2.10) +2472 more potentially affected by CVE-2026-73334 via org.apache.parquet:parquet-hadoop (>=1.12.0, <=1.18.0)
org.apache.parquet:parquet-hadoop MAVEN version =1.12.0, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =chaining-0.0.46-dev, =def544ccef5f753238ecc4adfc2eaa7d2fc36d53-0.0.91, =0.20.0, =0.21.0 and more Source cves: CVE-2026-73334 Source...
Server-side Request Forgery (SSRF)
Overview Affected versions of this package are vulnerable to Server-side Request Forgery SSRF through FileKeyUnwrapper in parquet-hadoop/src/main/java/org/apache/parquet/crypto/keytools/FileKeyUnwrapper.java. An attacker can make a reader send its KMS access token to an attacker-controlled host b...