org.apache.iotdb:customize-mqtt-example (>=1.0.0, <=2.0.1-beta), org.apache.iotdb:influxdb-protocol (>=1.0.0, <=1.1.2) +13 more potentially affected by CVE-2026-28564 via org.apache.iotdb:iotdb-server (>=1.0.0, <=2.0.8)

org.apache.iotdb:iotdb-server MAVEN version =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.3.3, =1.0.0, =1.0.0, =1.3.3, =1.3.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.0.0, =1.3.3 Source cves: CVE-2026-28564 Source advisory: SNYK:JAVA-ORGAPACHEIOTDB-18021390...

Insufficient Session Expiration

Overview org.apache.iotdb:iotdb-server is a data management system for time series data, which can provide users specific services, such as, data collection, storage and analysis. Affected versions of this package are vulnerable to Insufficient Session Expiration in the AuthorizationFilter of the...

org.apache.iotdb:iotdb-cli (2.0.8), org.apache.iotdb:iotdb-confignode (2.0.8) +3 more potentially affected by CVE-2026-40009 via org.apache.iotdb:iotdb-server (2.0.8)

org.apache.iotdb:iotdb-server MAVEN version 2.0.8 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.iotdb:iotdb-server and may be impacted: - org.apache.iotdb:iotdb-cli 2.0.8 - org.apache.iotdb:iotdb-confignode 2.0.8 -...

org.apache.iotdb:customize-mqtt-example (>=1.3.2, <=2.0.1-beta), org.apache.iotdb:integration-test (>=1.3.3, <=2.0.1-beta) +7 more potentially affected by CVE-2026-40006 via org.apache.iotdb:iotdb-server (>=1.3.2, <=2.0.8)

org.apache.iotdb:iotdb-server MAVEN version =1.3.2, =1.3.2, =1.3.3, =1.3.2, =1.3.2, =1.3.3, =1.3.2, =1.3.2, =1.3.2, =1.3.3 Source cves: CVE-2026-40006 Source advisory: MEND:CVE-2026-40006...

User Impersonation

Overview org.apache.iotdb:iotdb-server is a data management system for time series data, which can provide users specific services, such as, data collection, storage and analysis. Affected versions of this package are vulnerable to User Impersonation in certain Thrift RPC query handlers, which do...

org.apache.iotdb:customize-mqtt-example (>=1.3.3, <=2.0.1-beta), org.apache.iotdb:integration-test (>=1.3.3, <=2.0.1-beta) +6 more potentially affected by CVE-2026-24013 via org.apache.iotdb:iotdb-server (>=1.3.3, <=2.0.1-beta)

org.apache.iotdb:iotdb-server MAVEN version =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =2.0.1-beta - org.apache.iotdb:udf-example 1.3.3 Source cves: CVE-2026-24013 Source advisory: SNYK:JAVA-ORGAPACHEIOTDB-17874247...

org.apache.iotdb:customize-mqtt-example (>=1.3.3, <=2.0.1-beta), org.apache.iotdb:integration-test (>=1.3.3, <=2.0.1-beta) +6 more potentially affected by CVE-2026-24014 via org.apache.iotdb:iotdb-server (>=1.3.3, <=2.0.1-beta)

org.apache.iotdb:iotdb-server MAVEN version =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =2.0.1-beta - org.apache.iotdb:udf-example 1.3.3 Source cves: CVE-2026-24014 Source advisory: SNYK:JAVA-ORGAPACHEIOTDB-17822329...

org.apache.iotdb:customize-mqtt-example (>=1.3.3, <=2.0.1-beta), org.apache.iotdb:integration-test (>=1.3.3, <=2.0.1-beta) +6 more potentially affected by CVE-2026-24013 via org.apache.iotdb:iotdb-server (>=1.3.3, <=2.0.1-beta)

org.apache.iotdb:iotdb-server MAVEN version =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =2.0.1-beta - org.apache.iotdb:udf-example 1.3.3 Source cves: CVE-2026-24013 Source advisory: MEND:CVE-2026-24013...

org.apache.iotdb:customize-mqtt-example (>=1.3.3, <=2.0.1-beta), org.apache.iotdb:integration-test (>=1.3.3, <=2.0.1-beta) +6 more potentially affected by CVE-2026-24014 via org.apache.iotdb:iotdb-server (>=1.3.3, <=2.0.1-beta)

org.apache.iotdb:iotdb-server MAVEN version =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =1.3.3, =2.0.1-beta - org.apache.iotdb:udf-example 1.3.3 Source cves: CVE-2026-24014 Source advisory: MEND:CVE-2026-24014...

Binding to an Unrestricted IP Address

Overview org.apache.iotdb:iotdb-server is a data management system for time series data, which can provide users specific services, such as, data collection, storage and analysis. Affected versions of this package are vulnerable to Binding to an Unrestricted IP Address in the default configuratio...

Arbitrary Code Injection

Overview org.apache.iotdb:iotdb-server is a data management system for time series data, which can provide users specific services, such as, data collection, storage and analysis. Affected versions of this package are vulnerable to Arbitrary Code Injection through the registration of user-defined...

Insertion of Sensitive Information into Log File

Overview org.apache.iotdb:iotdb-server is a data management system for time series data, which can provide users specific services, such as, data collection, storage and analysis. Affected versions of this package are vulnerable to Insertion of Sensitive Information into Log File. An attacker can...

Improper Authentication

org.apache.iotdb:iotdb-server is vulnerable to Improper Authentication. A remote attacker is able to bypass authorization due to improper checks in the onConnect function of PublishHandler.java...

org.apache.iotdb:customize-mqtt-example (>=0.13.0, <=0.13.2), org.apache.iotdb:integration (>=0.13.0, <=0.13.2) +5 more potentially affected by CVE-2022-43766 via org.apache.iotdb:iotdb-server (>=0.12.2, <=0.13.2)

org.apache.iotdb:iotdb-server MAVEN version =0.12.2, =0.13.0, =0.13.0, =0.12.2, =0.12.2, =0.12.6, =0.13.0, =0.12.2, =0.13.2 Source cves: CVE-2022-43766 Source advisory: GHSA-G6HG-4V3C-6JQ7...

Remote Code Execution

iotdb-server is vulnerable to remote code execution. The JMX port 31999 is exposed and allows an unauthenticated attacker to access and execute code on the system...