Apache Pinot < 1.3.0 - Authentication Bypass

This vulnerability allows remote attackers to bypass authentication on affected installations of Apache Pinot. Authentication is not required to exploit this vulnerability.The specific flaw exists within the AuthenticationFilter class. The issue results from insufficient neutralization of special...

CVE-2026-45300 vulnerabilities

Vulnerabilities for packages: apache-pulsar, druid, pinot-fips, pinot, tez, apache-pulsar-fips...

GHSA-FMXF-PM6P-7XGM vulnerabilities

Vulnerabilities for packages: apache-pulsar, druid, pinot-fips, pinot, tez, apache-pulsar-fips...

GHSA-JFG9-48MV-9QGX vulnerabilities

Vulnerabilities for packages: druid, apache-activemq-artemis, seata, hono, pinot, thingsboard, management-api-for-apache-cassandra-4.1, apache-hop, tez, management-api-for-apache-cassandra-4.0, trino, celeborn, apache-hop-fips, management-api-for-apache-cassandra-5.0...

CVE-2026-44248 vulnerabilities

Vulnerabilities for packages: druid, apache-activemq-artemis, seata, hono, pinot, thingsboard, management-api-for-apache-cassandra-4.1, apache-hop, tez, management-api-for-apache-cassandra-4.0, trino, celeborn, apache-hop-fips, management-api-for-apache-cassandra-5.0...

GHSA-RGRR-P7GP-5XJ7 vulnerabilities

Vulnerabilities for packages: druid, seata, thingsboard, pinot, management-api-for-apache-cassandra-4.1, apache-hop, tez, management-api-for-apache-cassandra-4.0, trino, celeborn, apache-hop-fips, management-api-for-apache-cassandra-5.0...

CVE-2026-42586 vulnerabilities

Vulnerabilities for packages: druid, seata, thingsboard, pinot, management-api-for-apache-cassandra-4.1, apache-hop, tez, management-api-for-apache-cassandra-4.0, trino, celeborn, apache-hop-fips, management-api-for-apache-cassandra-5.0...

GHSA-3PXV-7CMR-FJR4 vulnerabilities

Vulnerabilities for packages: druid, apache-activemq-artemis, pinot, ghidra, airflow, spark-fips, infinispan, celeborn, apache-pulsar-fips, apache-activemq, opensearch, tritonserver-backend-vllm-cuda-13.0, apache-pulsar, akhq, strimzi-kafka-operator, apache-hop, apache-jena-fuseki,...

CVE-2026-34480 vulnerabilities

Vulnerabilities for packages: druid, apache-activemq-artemis, pinot, ghidra, airflow, spark-fips, infinispan, celeborn, apache-pulsar-fips, apache-activemq, opensearch, tritonserver-backend-vllm-cuda-13.0, apache-pulsar, akhq, strimzi-kafka-operator, apache-hop, apache-jena-fuseki,...

GHSA-W9FJ-CFPG-GRVV vulnerabilities

Vulnerabilities for packages: keycloak, druid, pinot, kayenta-fips, spark-fips, flyway-fips, infinispan, localstack, apache-pulsar-fips, opensearch, management-api-for-apache-cassandra-5.0, kafbat-ui, apache-pulsar, apicurio-registry, akhq, seata, strimzi-kafka-operator, thingsboard,...

CVE-2026-33871 vulnerabilities

Vulnerabilities for packages: keycloak, druid, pinot, kayenta-fips, spark-fips, flyway-fips, infinispan, localstack, apache-pulsar-fips, opensearch, management-api-for-apache-cassandra-5.0, kafbat-ui, apache-pulsar, apicurio-registry, akhq, seata, strimzi-kafka-operator, thingsboard,...

CVE-2026-33870 vulnerabilities

Vulnerabilities for packages: keycloak, druid, apache-activemq-artemis, pinot, kayenta-fips, spark-fips, flyway-fips, infinispan, celeborn, localstack, apache-pulsar-fips, opensearch, management-api-for-apache-cassandra-5.0, kafbat-ui, apache-pulsar, apicurio-registry, akhq, seata,...

CVE-2025-33042 vulnerabilities

Vulnerabilities for packages: apache-pulsar, druid, akhq, kafbat-ui-fips, pinot, wavefront-proxy, spark, logstash, apache-hop, spark-fips, celeborn, apache-hop-fips, hadoop-fips, kafbat-ui...

GHSA-RP46-R563-JRC7 vulnerabilities

Vulnerabilities for packages: apache-pulsar, druid, akhq, kafbat-ui-fips, pinot, wavefront-proxy, spark, logstash, apache-hop, spark-fips, celeborn, apache-hop-fips, hadoop-fips, kafbat-ui...

CVE-2022-26112

In 0.10.0 or older versions of Apache Pinot, Pinot query endpoint and realtime ingestion layer has a vulnerability in unprotected environments due to a groovy function support. In order to avoid this, we disabled the groovy function support by default from Pinot release 0.11.0. See...

EUVD-2022-7272

Malicious code in bioql PyPI...

EUVD-2022-1594

Malicious code in bioql PyPI...

EUVD-2025-9317

Malicious code in bioql PyPI...

EUVD-2022-6919

Malicious code in bioql PyPI...

CVE-2024-39676

Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Pinot. This issue affects Apache Pinot: from 0.1 before 1.0.0. Users are recommended to upgrade to version 1.0.0 and configure RBAC, which fixes the issue. Details: When using a request to path “/appconfigs” to the...