Apache Spark UI - Cross-Site Scripting

Apache Spark UI before 2.3.2 is vulnerable to XSS via unsanitized query string parameters in the /jobs/ endpoint. id: CVE-2018-8024 info: name: Apache Spark UI - Cross-Site Scripting author: ritikchaddha severity: medium description: | Apache Spark UI before 2.3.2 is vulnerable to XSS via...

Apache Spark - Authentication Bypass

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication spark.authenticate via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even...

Apache Spark UI - Remote Command Injection

Apache Spark UI is susceptible to remote command injection. ACLs can be enabled via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilte...

CVE-2026-73508 vulnerabilities

Vulnerabilities for packages: celeborn, thingsboard, opensearch, apicurio-registry, druid, spark, tez, management-api-for-apache-cassandra-5.0, strimzi-kafka-operator, apache-pulsar, zipkin, akhq, keycloak, apache-nifi...

GO-2021-0066 vulnerabilities

Vulnerabilities for packages: spark-operator...

GO-2021-0064 vulnerabilities

Vulnerabilities for packages: spark-operator, gostatsd, newrelic-nri-statsd, kubeflow-pipelines...

GO-2025-3521 vulnerabilities

Vulnerabilities for packages: longhorn-share-manager, longhorn-share-manager-fips, harvester, azure-container-networking, rke2-runtime-fips, vcluster, argo-cd-fips, longhorn-manager-fips, kubernetes, spark-operator-fips, longhorn-manager, harvester-fips...

GO-2024-2746 vulnerabilities

Vulnerabilities for packages: local-static-provisioner, kubernetes-csi-driver-hostpath, rancher-webhook, spark-operator, rancher-webhook-fips, aws-efs-csi-driver, nodetaint, aws-ebs-csi-driver, argocd-image-updater-fips, ip-masq-agent, kubernetes-dns-node-cache, argocd-image-updater,...

GO-2023-2341 vulnerabilities

Vulnerabilities for packages: spark-operator, aws-efs-csi-driver, nodetaint, ip-masq-agent, kubernetes-dns-node-cache, aws-ebs-csi-driver, prometheus-adapter, aws-efs-csi-driver-fips...

GO-2025-3787 vulnerabilities

Vulnerabilities for packages: mattermost, chart-testing, docker-compose-fips, kubecolor, timestamp-authority, opa-fips, tkn, openfga-fips, elastic-agent, gh, aws-otel-collector-fips, nri-postgresql, witness, amazon-cloudwatch-agent-fips, grafana-alloy, zarf, seaweedfs, kyverno-policy-reporter-fip...

GO-2021-0066 vulnerabilities

Vulnerabilities for packages: spark-operator...

GO-2021-0064 vulnerabilities

Vulnerabilities for packages: gostatsd, newrelic-nri-statsd, spark-operator, kubeflow-pipelines...

GO-2024-2994 vulnerabilities

Vulnerabilities for packages: ip-masq-agent, spark-operator, kubernetes-csi-driver-hostpath, aws-efs-csi-driver, kubernetes-dns-node-cache, cri-tools, argocd-image-updater, k8s-device-plugin, local-static-provisioner, nodetaint, kubeflow-pipelines...

GO-2024-2746 vulnerabilities

Vulnerabilities for packages: ip-masq-agent, spark-operator, kubernetes, aws-efs-csi-driver, kubernetes-csi-driver-hostpath, kubernetes-dns-node-cache, argocd-image-updater, local-static-provisioner, nodetaint, kubeflow-pipelines...

GO-2023-2341 vulnerabilities

Vulnerabilities for packages: ip-masq-agent, spark-operator, aws-efs-csi-driver, kubernetes-dns-node-cache, prometheus-adapter, nodetaint...

GO-2025-3465 vulnerabilities

Vulnerabilities for packages: argo-rollouts, ip-masq-agent, emissary, kapp, kubernetes, aws-efs-csi-driver, kubernetes-csi-driver-hostpath, rancher-webhook, kubernetes-csi-driver-nfs, kubernetes-dns-node-cache, spark-operator, vcluster, argocd-image-updater, local-static-provisioner, nodetaint,...

GO-2023-2153 vulnerabilities

Vulnerabilities for packages: kubevela, spark-operator, slsa-verifier, src, kubeflow, kubescape, k3d, dgraph, terraform-provider-sendgrid, up, buildkitd, scorecard, aactl, cortex...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: q, continuity, flux-kustomize-controller, ctop, neuvector-dbgen, prometheus-adapter, apache-exporter, nri-discovery-kubernetes, step-ca, apisix-ingress-controller, harbor-scanner-trivy, golangci-lint, spire-server, crossplane-provider-aws-sns, local-path-provisioner,...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: ip-masq-agent, cloud-provider-vsphere, gitleaks, flux-kustomize-controller, ctop, apache-exporter, kyverno-policy-reporter-ui, cilium-cli, langfuse, golangci-lint, spire-server, crossplane-provider-aws-sns, local-path-provisioner, vault-k8s, mountpoint-s3-csi-driver,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: ip-masq-agent, cloud-provider-vsphere, kubecolor, render-template, cilium-cli, polaris, cluster-api-helm-controller, nri-haproxy, cluster-api-provider-vsphere, neuvector-sigstore-interface, nri-consul, kubernetes-dashboard, aactl, argo-events,...