Apache Spark UI - Cross-Site Scripting

Apache Spark UI before 2.3.2 is vulnerable to XSS via unsanitized query string parameters in the /jobs/ endpoint. id: CVE-2018-8024 info: name: Apache Spark UI - Cross-Site Scripting author: ritikchaddha severity: medium description: | Apache Spark UI before 2.3.2 is vulnerable to XSS via...

Apache Spark - Authentication Bypass

In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication spark.authenticate via a shared secret. When enabled, however, a specially-crafted RPC to the master can succeed in starting an application's resources on the Spark cluster, even...

Apache Spark UI - Remote Command Injection

Apache Spark UI is susceptible to remote command injection. ACLs can be enabled via the configuration option spark.acls.enable. With an authentication filter, this checks whether a user has access permissions to view or modify the application. If ACLs are enabled, a code path in HttpSecurityFilte...

CVE-2026-73508 vulnerabilities

Vulnerabilities for packages: akhq, apicurio-registry, opensearch, strimzi-kafka-operator, spark, celeborn, management-api-for-apache-cassandra-5.0, tez, apache-nifi, druid, thingsboard, apache-pulsar, zipkin, keycloak...

GO-2021-0066 vulnerabilities

Vulnerabilities for packages: spark-operator...

GO-2021-0064 vulnerabilities

Vulnerabilities for packages: newrelic-nri-statsd, spark-operator, gostatsd, kubeflow-pipelines...

GO-2024-2746 vulnerabilities

Vulnerabilities for packages: argocd-image-updater-fips, argocd-image-updater, aws-efs-csi-driver-fips, kubernetes, kubernetes-dns-node-cache, kubernetes-csi-driver-hostpath, nodetaint, ip-masq-agent, kubeflow-pipelines, rancher-webhook-fips, aws-ebs-csi-driver, spark-operator, aws-efs-csi-driver...

GO-2025-3521 vulnerabilities

Vulnerabilities for packages: harvester, harvester-fips, azure-container-networking, longhorn-share-manager, spark-operator-fips, kubernetes, longhorn-manager-fips, longhorn-share-manager-fips, rke2-runtime-fips, vcluster, argo-cd-fips, longhorn-manager...

GO-2023-2341 vulnerabilities

Vulnerabilities for packages: aws-efs-csi-driver-fips, kubernetes-dns-node-cache, nodetaint, ip-masq-agent, aws-ebs-csi-driver, spark-operator, aws-efs-csi-driver, prometheus-adapter...

GO-2025-3787 vulnerabilities

Vulnerabilities for packages: argo-events, spire-server-fips, neuvector-sigstore-interface, policy-controller-fips, syft, traefik-fips, docker-cli-buildx, flux-source-controller, argo-workflows, opentelemetry-collector, chainctl, gh, prometheus, podinfo, chart-testing-fips, kots, opentofu-fips,...

GO-2021-0066 vulnerabilities

Vulnerabilities for packages: spark-operator...

GO-2021-0064 vulnerabilities

Vulnerabilities for packages: gostatsd, spark-operator, kubeflow-pipelines, newrelic-nri-statsd...

GO-2024-2994 vulnerabilities

Vulnerabilities for packages: spark-operator, nodetaint, kubernetes-dns-node-cache, cri-tools, kubernetes-csi-driver-hostpath, local-static-provisioner, kubeflow-pipelines, k8s-device-plugin, aws-efs-csi-driver, argocd-image-updater, ip-masq-agent...

GO-2023-2341 vulnerabilities

Vulnerabilities for packages: spark-operator, nodetaint, kubernetes-dns-node-cache, prometheus-adapter, aws-efs-csi-driver, ip-masq-agent...

GO-2024-2746 vulnerabilities

Vulnerabilities for packages: spark-operator, aws-efs-csi-driver, nodetaint, kubernetes-dns-node-cache, kubernetes-csi-driver-hostpath, local-static-provisioner, kubeflow-pipelines, kubernetes, argocd-image-updater, ip-masq-agent...

GO-2025-3465 vulnerabilities

Vulnerabilities for packages: argo-rollouts, spark-operator, nodetaint, kubernetes-dns-node-cache, rancher-webhook, kubernetes-csi-driver-hostpath, local-static-provisioner, rancher-fleet, kapp, vcluster, yunikorn-k8shim, kubernetes, emissary, kubernetes-csi-driver-nfs, aws-efs-csi-driver,...

GO-2026-5039 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, authservice, policy-controller, cortex, kube-state-metrics, nri-kubernetes, lazydocker, spire-server, docker-machine-driver-harvester, net-kourier, temporal, opa-envoy, helm-push, cert-manager-webhook-pdns, descheduler,...

GO-2023-2153 vulnerabilities

Vulnerabilities for packages: terraform-provider-sendgrid, up, spark-operator, slsa-verifier, dgraph, cortex, kubescape, k3d, aactl, kubevela, scorecard, kubeflow, src, buildkitd...

GO-2026-4340 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-cloudfront, authservice, aws-privateca-issuer, policy-controller, swagger, cortex, kubelet-csr-approver, juicefs, spire-server, kserve-modelmesh-serving, spire-controller-manager, crossplane-provider-sql, whereabouts, postgres-operator,...

GO-2025-3955 vulnerabilities

Vulnerabilities for packages: dive, aws-privateca-issuer, gcsfuse, swagger, kubernetes-dashboard-auth, lazydocker, terraform-provider-azapi, docker-machine-driver-harvester, spire-controller-manager, helm-push, terraform, rabbitmq-messaging-topology-operator, nri-mysql, azure-service-operator,...