Malicious code in inferno-zeppelin-po2r (npm)

The package inferno-zeppelin-po2r was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in grove-zeppelin-npw743-project (npm)

The package grove-zeppelin-npw743-project was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in banana-zeppelin-sryo (npm)

The package banana-zeppelin-sryo was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in ant-zeppelin-csy326-project (npm)

The package ant-zeppelin-csy326-project was found to contain malicious code. --- Credit: OpenSSF source...

Malicious code in alb-um-availa-ble-zip-mp3-file-131408-zeppelin-over-china-ylmq2-mamqni (npm)

The package alb-um-availa-ble-zip-mp3-file-131408-zeppelin-over-china-ylmq2-mamqni was found to contain malicious code. --- Credit: OpenSSF source...

Exploit for Cross-Site Request Forgery (CSRF) in Apache Zeppelin

CVE-2026-44613 Donate Support the maintenance of this pro...

CVE-2026-48054 OpenZeppelin Contracts Wizard has Code Injection in Generated Hardhat and Foundry Tests via Unsanitized opts.name / opts.uri

OpenZeppelin Contracts Wizard is a web application to interactively build a contract out of components from OpenZeppelin Contracts. Versions prior to 0.10.9 generate a Hardhat test file test/test.ts by interpolating user-supplied opts.name ERC20/ERC721 and opts.uri ERC1155 directly into TypeScrip...

Directory Traversal

Overview org.apache.zeppelin:zeppelin-server is a web-based notebook that enables interactive data analytics. You can make beautiful data-driven, interactive and collaborative documents with SQL, Scala and more. Affected versions of this package are vulnerable to Directory Traversal through the...

org.apache.zeppelin:launcher-cluster (>=0.9.0, <=0.11.2), org.apache.zeppelin:launcher-docker (>=0.9.0, <=0.12.0) +13 more potentially affected by CVE-2026-44615 via org.apache.zeppelin:zeppelin-zengine (>=0.9.0, <=0.12.0)

org.apache.zeppelin:zeppelin-zengine MAVEN version =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.12.0 Source cves: CVE-2026-44615 Source advisory: SNYK:JAVA-ORGAPACHEZEPPELIN-18507761...

CVE-2026-44615

Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or access to folder operations, could supply traversal segments in note or folder paths. Zeppelin composed these values into...

CVE-2026-44615

A path traversal vulnerability exists in Apache Zeppelin versions 0.9.0 through 0.12.0 . When FileSystemNotebookRepo is configured, an authenticated attacker with permissions to rename a note or perform folder operations can supply traversal segments (such as .. or URL-encoded %2e%2e) in note or ...

CVE-2026-44615

Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or access to folder operations, could supply traversal segments in note or folder paths. Zeppelin composed these values into...

CVE-2026-44615 Path traversal in NotebookRepo note and folder path composition

Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or access to folder operations, could supply traversal segments in note or folder paths. Zeppelin composed these values into...

org.apache.zeppelin:launcher-cluster (>=0.9.0, <=0.11.2), org.apache.zeppelin:launcher-docker (>=0.9.0, <=0.12.0) +13 more potentially affected by CVE-2026-44615 via org.apache.zeppelin:zeppelin-zengine (>=0.6.0, <=0.12.0)

org.apache.zeppelin:zeppelin-zengine MAVEN version =0.6.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.9.0, =0.6.0, =0.12.0 Source cves: CVE-2026-44615 Source advisory: MEND:CVE-2026-44615...

CVE-2026-44615 Path traversal in NotebookRepo note and folder path composition

Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or access to folder operations, could supply traversal segments in note or folder paths. Zeppelin composed these values into...

CVE-2026-44615 Path traversal in NotebookRepo note and folder path composition

Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or access to folder operations, could supply traversal segments in note or folder paths. Zeppelin composed these values into...

EUVD-2026-51524

Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or access to folder operations, could supply traversal segments in note or folder paths. Zeppelin composed these values into...

CVE-2026-44615

Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or access to folder operations, could supply traversal segments in note or folder paths. Zeppelin composed these values into...

CVE-2026-44615: Improper Limitation of a Pathname to a Restricted Directory

Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or access to folder operations, could supply traversal segments in note or folder paths. Zeppelin composed these values into...

PT-2026-66746

Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with permission to rename a note, or access to folder operations, could supply traversal segments in note or folder paths. Zeppelin composed these values into...