What’s Vulnerable › Products
Apache Software Foundation Apache Kylin vulnerabilities
45 known vulnerabilities, 1 confirmed exploited in the wild (CISA KEV), 30 published in the last 12 months.
Check whether your Apache Software Foundation Apache Kylin version is affected
Exploited Apache Software Foundation Apache Kylin vulnerabilities
- CVE-2020-1956 — Apache Kylin OS Command Injection Vulnerability
Latest Apache Software Foundation Apache Kylin vulnerabilities
- CVE-2026-108837 — Apache Kylin: Potential computed-column resource exhaustion
- CVE-2026-108833 — Apache Kylin: default startup profile miss security settings
- CVE-2026-108823 — Apache Kylin: Potential unauthenticated job metadata replacement
- CVE-2026-108780 — Apache Kylin: Potential JDBC source configuration validation issue
- CVE-2026-108776 — Apache Kylin: tables/names SparkSQL injection
- CVE-2026-108771 — Apache Kylin: unauthenticated broadcast API and polymorphic deserialization
- CVE-2026-108766 — Apache Kylin: missing JDBC-config authorization
- CVE-2026-108764 — Apache Kylin: job-driver UI proxy SSRF
- CVE-2026-108762 — Apache Kylin: delete metadata backup path-confinement bypass
- CVE-2026-69080 — Apache Kylin: Broken Access Control in QuerySQLBlacklistController (CVSS 7.5)
- CVE-2026-69077 — Apache Kylin: JobController allows unauthorized cross-project manipulation (CVSS 7.5)
- CVE-2026-69076 — Apache Kylin: Unauthorized cross-project job discard (CVSS 7.5)
- CVE-2026-68573 — Apache Kylin: Unauthenticated Metastore Cleanup (CVSS 9.8)
- CVE-2026-68572 — Apache Kylin: Unauthorized SQL execution to Spark SQL env (CVSS 7.5)
- CVE-2026-108743 — Apache Kylin: spark job OS command injection (CVSS 8.8)
- CVE-2026-108709 — Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network) (CVSS 9.8)
- CVE-2026-68571 — Apache Kylin: JDBC URL Whitelist Verification Bypass (CVSS 8.8)
- CVE-2026-64959 — Apache Kylin: Missing authentication on certain cache API endpoints (CVSS 9.8)
- CVE-2026-64610 — Apache Kylin: Redis unsafe Java deserialization (CVSS 9.8)
- CVE-2026-63619 — Apache Kylin: Missing authorization and path-confinement on system meta dump (CVSS 9.1)
- CVE-2026-63618 — Apache Kylin: Low-Privilege Config Exposure (CVSS 7.5)
- CVE-2026-62393 — Apache Kylin: Improper authorization in job information retrieval (CVSS 4.3)
- CVE-2026-62392 — Apache Kylin: OS Command Injection via Async Query API (CVSS 9.8)
- CVE-2026-62390 — Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API (CVSS 9.8)
- CVE-2025-61735 — Apache Kylin: Server-Side Request Forgery (CVSS 7.3)