What’s Vulnerable › Products

Apache Software Foundation Apache StreamPark vulnerabilities

17 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 5 published in the last 12 months.

Check whether your Apache Software Foundation Apache StreamPark version is affected

Latest Apache Software Foundation Apache StreamPark vulnerabilities

• CVE-2025-53960 — Apache StreamPark: Uses the user’s password as the secret key (CVSS 5.9)
• CVE-2025-54981 — Apache StreamPark: Weak Encryption Algorithm in StreamPark (CVSS 7.5)
• CVE-2025-54947 — Apache StreamPark: Use hard-coded key vulnerability (CVSS 9.8)
• CVE-2025-30001 — Apache StreamPark: Authenticated users can trigger remote command execution (CVSS 7.3)
• CVE-2024-48988 — Apache StreamPark: SQL injection vulnerability (CVSS 7.6)
• CVE-2024-29070 — Apache StreamPark: session not invalidated after logout (CVSS 9.1)
• CVE-2024-34457 — Apache StreamPark IDOR Vulnerability (CVSS 6.5)
• CVE-2024-29178 — Apache StreamPark: FreeMarker SSTI RCE Vulnerability (CVSS 8.8)
• CVE-2024-29120 — Apache StreamPark: Information leakage vulnerability (CVSS 5.9)
• CVE-2024-29737 — Apache StreamPark (incubating): maven build params could trigger remote command execution (CVSS 4.7)
• CVE-2023-52291 — Apache StreamPark (incubating): Unchecked maven build params could trigger remote command execution (CVSS 4.7)
• CVE-2023-52290 — Apache StreamPark (incubating): Unchecked SQL query fields trigger SQL injection vulnerability (CVSS 8.1)
• CVE-2023-49898 — Apache StreamPark (incubating): Authenticated system users could trigger remote command execution (CVSS 7.2)
• CVE-2023-30867 — Apache StreamPark (incubating): Authenticated system users could trigger SQL injection vulnerability (CVSS 4.9)
• CVE-2022-46365 — Apache StreamPark (incubating): Logic error causing any account reset (CVSS 9.1)
• CVE-2022-45802 — Apache StreamPark (incubating): Upload any file to any directory (CVSS 9.8)
• CVE-2022-45801 — Apache StreamPark (incubating): LDAP Injection Vulnerability (CVSS 5.4)