What’s Vulnerable › Products
Apache Software Foundation Apache Zeppelin vulnerabilities
26 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 8 published in the last 12 months.
Check whether your Apache Software Foundation Apache Zeppelin version is affected
Latest Apache Software Foundation Apache Zeppelin vulnerabilities
- CVE-2026-44615 — Path traversal in NotebookRepo note and folder path composition (CVSS 6.5)
- CVE-2026-44617 — Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867 (CVSS 6.5)
- CVE-2026-44616 — Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction (CVSS 6.5)
- CVE-2026-44613 — Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling (CVSS 6.1)
- CVE-2024-51775 — Apache Zeppelin: Command Injection via CSWSH (CVSS 5.3)
- CVE-2024-52279 — Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string (CVSS 5.3)
- CVE-2024-41177 — Apache Zeppelin: XSS in the Helium module (CVSS 6.1)
- CVE-2024-41169 — Apache Zeppelin: raft directory listing and file read (CVSS 7.5)
- CVE-2024-31867 — Apache Zeppelin: LDAP search filter query Injection Vulnerability (CVSS 6.5)
- CVE-2024-31868 — Apache Zeppelin: XSS vulnerability in the helium module (CVSS 6.1)
- CVE-2024-31866 — Apache Zeppelin: Interpreter download command does not escape malicious code injection (CVSS 9.8)
- CVE-2024-31865 — Apache Zeppelin: Cron arbitrary user impersonation with improper privileges (CVSS 6.5)
- CVE-2024-31864 — Apache Zeppelin: Remote code execution by adding malicious JDBC connection string (CVSS 9.8)
- CVE-2024-31863 — Apache Zeppelin: Replacing other users notebook, bypassing any permissions (CVSS 5.3)
- CVE-2024-31862 — Apache Zeppelin: Denial of service with invalid notebook name (CVSS 5.3)
- CVE-2022-47894 — Apache Zeppelin SAP: connecting to a malicious SAP server allowed it to perform XXE (CVSS 5.3)
- CVE-2021-28656 — Apache Zeppelin: CSRF vulnerability in the Credentials page (CVSS 5.4)
- CVE-2024-31860 — Apache Zeppelin: Path traversal vulnerability (CVSS 6.5)
- CVE-2022-46870 — Apache Zeppelin: Stored XSS in note permissions (CVSS 5.4)
- CVE-2021-28655 — Apache Zeppelin: Arbitrary file deletion vulnerability (CVSS 6.5)
- CVE-2021-27578 — Cross Site Scripting in markdown interpreter (CVSS 6.1)
- CVE-2020-13929 — Notebook permissions bypass (CVSS 7.5)
- CVE-2019-10095 — bash command injection in spark interpreter (CVSS 9.8)
- CVE-2018-1328 — (CVSS 6.1)
- CVE-2018-1317 — (CVSS 8.8)