| CVE-2026-32773 |
There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to…
|
Not rated
|
Sep 2, 2026 |
| CVE-2025-54920 |
This issue affects Apache Spark: before 3.5.7 and 4.0.1
|
Not rated
|
Mar 14, 2026 |
| CVE-2025-55039 |
This issue affects Apache Spark versions before 3.4.4, 3.5.2 and 4.0.0
|
Not rated
|
Oct 15, 2025 |
| CVE-2024-23945 |
Signing cookies is an application security feature that adds a digital signature to cookie data to verify its…
|
Not rated
|
Dec 23, 2024 |
| CVE-2023-32007 |
** UNSUPPORTED WHEN ASSIGNED ** The Apache Spark UI offers the possibility to enable ACLs via the configuration option…
|
Not rated
|
May 2, 2023 |
| CVE-2023-22946 |
In Apache Spark versions prior to 3.4.0, applications using spark-submit can specify a 'proxy-user' to run as,…
|
6.4
Medium
|
Apr 17, 2023 |
| CVE-2022-31777 |
A stored cross-site scripting (XSS) vulnerability in Apache Spark 3.2.1 and earlier, and 3.3.0, allows remote…
|
Not rated
|
Nov 1, 2022 |
| CVE-2022-33891 |
Exploited
Apache Spark Command Injection Vulnerability
|
Not rated
|
Jul 18, 2022 |
| CVE-2021-38296 |
Apache Spark supports end-to-end encryption of RPC connections via "spark.authenticate" and…
|
Not rated
|
Mar 10, 2022 |
| CVE-2020-9480 |
In Apache Spark 2.4.5 and earlier, a standalone resource manager's master may be configured to require authentication…
|
Not rated
|
Jun 23, 2020 |
| CVE-2018-11760 |
When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the…
|
Not rated
|
Feb 4, 2019 |
| CVE-2018-17190 |
In all versions of Apache Spark, its standalone resource manager accepts code to execute on a 'master' host, that then…
|
Not rated
|
Nov 19, 2018 |
| CVE-2018-11804 |
Spark's Apache Maven-based build includes a convenience script, 'build/mvn', that downloads and runs a zinc server to…
|
Not rated
|
Oct 24, 2018 |
| CVE-2018-11770 |
From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the…
|
Not rated
|
Aug 13, 2018 |
| CVE-2018-8024 |
In Apache Spark 2.1.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, it's possible for a malicious user to construct a URL…
|
Not rated
|
Jul 12, 2018 |
| CVE-2018-1334 |
In Apache Spark 1.0.0 to 2.1.2, 2.2.0 to 2.2.1, and 2.3.0, when using PySpark or SparkR, it's possible for a different…
|
Not rated
|
Jul 12, 2018 |