| CVE-2026-23906 |
Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to…
|
Non notée
|
10 févr. 2026 |
| CVE-2025-59390 |
Apache Druid’s Kerberos authenticator uses a weak fallback secret when the…
|
Non notée
|
26 nov. 2025 |
| CVE-2025-27888 |
Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web…
|
5.8
Moyenne
|
20 mars 2025 |
| CVE-2024-45537 |
Apache Druid allows users with certain permissions to read data from other database systems using JDBC
|
Non notée
|
17 sept. 2024 |
| CVE-2024-45384 |
Padding Oracle vulnerability in Apache Druid extension, druid-pac4j
|
Non notée
|
17 sept. 2024 |
| CVE-2022-28889 |
In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking
|
Non notée
|
7 juil. 2022 |
| CVE-2021-44791 |
In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back…
|
Non notée
|
7 juil. 2022 |
| CVE-2021-36749 |
In the Druid ingestion system, the InputSource is used for reading data from a certain data source
|
Non notée
|
24 sept. 2021 |
| CVE-2021-26920 |
In the Druid ingestion system, the InputSource is used for reading data from a certain data source
|
Non notée
|
2 juil. 2021 |
| CVE-2021-26919 |
Apache Druid allows users to read data from other database systems using JDBC
|
Non notée
|
30 mars 2021 |
| CVE-2021-25646 |
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests
|
Non notée
|
29 janv. 2021 |