| CVE-2026-23906 |
Affected Products and Versions * Apache Druid * Affected Versions: 0.17.0 through 35.x (all versions prior to…
|
Not rated
|
Feb 10, 2026 |
| CVE-2025-59390 |
Apache Druid’s Kerberos authenticator uses a weak fallback secret when the…
|
Not rated
|
Nov 26, 2025 |
| CVE-2025-27888 |
Severity: medium (5.8) / important Server-Side Request Forgery (SSRF), Improper Neutralization of Input During Web…
|
5.8
Medium
|
Mar 20, 2025 |
| CVE-2024-45537 |
Apache Druid allows users with certain permissions to read data from other database systems using JDBC
|
Not rated
|
Sep 17, 2024 |
| CVE-2024-45384 |
Padding Oracle vulnerability in Apache Druid extension, druid-pac4j
|
Not rated
|
Sep 17, 2024 |
| CVE-2022-28889 |
In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking
|
Not rated
|
Jul 7, 2022 |
| CVE-2021-44791 |
In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back…
|
Not rated
|
Jul 7, 2022 |
| CVE-2021-36749 |
In the Druid ingestion system, the InputSource is used for reading data from a certain data source
|
Not rated
|
Sep 24, 2021 |
| CVE-2021-26920 |
In the Druid ingestion system, the InputSource is used for reading data from a certain data source
|
Not rated
|
Jul 2, 2021 |
| CVE-2021-26919 |
Apache Druid allows users to read data from other database systems using JDBC
|
Not rated
|
Mar 30, 2021 |
| CVE-2021-25646 |
Apache Druid includes the ability to execute user-provided JavaScript code embedded in various types of requests
|
Not rated
|
Jan 29, 2021 |