You are viewing a plain text version of this content. The canonical link for it is here.
- [Announcement] Apache Kylin 5.0.5 released - posted by Li Yang <li...@apache.org> on 2026/10/15 10:28:44 UTC, 0 replies.
- CVE-2026-63618: Apache Kylin: Low-Privilege Config Exposure - posted by Li Yang <li...@apache.org> on 2026/10/16 02:24:10 UTC, 0 replies.
- CVE-2026-63619: Apache Kylin: Missing authorization and path-confinement on system meta dump - posted by Li Yang <li...@apache.org> on 2026/10/16 02:27:53 UTC, 0 replies.
- CVE-2026-64610: Apache Kylin: Redis unsafe Java deserialization - posted by Li Yang <li...@apache.org> on 2026/10/16 02:29:20 UTC, 0 replies.
- CVE-2026-64959: Apache Kylin: Missing authentication on certain cache API endpoints - posted by Li Yang <li...@apache.org> on 2026/10/16 02:33:15 UTC, 0 replies.
- CVE-2026-68571: Apache Kylin: JDBC URL Whitelist Verification Bypass - posted by Li Yang <li...@apache.org> on 2026/10/16 02:34:34 UTC, 0 replies.
- CVE-2026-68572: Apache Kylin: Unauthorized SQL execution to Spark SQL env - posted by Li Yang <li...@apache.org> on 2026/10/16 02:37:29 UTC, 0 replies.
- CVE-2026-68573: Apache Kylin: Unauthenticated Metastore Cleanup - posted by Li Yang <li...@apache.org> on 2026/10/16 02:39:59 UTC, 0 replies.
- CVE-2026-69076: Apache Kylin: Unauthorized cross-project job discard - posted by Li Yang <li...@apache.org> on 2026/10/16 02:42:38 UTC, 0 replies.
- CVE-2026-69077: Apache Kylin: JobController allows unauthorized cross-project manipulation - posted by Li Yang <li...@apache.org> on 2026/10/16 02:43:17 UTC, 0 replies.
- CVE-2026-69080: Apache Kylin: Broken Access Control in QuerySQLBlacklistController - posted by Li Yang <li...@apache.org> on 2026/10/16 02:45:32 UTC, 0 replies.
- CVE-2026-108709: Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network) - posted by Li Yang <li...@apache.org> on 2026/10/16 02:46:03 UTC, 0 replies.
- CVE-2026-108743: Apache Kylin: spark job OS command injection - posted by Li Yang <li...@apache.org> on 2026/10/16 03:00:12 UTC, 0 replies.
- CVE-2026-108762: Apache Kylin: delete metadata backup path-confinement bypass - posted by Li Yang <li...@apache.org> on 2026/10/16 03:00:58 UTC, 0 replies.
- CVE-2026-108764: Apache Kylin: job-driver UI proxy SSRF - posted by Li Yang <li...@apache.org> on 2026/10/16 03:03:11 UTC, 0 replies.
- CVE-2026-108766: Apache Kylin: missing JDBC-config authorization - posted by Li Yang <li...@apache.org> on 2026/10/16 03:03:55 UTC, 0 replies.
- CVE-2026-108771: Apache Kylin: unauthenticated broadcast API and polymorphic deserialization - posted by Li Yang <li...@apache.org> on 2026/10/16 03:05:10 UTC, 0 replies.
- CVE-2026-108776: Apache Kylin: tables/names SparkSQL injection - posted by Li Yang <li...@apache.org> on 2026/10/16 03:09:33 UTC, 0 replies.
- CVE-2026-108780: Apache Kylin: Potential JDBC source configuration validation issue - posted by Li Yang <li...@apache.org> on 2026/10/16 03:10:21 UTC, 0 replies.
- CVE-2026-108823: Apache Kylin: Potential unauthenticated job metadata replacement - posted by Li Yang <li...@apache.org> on 2026/10/16 03:10:54 UTC, 0 replies.
- CVE-2026-108833: Apache Kylin: default startup profile miss security settings - posted by Li Yang <li...@apache.org> on 2026/10/16 03:11:38 UTC, 0 replies.
- CVE-2026-108837: Apache Kylin: Potential computed-column resource exhaustion - posted by Li Yang <li...@apache.org> on 2026/10/16 03:12:18 UTC, 0 replies.