- Latest release
- Not known: cve.now hasn't read this package's releases
- Newest unaffected release
- Not known without release data
- Advisories
- 13 · 1 critical, 5 high
- Registry
- Maven Central
Advisories 13
- CVE-2025-61735High 7.3
Apache Kylin: Server-Side Request Forgery
Affected: from 4.0.0, fixed in 5.0.3.
- CVE-2025-61733High 7.5
Apache Kylin: Authentication bypass
Affected: from 4.0.0, fixed in 5.0.3.
- CVE-2025-61734High 7.5
Apache Kylin: improper restriction of file read
Affected: from 4.0.0, fixed in 5.0.3.
- CVE-2025-30067High 7.2
Apache Kylin: The remote code execution via jdbc url
Affected: from 4.0.0, fixed in 5.0.2.
- CVE-2024-23590Critical 9.1
Apache Kylin: Session fixation in web interface
Affected: from 2.0.0, fixed in 5.0.0.
- CVE-2022-43396High 8.8
Apache Kylin: Command injection by Useless configuration
Affected: from 2.0.0, fixed in 4.0.3.
- CVE-2021-45458Unrated
Hardcoded credentials
Affected: fixed in 3.1.3; from 4.0.0, fixed in 4.0.1.
- CVE-2021-45457Unrated
Overly broad CORS configuration
Affected: fixed in 3.1.3; from 4.0.0, fixed in 4.0.1.
- CVE-2021-45456Unrated
Command injection
Affected: fixed in 4.0.1.
- CVE-2021-36774Unrated
Mysql JDBC Connector Deserialize RCE
Affected: fixed in 3.1.3.
- CVE-2021-31522Unrated
Apache Kylin unsafe class loading
Affected: fixed in 3.1.3; from 4.0.0, fixed in 4.0.1.
- CVE-2021-27738Unrated
Improper Access Control to Streaming Coordinator & SSRF
Affected: fixed in 3.1.3.
- CVE-2020-13937Unrated
Apache Kylin 2.0.0, 2.1.0, 2.2.0, 2.3.0, 2.3.1, 2.3.2, 2.4.0, 2.4.1, 2.5.0, 2.5.1, 2.5.2, 2.6.0, 2.6.1, 2.6.2, 2.6.3, 2.6.4, 2.6.5, 2.6.6…
Affected: fixed in 3.1.1; from 4.0.0-alpha, fixed in 4.0.0-beta.