MavenPackage

org.apache.kylin:kylin-core-common

6 known vulnerabilities (1 critical, 5 high), with the versions each affects and the releases that fix them.

Latest release: 5.0.5 (Oct 12, 2026): no advisory affects it
Newest unaffected release: 5.0.5 (Oct 12, 2026), the latest release
Advisories: 6 · 1 critical, 5 high

Dependents: 43
Releases: 49 since 1.5.0 (Mar 12, 2016)
Registry: Maven Central
Releases read: Nov 8, 2026

Version timeline

CVE-2025-61735
Affects 4.0.0 to 5.0.2 (5.0.3 is outside it)
CVE-2025-61733
Affects 4.0.0 to 5.0.2 (5.0.3 is outside it)
CVE-2025-61734
Affects 4.0.0 to 5.0.2 (5.0.3 is outside it)
CVE-2023-29055
Affects 2.0.0 to 4.0.3 (4.0.4 is outside it)
CVE-2022-24697
Affects 1.5.0 to 4.0.1 (4.0.2 is outside it)
CVE-2020-1956
Affects 1.5.0 to 2.6.5 (2.6.6 is outside it); 3.0.0 to 3.0.1 (3.0.2 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 6

CVE-2025-61735High 7.3
Apache Kylin: Server-Side Request Forgery
Affected: from 4.0.0, fixed in 5.0.3.
Fixed in 5.0.3 (released Sep 18, 2025, 14 days before disclosure).
The latest release, 5.0.5, is not affected.
CVE-2025-61733High 7.5
Apache Kylin: Authentication bypass
Affected: from 4.0.0, fixed in 5.0.3.
Fixed in 5.0.3 (released Sep 18, 2025, 14 days before disclosure).
The latest release, 5.0.5, is not affected.
CVE-2025-61734High 7.5
Apache Kylin: improper restriction of file read
Affected: from 4.0.0, fixed in 5.0.3.
Fixed in 5.0.3 (released Sep 18, 2025, 14 days before disclosure).
The latest release, 5.0.5, is not affected.
CVE-2023-29055High 7.5
Apache Kylin: Insufficiently protected credentials in config file
Affected: from 2.0.0, fixed in 4.0.4.
Fixed in 4.0.4 (released Jan 20, 2024, 9 days before disclosure).
The latest release, 5.0.5, is not affected.
CVE-2022-24697Critical 9.8
Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters
Affected: fixed in 4.0.2.
Fixed in 4.0.2 (released Aug 28, 2022, 46 days before disclosure).
The latest release, 5.0.5, is not affected.
CVE-2020-1956High 8.8 · KEV
Apache Kylin 2.3.0, and releases up to 2.6.5 and 3.0.1 has some restful apis which will concatenate os command with the user input string, a
Affected: fixed in 2.6.6; from 3.0.0, fixed in 3.0.2.
Fixed in 2.6.6 (released May 12, 2020, 10 days before disclosure) and 3.0.2 (released May 12, 2020, 10 days before disclosure).
The latest release, 5.0.5, is not affected.