# cve.now: Hitachi Vantara

The newest entries naming Hitachi Vantara as an affected vendor (up to 200), of 56 in all, 2 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-108337](https://cve.now/CVE-2026-108337.md): Password Reset Code Accessible in User Listing API (CVSS 7.4)
- [CVE-2026-108336](https://cve.now/CVE-2026-108336.md): Token Signing Key Allows Unauthenticated Administrative Access (CVSS 9.1)
- [CVE-2026-108335](https://cve.now/CVE-2026-108335.md): Password Reset Functionality Missing Brute-Force Protection (CVSS 9.1)
- [CVE-2026-2253](https://cve.now/CVE-2026-2253.md): Hitachi Vantara Pentaho Data Integration & Analytics - Improper Restriction of XML External Entity Reference (CVSS 7.7)
- [CVE-2026-2255](https://cve.now/CVE-2026-2255.md): Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials (CVSS 4.3)
- [CVE-2026-2254](https://cve.now/CVE-2026-2254.md): Hitachi Vantara Pentaho Data Integration & Analytics - Incorrect Permission Assignment for Critical Resource (CVSS 6.3)
- [CVE-2025-11159](https://cve.now/CVE-2025-11159.md): Hitachi Vantara Pentaho Data Integration & Analytics - Dependency on Vulnerable Third-Party Component (CVSS 9.1)
- [CVE-2025-11158](https://cve.now/CVE-2025-11158.md): Hitachi Vantara Pentaho Data Integration & Analytics - Missing Authorization (CVSS 9.1)
- [CVE-2025-9121](https://cve.now/CVE-2025-9121.md): Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data (CVSS 8.8)
- [CVE-2025-9122](https://cve.now/CVE-2025-9122.md): Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information (CVSS 5.3)
- [CVE-2025-24907](https://cve.now/CVE-2025-24907.md): Hitachi Vantara Pentaho Data Integration & Analytics – Path Traversal (CVSS 6.8)
- [CVE-2025-24911](https://cve.now/CVE-2025-24911.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference (CVSS 4.9)
- [CVE-2025-24910](https://cve.now/CVE-2025-24910.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference (CVSS 4.9)
- [CVE-2025-24909](https://cve.now/CVE-2025-24909.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 4.4)
- [CVE-2025-24908](https://cve.now/CVE-2025-24908.md): Hitachi Vantara Pentaho Data Integration & Analytics – Path Traversal (CVSS 6.8)
- [CVE-2025-0756](https://cve.now/CVE-2025-0756.md): Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection') (CVSS 9.1)
- [CVE-2025-0757](https://cve.now/CVE-2025-0757.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 4.4)
- [CVE-2025-0758](https://cve.now/CVE-2025-0758.md): Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource (CVSS 6.1)
- [CVE-2024-37363](https://cve.now/CVE-2024-37363.md): Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization (CVSS 6.5)
- [CVE-2024-37362](https://cve.now/CVE-2024-37362.md): Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials (CVSS 6.3)
- [CVE-2024-6697](https://cve.now/CVE-2024-6697.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Handling of Insufficient Permissions or Privileges (CVSS 6.5)
- [CVE-2024-6696](https://cve.now/CVE-2024-6696.md): Hitachi Vantara Pentaho Business Analytics Server - Insufficient Granularity of Access Control (CVSS 4.9)
- [CVE-2024-37361](https://cve.now/CVE-2024-37361.md): Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data (CVSS 9.9)
- [CVE-2024-37360](https://cve.now/CVE-2024-37360.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 4.4)
- [CVE-2024-37359](https://cve.now/CVE-2024-37359.md): Hitachi Vantara Pentaho Business Analytics Server – Server Side Request Forgery (CVSS 8.6)
- [CVE-2024-5705](https://cve.now/CVE-2024-5705.md): Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization (CVSS 8.8)
- [CVE-2024-5706](https://cve.now/CVE-2024-5706.md): Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection') (CVSS 8.8)
- [CVE-2024-28981](https://cve.now/CVE-2024-28981.md): Hitachi Vantara Pentaho Data Integration & Analytics - Insufficiently Protected Credentials (CVSS 8.5)
- [CVE-2024-28984](https://cve.now/CVE-2024-28984.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 8.8)
- [CVE-2024-28983](https://cve.now/CVE-2024-28983.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 8.8)
- [CVE-2024-28982](https://cve.now/CVE-2024-28982.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference (CVSS 7.1)
- [CVE-2023-5617](https://cve.now/CVE-2023-5617.md): Hitachi Vantara Pentaho Data Integration & Analytics - Server-generated Error Message Containing Sensitive Information (CVSS 5.3)
- [CVE-2023-3517](https://cve.now/CVE-2023-3517.md): Hitachi Vantara Pentaho Data Integration & Analytics - Improper Control of Resource Identifiers ('Resource Injection') (CVSS 8.5)
- [CVE-2023-6538](https://cve.now/CVE-2023-6538.md): System Management Unit (SMU) versions prior to 14.8.7825.01, used to manage Hitachi Vantara NAS products is susceptible to unintended information disclosure via unprivileged access to SMU configuration backup data. (CVSS 7.6)
- [CVE-2023-5808](https://cve.now/CVE-2023-5808.md): System Management Unit (SMU) versions prior to 14.8.7825.01, used to manage Hitachi Vantara NAS products are susceptible to unintended information disclosure via unprivileged access to HNAS configuration backup and diagnostic data. (CVSS 7.6)
- [CVE-2023-2358](https://cve.now/CVE-2023-2358.md): Hitachi Vantara Pentaho Business Analytics Server – Password Stored in a Recoverable Format (CVSS 4.3)
- [CVE-2022-4815](https://cve.now/CVE-2022-4815.md): Hitachi Vantara Pentaho Business Analytics Server - Deserialization of Untrusted Data (CVSS 8.0)
- [CVE-2023-1158](https://cve.now/CVE-2023-1158.md): Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization (CVSS 4.3)
- [CVE-2022-43770](https://cve.now/CVE-2022-43770.md): Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization (CVSS 5.4)
- [CVE-2022-3695](https://cve.now/CVE-2022-3695.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation (CVSS 6.5)
- [CVE-2022-4771](https://cve.now/CVE-2022-4771.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CVSS 5.4)
- [CVE-2022-4770](https://cve.now/CVE-2022-4770.md): Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information (CVSS 4.3)
- [CVE-2022-4769](https://cve.now/CVE-2022-4769.md): Hitachi Vantara Pentaho Business Analytics Server - Generation of Error Message Containing Sensitive Information (CVSS 4.3)
- [CVE-2022-43772](https://cve.now/CVE-2022-43772.md): Hitachi Vantara Pentaho Business Analytics Server - Insertion of Sensitive Information into Log File (CVSS 3.8)
- [CVE-2022-3960](https://cve.now/CVE-2022-3960.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') (CVSS 6.3)
- [CVE-2022-43941](https://cve.now/CVE-2022-43941.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Restriction of XML External Entity Reference (CVSS 7.1)
- [CVE-2022-43771](https://cve.now/CVE-2022-43771.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') (CVSS 6.5)
- [CVE-2022-43940](https://cve.now/CVE-2022-43940.md): Hitachi Vantara Pentaho Business Analytics Server - Incorrect Authorization (CVSS 8.8)
- [CVE-2022-43939](https://cve.now/CVE-2022-43939.md): Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions (CVSS 8.6, KEV)
- [CVE-2022-43938](https://cve.now/CVE-2022-43938.md): Hitachi Vantara Pentaho Business Analytics Server - Improper Neutralization of Directives in Statically Saved Code ('Static Code Injection') (CVSS 8.8)
- [CVE-2022-43773](https://cve.now/CVE-2022-43773.md): Hitachi Vantara Pentaho Business Analytics Server - Incorrect Permission Assignment for Critical Resource (CVSS 8.8)
- [CVE-2022-43769](https://cve.now/CVE-2022-43769.md): Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection) (CVSS 8.8, KEV)
- [CVE-2021-45448](https://cve.now/CVE-2021-45448.md): Pentaho Business Analytics Server - Pentaho Analyzer plugin exposes a service endpoint for templates which allows a user supplied path to access resources that are out of bounds. (CVSS 7.1)
- [CVE-2021-45447](https://cve.now/CVE-2021-45447.md): Pentaho Business Analytics Server - With the Data Lineage feature enabled, the system transmits database passwords in clear text (CVSS 7.7)
- [CVE-2021-45446](https://cve.now/CVE-2021-45446.md): Pentaho Business Analytics Server - Exposure of Information Through Directory Listing (CVSS 5.0)
- [CVE-2021-28052](https://cve.now/CVE-2021-28052.md): Hitachi Content Platform Information Disclosure Vulnerability (CVSS 7.5)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/hitachi-vantara
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.