Veille CVE

Semaine du 19 octobre au 25 octobre 2026

9 CVE

Critique 0 Élevée 0 Moyenne 0 Faible 0 Non évaluée 9 Exploitées (KEV) Tri : plus récentes « Apache Software Foundation Apache Kylin » ✕
  1. CVE-2026-108837 – Non évaluée

    Apache Software Foundation Apache Kylin

    Allocation of resources without limits or throttling vulnerability in Apache Kylin. Given an attacker has got project admin permission, an cache API maybe used to cause computed-column resource exhaustion. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

  2. CVE-2026-108833 – Non évaluée

    Apache Software Foundation Apache Kylin

    Default startup profile miss security settings in Apache Kylin. Any deployment has security setting profile turned on does not impact. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

  3. CVE-2026-108823 – Non évaluée

    Apache Software Foundation Apache Kylin

    Exposure of Sensitive Information to an Unauthorized Actor during job manipulation in Apache Kylin. The impact is minor unless job services are exposed to public network, which is uncommon. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

  4. CVE-2026-108780 – Non évaluée

    Apache Software Foundation Apache Kylin

    Potential JDBC source configuration validation vulnerability in Apache Kylin. The impact is minor, unless the kylin backend services are open to public network. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

  5. CVE-2026-108776 – Non évaluée

    Apache Software Foundation Apache Kylin

    Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache Kylin. The impact is moderate if kylin service is in query only mode, which is the default and most common mode. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

  6. CVE-2026-108771 – Non évaluée

    Apache Software Foundation Apache Kylin

    Missing authentication for in-house broadcast and polymorphic deserialization vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

  7. CVE-2026-108766 – Non évaluée

    Apache Software Foundation Apache Kylin

    Missing authorization on jdbc source config update in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

  8. CVE-2026-108764 – Non évaluée

    Apache Software Foundation Apache Kylin

    Server-Side request forgery (SSRF) vulnerability in Apache Kylin. Impact most to the kylin job service that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.

  9. CVE-2026-108762 – Non évaluée

    Apache Software Foundation Apache Kylin

    Path-confinement bypass during metadata backup deletion in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted. This issue affects Apache Kylin: from 4.0.0 through 5.0.4. Users are recommended to upgrade to version 5.0.5, which fixes the issue.