Login Request a demo
CA
Product
Cassandra
by Apache · last CVE Apr 7, 2026
On CISA KEVExploited in the wild
16
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities16In the news0Timeline
Severity mix
Critical 3High 6Medium 6Low 0
Severity
All severities16Critical3High6Medium6Low0
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Cassandra to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-27314
8.8
0%
Apr 7
Apache Cassandra: Privilege escalation via ADD IDENTITY authorization bypass
Affected: 5.0.0 before 5.0.7
CVE-2025-26467
8.8
1%
Aug 25
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra
Affected: 3.0.0 before 3.0.31; 3.11.0 before 3.11.18; 4.0.0 before 4.0.17; 4.1.0 before 4.1.8; 5.0.0 before 5.0.3
CVE-2025-23015
8.8
1%
Feb 4
Privilege Defined With Unsafe Actions vulnerability in Apache Cassandra
Affected: 3.0.0 before 3.0.31; 3.1 before 3.11.18; 4.0.0 before 4.0.16; 4.1.0 before 4.1.8; 5.0.0 before 5.0.3
CVE-2023-30601
7.8
0%
May 30
Privilege escalation when enabling FQL/Audit logs allows user with JMX access to run arbitrary commands as the user running Apache Cassandra This issue affects Apache Cassandra:…
Affected: 4.0.0 before 4.0.10; 4.1.0 before 4.1.2
CVE-2020-17516
7.5
2%
Feb 3
Apache Cassandra versions 2.1.0 to 2.1.22, 2.2.0 to 2.2.19, 3.0.0 to 3.0.23, and 3.11.0 to 3.11.9, when using 'dc' or 'rack' internode_encryption setting, allows both encrypted…
Affected: 2.1.0 through 2.1.22; 2.2.0 through 2.2.19; 3.0.0 through 3.0.23; 3.11.0 through 3.11.9
CVE-2016-4970
7.5
11%
Apr 13
handler/ssl/OpenSslEngine.java in Netty 4.0.x before 4.0.37.Final and 4.1.x before 4.1.1.Final allows remote attackers to cause a denial of service (infinite loop)
Affected: 3.11.4
Showing 6