DO
Product
Dolphinscheduler
34
CVEs
0
On KEV
9.8
Max CVSS
1
New 30D
Severity mix
Critical 8High 15Medium 11Low 0
Watch
Add Dolphinscheduler to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-49050 | 8.8 | Aug 25 | Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens Affected: before 3.4.2 |
| CVE-2024-43115 | 8.8 | Sep 3 | Improper Input Validation vulnerability in Apache DolphinScheduler Affected: before 3.2.2 |
| CVE-2024-29831 | 8.8 | Aug 12 | Improper Input Validation vulnerability in Apache DolphinScheduler Affected: before 3.2.2 |
| CVE-2024-23320 | 8.8 | Feb 23 | Improper Input Validation vulnerability in Apache DolphinScheduler Affected: before 3.2.1 |
| CVE-2023-49299 | 8.8 | Dec 30 | Improper Input Validation vulnerability in Apache DolphinScheduler Affected: before 3.1.9 |
| CVE-2021-27644 | 8.8 | Nov 1 | In Apache DolphinScheduler before 1.3.6 versions, authorized users can use SQL injection in the data source center Affected: before 1.3.6 |
| CVE-2026-23902 | 8.1 | Apr 24 | Apache DolphinScheduler: Users are able to use tenants that are not defined on the platform during workflow execution. Affected: before 3.4.1 |
| CVE-2024-30188 | 8.1 | Aug 12 | File read and write vulnerability in Apache DolphinScheduler , authenticated users can illegally access additional resource files Affected: 3.1.0 before 3.2.2 |
| CVE-2025-62188 | 7.5 | Apr 9 | Apache DolphinScheduler: Users can access sensitive information through the actuator endpoint. Affected: 3.1.0 before 3.2.0 |
| CVE-2023-51770 | 7.5 | Feb 20 | Arbitrary File Read Vulnerability in Apache Dolphinscheduler Affected: 1.2.0 before 3.2.1 |
| CVE-2023-49068 | 7.5 | Nov 27 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler.This issue affects Apache DolphinScheduler: before 3.2.1 Affected: before 3.2.1 |
| CVE-2023-48796 | 7.5 | Nov 24 | Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache DolphinScheduler Affected: 3.0.0 before 3.0.2 |
| CVE-2022-26885 | 7.5 | Nov 24 | When using tasks to read config files, there is a risk of database password disclosure Affected: before 2.0.6 |
| CVE-2022-25598 | 7.5 | Mar 30 | Apache DolphinScheduler user registration is vulnerable to Regular express Denial of Service (ReDoS) attacks, Apache DolphinScheduler users should upgrade to version 2.0.5 or… Affected: before 2.0.5 |
| CVE-2023-49250 | 7.3 | Feb 20 | Because the HttpUtils class did not verify certificates, an attacker that could perform a Man-in-the-Middle (MITM) attack on outgoing https connections could impersonate the… Affected: before 3.2.1 |
Showing 15