Login Request a demo
DR
Product
Druid
by Apache · last CVE Feb 10, 2026
12
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities12In the news0Timeline
Severity mix
Critical 2High 2Medium 8Low 0
Severity
All severities12Critical2High2Medium8Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Druid to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-45537
6.5
1%
Sep 17
Apache Druid allows users with certain permissions to read data from other database systems using JDBC
Affected: before 30.0.1
CVE-2021-36749
6.5
81%
Sep 24
In the Druid ingestion system, the InputSource is used for reading data from a certain data source
Affected: before 0.22.0
CVE-2021-26920
6.5
9%
Jul 2
In the Druid ingestion system, the InputSource is used for reading data from a certain data source
Affected: before 0.22.0
CVE-2020-1958
6.5
5%
Apr 1
When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter…
Affected: 0.17.0
CVE-2021-44791
6.1
2%
Jul 7
In Apache Druid 0.22.1 and earlier, certain specially-crafted links result in unescaped URL parameters being sent back in HTML responses
Affected: through 0.22.1
CVE-2025-27888
5.4
2%
Mar 20
Apache Druid: Server-Side Request Forgery and Cross-Site Scripting
Affected: before 31.0.2
CVE-2024-45384
5.3
1%
Sep 17
Padding Oracle vulnerability in Apache Druid extension, druid-pac4j
Affected: 0.18.0 before 30.0.1
CVE-2022-28889
4.3
2%
Jul 7
In Apache Druid 0.22.1 and earlier, the server did not set appropriate headers to prevent clickjacking
Affected: before 0.23.0
Showing 8