IO
Product
Iotdb
20
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 9High 10Medium 1Low 0
Watch
Add Iotdb to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-24014 | 9.8 | Jul 6 | Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write Affected: 1.3.3 before 2.0.8 |
| CVE-2026-24713 | 9.8 | Mar 9 | Improper Input Validation vulnerability in Apache IoTDB Affected: 1.0.0 before 1.3.7; 2.0.0 before 2.0.7 |
| CVE-2026-24015 | 9.8 | Mar 9 | A vulnerability in Apache IoTDB Affected: 1.0.0 before 1.3.7; 2.0.0 before 2.0.7 |
| CVE-2024-24780 | 9.8 | May 14 | Remote Code Execution with untrusted URI of UDF vulnerability in Apache IoTDB Affected: 1.0.0 before 1.3.4 |
| CVE-2023-46226 | 9.8 | Jan 15 | Remote Code Execution vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 1.0.0 through 1.2.2 Affected: 1.0.0 before 1.3.0 |
| CVE-2023-51656 | 9.8 | Dec 21 | Deserialization of Untrusted Data vulnerability in Apache IoTDB.This issue affects Apache IoTDB: from 0.13.0 through 0.13.4 Affected: 0.13.0 through 0.13.4 |
| CVE-2023-24831 | 9.8 | Apr 17 | Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects Apache IoTDB Grafana Connector: from 0.13.0 through 0.13.3 Affected: 0.13.0 through 0.13.3 |
| CVE-2020-1952 | 9.8 | Apr 27 | An issue was found in Apache IoTDB .9.0 to 0.9.1 and 0.8.0 to 0.8.2 Affected: 0.8.0 through 0.8.2; 0.9.0 through 0.9.1 |
| CVE-2026-24013 | 9.1 | Jul 6 | Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC Affected: 1.3.3 before 2.0.8 |
| CVE-2023-24829 | 8.8 | Jan 31 | Incorrect Authorization vulnerability in Apache Software Foundation Apache IoTDB.This issue affects the iotdb-web-workbench component from 0.13.0 before 0.13.3 Affected: 0.13.0 before 0.13.3 |
| CVE-2022-38369 | 8.8 | Sep 5 | Apache IoTDB version 0.13.0 is vulnerable by session id attack Affected: 0.13.0 |
| CVE-2026-24012 | 7.5 | Jul 6 | Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query Affected: 1.3.3 before 2.0.8 |
| CVE-2025-48392 | 7.5 | Sep 24 | A vulnerability in Apache IoTDB Affected: 1.3.3 through 1.3.4; 2.0.1 before 2.0.5 |
| CVE-2025-26864 | 7.5 | May 14 | Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in the OpenIdAuthorizer of Apache IoTDB Affected: 0.10.0 before 1.3.4; 2.0.1 |
| CVE-2025-26795 | 7.5 | May 14 | Exposure of Sensitive Information to an Unauthorized Actor, Insertion of Sensitive Information into Log File vulnerability in Apache IoTDB JDBC driver Affected: 0.10.0 before 1.3.4; 2.0.1 before 2.0.2 |
| CVE-2023-24830 | 7.5 | Jan 30 | Improper Authentication vulnerability in Apache Software Foundation Apache IoTDB.This issue affects iotdb-web-workbench component: from 0.13.0 before 0.13.3 Affected: 0.13.0 before 0.13.3 |
| CVE-2022-43766 | 7.5 | Oct 26 | Apache IoTDB prior to 0.13.3 allows DoS Affected: 0.12.2 through 0.12.6; 0.13.0 through 0.13.2 |
| CVE-2022-38370 | 7.5 | Sep 5 | Apache IoTDB grafana-connector version 0.13.0 contains an interface without authorization, which may expose the internal structure of database Affected: 0.13.0 |
| CVE-2020-25649 | 7.5 | Dec 3 | A flaw was found in FasterXML Jackson Databind, where it did not have entity expansion secured properly Affected: before 0.12.0 |
| CVE-2025-48459 | 5.3 | Sep 24 | Deserialization of Untrusted Data vulnerability in Apache IoTDB Affected: 1.0.0 before 2.0.5 |
Showing 20