KY
Product
Kylin
On CISA KEVExploited in the wild
24
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 9High 11Medium 4Low 0
Watch
Add Kylin to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-62392 | 9.8 | Jul 14 | Apache Kylin: OS Command Injection via Async Query API Affected: 4.0.0 before 5.0.4 |
| CVE-2026-62390 | 9.8 | Jul 14 | Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API Affected: 4.0.0 before 5.0.4 |
| CVE-2022-44621 | 9.8 | Dec 30 | Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request Affected: before 4.0.3 |
| CVE-2022-24697 | 9.8 | Oct 13 | Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters Affected: 2.0.0 before 2.6.6; 3.0.0 through 3.1.2; 4.0.0 through 4.0.1 |
| CVE-2021-45456 | 9.8 | Jan 6 | Apache kylin checks the legitimacy of the project before executing some commands with the project name passed in by the user Affected: 4.0.0; 4.0.0; 4.0.0 |
| CVE-2021-31522 | 9.8 | Jan 6 | Kylin can receive user input and load any class through Class.forName(...) Affected: 2.0.0 through 2.6.6; 3.0.0 before 3.1.3; 4.0.0; 4.0.0; 4.0.0 |
| CVE-2020-13926 | 9.8 | Jul 14 | Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be… Affected: 2.0.0 before 3.1.0 |
| CVE-2020-13925 | 9.8 | Jul 14 | Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses… Affected: 2.3.0 before 3.1.0 |
| CVE-2024-23590 | 9.1 | Nov 4 | Session Fixation vulnerability in Apache Kylin Affected: 2.0.0 before 5.0.0 |
Showing 9