Login Request a demo
KY
Product
Kylin
by Apache · last CVE Jul 14, 2026
On CISA KEVExploited in the wild
24
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities24In the news0Timeline
Severity mix
Critical 9High 11Medium 4Low 0
Severity
All severities24Critical9High11Medium4Low0
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Kylin to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2020-1956
In wildKEV
8.8
97%
May 22
Apache Kylin OS Command Injection Vulnerability
Affected: 2.3.0; <=2.6.5; <=3.0.1
CVE-2022-43396
8.8
55%
Dec 30
In the fix for CVE-2022-24697, a blacklist is used to filter user input commands
Affected: before 4.0.3
CVE-2020-1937
8.8
3%
Feb 24
Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries
Affected: 2.3.0 through 2.3.2; 2.4.0 through 2.4.1; 2.5.0 through 2.5.2; 2.6.0 through 2.6.4; 3.0.0; 3.0.0; +2 more
CVE-2025-61734
7.5
26%
Oct 2
Files or Directories Accessible to External Parties vulnerability in Apache Kylin
Affected: 4.0.0 before 5.0.3
CVE-2025-61733
7.5
1%
Oct 2
Authentication Bypass Using an Alternate Path or Channel vulnerability in Apache Kylin
Affected: 4.0.0 before 5.0.3
CVE-2023-29055
7.5
1%
Jan 29
In Apache Kylin version 2.0.0 to 4.0.3, there is a Server Config web interface that displays the content of file 'kylin.properties', that may contain serverside credentials
Affected: 2.0.0 before 4.0.4
CVE-2021-45458
7.5
2%
Jan 6
Apache Kylin provides encryption classes PasswordPlaceholderConfigurer to help users encrypt their passwords
Affected: 2.0.0 through 2.6.6; 3.0.0 before 3.1.3; 4.0.0; 4.0.0; 4.0.0
CVE-2021-45457
7.5
2%
Jan 6
In Apache Kylin, Cross-origin requests with credentials are allowed to be sent from any origin
Affected: 2.0.0 through 2.6.6; 3.0.0 before 3.1.3; 4.0.0; 4.0.0; 4.0.0
CVE-2021-27738
7.5
3%
Jan 6
All request mappings in `StreamingCoordinatorController.java` handling `/kylin/api/streaming_coordinator/*` REST API endpoints did not include any security checks, which allowed…
Affected: 3.0.0 before 3.1.2
CVE-2025-61735
7.3
1%
Oct 2
Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin
Affected: 4.0.0 before 5.0.3
CVE-2025-30067
7.2
1%
Mar 27
Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin
Affected: 4.0.0 before 5.0.2
Showing 11