Login Request a demo
ST
Product
Storm
by Apache · last CVE Apr 27, 2026
14
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities14In the news0Timeline
Severity mix
Critical 4High 5Medium 5Low 0
Severity
All severities14Critical4High5Medium5Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Storm to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2021-40865
9.8
64%
Oct 25
An Unsafe Deserialization vulnerability exists in the worker services of the Apache Storm supervisor server allowing pre-auth Remote Code Execution (RCE)
Affected: 1.0.0 before 1.2.4; 2.1.0 before 2.1.1; 2.2.0 before 2.2.1
CVE-2021-38294
9.8
84%
Oct 25
A Command Injection vulnerability exists in the getTopologyHistory service of the Apache Storm 2.x prior to 2.2.1 and Apache Storm 1.x prior to 1.2.4
Affected: 1.0.0 before 1.2.4; 2.1.0 before 2.1.1; 2.2.0 before 2.2.1
CVE-2018-11779
9.8
3%
Jul 26
In Apache Storm versions 1.1.0 to 1.2.2, when the user is using the storm-kafka-client or storm-kafka modules, it is possible to cause the Storm UI daemon to deserialize user…
Affected: 1.1.0 through 1.2.2
CVE-2015-3188
9.8
14%
Jan 13
The UI daemon in Apache Storm 0.10.0 before 0.10.0-beta1 allows remote attackers to execute arbitrary code via unspecified vectors
Affected: 0.10.0
Showing 4