Login Request a demo
ST
Product
Storm
by Apache · last CVE Apr 27, 2026
14
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities14In the news0Timeline
Severity mix
Critical 4High 5Medium 5Low 0
Severity
All severities14Critical4High5Medium5Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Storm to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-35337
8.8
1%
Apr 13
Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling
Affected: 2.0.0 before 2.8.6
CVE-2018-1331
8.8
4%
Jul 10
In Apache Storm 0.10.0 through 0.10.2, 1.0.0 through 1.0.6, 1.1.0 through 1.1.2, and 1.2.0 through 1.2.1, an attacker with access to a secure storm cluster in some cases could…
Affected: after 0.10.0 through 0.10.2; 1.0.0 through 1.0.6; after 1.1.0 through 1.1.2; 1.2.0 through 1.2.1
CVE-2017-9799
8.8
5%
Aug 9
It was found that under some situations and configurations of Apache Storm 1.x before 1.0.4 and 1.1.x before 1.1.1, it is theoretically possible for the owner of a topology to…
Affected: 1.0; 1.0.1; 1.0.2; 1.0.3; 1.1
CVE-2019-0202
7.5
2%
Jul 26
The Apache Storm Logviewer daemon exposes HTTP-accessible endpoints to read/search log files on hosts running Storm
Affected: 0.9.3 through 1.2.2; 0.9.1; 0.9.2
CVE-2014-0115
7.5
5%
Oct 30
Directory traversal vulnerability in the log viewer in Apache Storm 0.9.0.1 allows remote attackers to read arbitrary files via a
Affected: 0.9.0.1
Showing 5