AI
Product
Apache IoTDB
17
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 7High 6Medium 1Low 0
Watch
Add Apache IoTDB to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-40008 | 9.8 | Jul 10 | Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC Affected: 1.0.0 before 2.0.10 |
| CVE-2026-28564 | 9.8 | Jul 10 | Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials Affected: 1.0.0 before 2.0.10 |
| CVE-2026-24014 | 9.8 | Jul 6 | Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write Affected: 1.3.3 before 2.0.8 |
| CVE-2026-40005 | 9.1 | Jul 10 | Apache IoTDB: Path Traversal in Pipe File Transfer Receiver Affected: 1.0.0 before 2.0.10 |
| CVE-2026-24013 | 9.1 | Jul 6 | Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC Affected: 1.3.3 before 2.0.8 |
| CVE-2025-64152 | 9.1 | Jun 26 | Apache IoTDB: Path Traversal Vulnerability Affected: 1.0.0 before 1.3.6; 2.0.0 before 2.0.7 |
| CVE-2025-55017 | 9.1 | Jun 26 | Apache IoTDB: Path Traversal Vulnerability Affected: 2.0.0 before 2.0.6; 1.0.0 before 1.3.6 |
| CVE-2026-44630 | 7.5 | Aug 10 | Apache IoTDB: RPC service denial of service via unchecked Thrift string length Affected: before 1.3.8; 2.0.0 before 2.0.10 |
| CVE-2026-40452 | 7.5 | Jul 10 | Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users Affected: 1.3.5 before 1.3.8; 2.0.5 before 2.0.10 |
| CVE-2026-40007 | 7.5 | Jul 10 | Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per-connection StackOverflowError Affected: 1.0.0 before 2.0.10 |
| CVE-2026-40006 | 7.5 | Jul 10 | Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver Affected: 1.0.0 before 2.0.10 |
| CVE-2026-24012 | 7.5 | Jul 6 | Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query Affected: 1.3.3 before 2.0.8 |
| CVE-2022-43766 | 7.5 | Oct 26 | Apache IoTDB prior to 0.13.3 allows DoS Affected: through 0.13.2; 0.12.2 before unspecified |
| CVE-2026-40009 | 6.5 | Jul 10 | Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor Affected: 2.0.8 before 2.0.10 |
| CVE-2026-59229 | – | Oct 21 | Apache IoTDB: Legacy Pipe Privilege Escalation Affected: 2.0.0 before 2.0.11 |
| CVE-2026-59562 | – | Oct 21 | Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC Affected: 2.0.0 before 2.0.11 |
| CVE-2026-58663 | – | Oct 21 | Apache IoTDB: Auth Bypass in pipeTransfer() interface Affected: 2.0.0 before 2.0.11 |
Showing 17