Login Request a demo
AK
Product
Apache Kylin
by Apache Software Foundation · last CVE Oct 19, 2026
25
CVEs
0
On KEV
9.8
Max CVSS
21
New 30D
Vulnerabilities25In the news0Timeline
Severity mix
Critical 8High 7Medium 1Low 0
Severity
All severities25Critical8High7Medium1Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Apache Kylin to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-108709
9.8
0%
Oct 16
Apache Kylin: Unauthenticated Metadata Broadcast (inside in-house network)
Affected: 4.0.4 through 5.0.4
CVE-2026-68573
9.8
0%
Oct 16
Apache Kylin: Unauthenticated Metastore Cleanup
Affected: 4.0.0 through 5.0.4
CVE-2026-64959
9.8
0%
Oct 16
Apache Kylin: Missing authentication on certain cache API endpoints
Affected: 5.0.0 through 5.0.4
CVE-2026-64610
9.8
0%
Oct 16
Apache Kylin: Redis unsafe Java deserialization
Affected: 4..0.0 through 5.0.4
CVE-2026-62392
9.8
2%
Jul 14
Apache Kylin: OS Command Injection via Async Query API
Affected: 4 through 5.0.3
CVE-2026-62390
9.8
1%
Jul 14
Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API
Affected: 4 through 5.0.3
CVE-2022-24697
9.8
85%
Oct 13
Apache Kylin prior to 4.0.2 allows command injection when the configuration overwrites function overwrites system parameters
Affected: Apache Kylin 2 before 2.6.6; Apache Kylin 3 through 3.1.2; Apache Kylin 4 through 4.0.1
CVE-2026-63619
9.1
0%
Oct 16
Apache Kylin: Missing authorization and path-confinement on system meta dump
Affected: 4..0.0 through 5.0.4
Showing 8