AS
Product
Apache Spark
On CISA KEVExploited in the wild
7
CVEs
1
On KEV
8.8
Max CVSS
0
New 30D
Severity mix
Critical 0High 2Medium 5Low 0
Watch
Add Apache Spark to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-32773 | 6.1 | Sep 2 | Apache Spark: XSS Vulnerability in Spark Web 3.5.4 Affected: 3.0.0 before 3.5.8 |
| CVE-2024-23945 | 5.9 | Dec 23 | Apache Hive, Apache Spark, Apache Spark: CookieSigner exposes the correct signature when message verification fails Affected: 2.0.0 before 3.0.0; 3.0.0 before 3.3.4; 3.4.0 before 3.4.2; 3.5.0 |
| CVE-2018-11760 | 5.5 | Feb 4 | When using PySpark , it's possible for a different local user to connect to the Spark application and impersonate the user running the Spark application Affected: Apache Spark 1.x, 2.0.x, 2.1.x, 2.2.0 to 2.2.2, and 2.3.0 to 2.3.1 |
| CVE-2022-31777 | 5.4 | Nov 1 | Apache Spark XSS vulnerability in log viewer UI Javascript Affected: 3.3.0; 3.2.1 and earlier through 3.2.1 |
| CVE-2018-11770 | 4.2 | Aug 13 | From version 1.3.0 onward, Apache Spark's standalone master exposes a REST API for job submission, in addition to the submission mechanism used by spark-submit Affected: 1.3.0 before 2.4.0 |
Showing 5