Login Request a demo
DR
Product
Druid
by Apache · last CVE Feb 10, 2026
12
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities12In the news0Timeline
Severity mix
Critical 2High 2Medium 8Low 0
Severity
All severities12Critical2High2Medium8Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Druid to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2024-45537
6.5
1%
Sep 17
Apache Druid: Users can provide MySQL JDBC properties not on allow list
Affected: before 30.0.1
CVE-2021-36749
6.5
81%
Sep 24
In the Druid ingestion system, the InputSource is used for reading data from a certain data source
Affected: before 0.22.0
CVE-2021-26920
6.5
9%
Jul 2
In the Druid ingestion system, the InputSource is used for reading data from a certain data source
Affected: before 0.22.0
CVE-2020-1958
6.5
5%
Apr 1
When LDAP authentication is enabled in Apache Druid 0.17.0, callers of Druid APIs with a valid set of LDAP credentials can bypass the credentialsValidator.userSearch filter…
Affected: 0.17.0
CVE-2021-44791
6.1
2%
Jul 7
Reflected XSS on certain HTTP endpoints
Affected: through 0.22.1
CVE-2025-27888
5.4
2%
Mar 20
Apache Druid: Server-Side Request Forgery and Cross-Site Scripting
Affected: before 31.0.2
CVE-2024-45384
5.3
1%
Sep 17
Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle Attack
Affected: 0.18.0 before 30.0.1
CVE-2022-28889
4.3
2%
Jul 7
Clickjacking in the web console
Affected: before 0.23.0
Showing 8