AD
Product
Apache Druid
7
CVEs
0
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 2High 0Medium 5Low 0
Watch
Add Apache Druid to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2024-45537 | 6.5 | Sep 17 | Apache Druid: Users can provide MySQL JDBC properties not on allow list Affected: through 30.0.0 |
| CVE-2021-44791 | 6.1 | Jul 7 | Reflected XSS on certain HTTP endpoints Affected: Apache Druid through 0.22.1 |
| CVE-2025-27888 | 5.4 | Mar 20 | Apache Druid: Server-Side Request Forgery and Cross-Site Scripting Affected: before 31.0.2; 32.0.0 |
| CVE-2024-45384 | 5.3 | Sep 17 | Apache Druid: Padding oracle in druid-pac4j extension that allows an attacker to manipulate a pac4j session cookie via Padding Oracle Attack Affected: 0.18.0 through 30.0.0 |
| CVE-2022-28889 | 4.3 | Jul 7 | Clickjacking in the web console Affected: through 0.22.1 |
Showing 5