AI
Product
Apache IoTDB
23
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 10High 8Medium 2Low 0
Watch
Add Apache IoTDB to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-40008 | 9.8 | Jul 10 | Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC Affected: 1.0.0 before 2.0.10 |
| CVE-2026-28564 | 9.8 | Jul 10 | Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials Affected: 1.0.0 before 2.0.10 |
| CVE-2026-24014 | 9.8 | Jul 6 | Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write Affected: 1.3.3 before 2.0.8 |
| CVE-2026-24713 | 9.8 | Mar 9 | Apache IoTDB: JEXL Expression Injection Vulnerability Affected: 1.0.0 before 1.3.7; 2.0.0 before 2.0.7 |
| CVE-2026-24015 | 9.8 | Mar 9 | Apache IoTDB: Insecure Default Configuration Vulnerability Affected: 1.0.0 before 1.3.7; 2.0.0 before 2.0.7 |
| CVE-2024-24780 | 9.8 | May 14 | Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function Affected: 1.0.0 before 1.3.4 |
| CVE-2026-40005 | 9.1 | Jul 10 | Apache IoTDB: Path Traversal in Pipe File Transfer Receiver Affected: 1.0.0 before 2.0.10 |
| CVE-2026-24013 | 9.1 | Jul 6 | Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC Affected: 1.3.3 before 2.0.8 |
| CVE-2025-64152 | 9.1 | Jun 26 | Apache IoTDB: Path Traversal Vulnerability Affected: 1.0.0 before 1.3.6; 2.0.0 before 2.0.7 |
| CVE-2025-55017 | 9.1 | Jun 26 | Apache IoTDB: Path Traversal Vulnerability Affected: 2.0.0 before 2.0.6; 1.0.0 before 1.3.6 |
| CVE-2026-44630 | 7.5 | Aug 10 | Apache IoTDB: RPC service denial of service via unchecked Thrift string length Affected: before 1.3.8; 2.0.0 before 2.0.10 |
| CVE-2026-40452 | 7.5 | Jul 10 | Apache IoTDB: Authorization bypass in /rest/v2/fastLastQuery exposes last-value data to unauthorized authenticated users Affected: 1.3.5 before 1.3.8; 2.0.5 before 2.0.10 |
| CVE-2026-40007 | 7.5 | Jul 10 | Apache IoTDB: Unauthenticated unbounded recursion in IoTDB AirGap receiver's E-language prefix parser causes per-connection StackOverflowError Affected: 1.0.0 before 2.0.10 |
| CVE-2026-40006 | 7.5 | Jul 10 | Apache IoTDB: Unauthenticated heap-exhaustion DoS via unbounded allocation in IoTDB AirGap pipe receiver Affected: 1.0.0 before 2.0.10 |
| CVE-2026-24012 | 7.5 | Jul 6 | Apache IoTDB: Denial of Service via Resource Exhaustion in Aggregation Query Affected: 1.3.3 before 2.0.8 |
| CVE-2025-48392 | 7.5 | Sep 24 | Apache IoTDB: DoS Vulnerability Affected: 1.3.3 through 1.3.4; 2.0.1-beta through 2.0.4 |
| CVE-2025-26864 | 7.5 | May 14 | Apache IoTDB: Exposure of Sensitive Information in IoTDB OpenID Authentication Affected: 0.10.0 through 1.3.3; 2.0.1-beta before 2.0.2 |
| CVE-2022-43766 | 7.5 | Oct 26 | Apache IoTDB prior to 0.13.3 allows DoS Affected: through 0.13.2; 0.12.2 before unspecified |
| CVE-2026-40009 | 6.5 | Jul 10 | Apache IoTDB: Authenticated users can escalate to full tree-path access by renaming themselves to __internal_auditor Affected: 2.0.8 before 2.0.10 |
| CVE-2025-48459 | 5.3 | Sep 24 | Apache IoTDB: Deserialization of untrusted Data Affected: 1.0.0 before 2.0.5 |
| CVE-2026-59229 | – | Oct 21 | Apache IoTDB: Legacy Pipe Privilege Escalation Affected: 2.0.0 before 2.0.11 |
| CVE-2026-59562 | – | Oct 21 | Apache IoTDB: Remote code execution and Unauthenticated path traversal in legacy pipe sendFile RPC Affected: 2.0.0 before 2.0.11 |
| CVE-2026-58663 | – | Oct 21 | Apache IoTDB: Auth Bypass in pipeTransfer() interface Affected: 2.0.0 before 2.0.11 |
Showing 23