Login Request a demo
AI
Product
Apache IoTDB
by Apache Software Foundation · last CVE Oct 21, 2026
25
CVEs
0
On KEV
9.8
Max CVSS
3
New 30D
Vulnerabilities25In the news0Timeline
Severity mix
Critical 12High 8Medium 2Low 0
Severity
All severities25Critical12High8Medium2Low0
Exploitation
On CISA KEV0Exploited in the wild0
Watch

Add Apache IoTDB to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2026-40008
9.8
1%
Jul 10
Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfer RPC
Affected: 1.0.0 before 2.0.10
CVE-2026-28564
9.8
1%
Jul 10
Apache IoTDB: REST Basic Authentication Accepts Stale Cached Credentials
Affected: 1.0.0 before 2.0.10
CVE-2026-24014
9.8
1%
Jul 6
Apache IoTDB: Path Traversal in DataNode Internal RPC Trigger JAR Upload Allows Arbitrary File Write
Affected: 1.3.3 before 2.0.8
CVE-2026-24713
9.8
1%
Mar 9
Apache IoTDB: JEXL Expression Injection Vulnerability
Affected: 1.0.0 before 1.3.7; 2.0.0 before 2.0.7
CVE-2026-24015
9.8
1%
Mar 9
Apache IoTDB: Insecure Default Configuration Vulnerability
Affected: 1.0.0 before 1.3.7; 2.0.0 before 2.0.7
CVE-2024-24780
9.8
1%
May 14
Apache IoTDB: Remote Code Execution with untrusted URI of User-defined function
Affected: 1.0.0 before 1.3.4
CVE-2023-46226
9.8
2%
Jan 15
Apache IoTDB: Remote Code Execution (RCE) risk via the UDF
Affected: 1.0.0 through 1.2.2
CVE-2023-51656
9.8
1%
Dec 21
Apache IoTDB: Unsafe deserialize map in Sync Tool
Affected: 0.13.0 through 0.13.4
CVE-2026-40005
9.1
1%
Jul 10
Apache IoTDB: Path Traversal in Pipe File Transfer Receiver
Affected: 1.0.0 before 2.0.10
CVE-2026-24013
9.1
1%
Jul 6
Apache IoTDB: Authentication Bypass via Forged SessionID in Thrift RPC
Affected: 1.3.3 before 2.0.8
CVE-2025-64152
9.1
1%
Jun 26
Apache IoTDB: Path Traversal Vulnerability
Affected: 1.0.0 before 1.3.6; 2.0.0 before 2.0.7
CVE-2025-55017
9.1
1%
Jun 26
Apache IoTDB: Path Traversal Vulnerability
Affected: 2.0.0 before 2.0.6; 1.0.0 before 1.3.6
Showing 12