Apache Zeppelin vulnerabilities | LiveThreat CVE Feed — Verisq

Login Request a demo

AZ

Product

Apache Zeppelin

by Apache Software Foundation · last CVE Jul 31, 2026

8

CVEs

0

On KEV

7.5

Max CVSS

0

New 30D

Vulnerabilities8 In the news0 Timeline

Severity mix

Critical 0High 1Medium 7Low 0

Severity

All severities8 Critical0 High1 Medium7 Low0

Exploitation

On CISA KEV0 Exploited in the wild0

Watch

Add Apache Zeppelin to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2026-44615	6.5	1%	Jul 31	Path traversal in NotebookRepo note and folder path composition Affected: 0.9.0 before 0.12.1
CVE-2026-44617	6.5	1%	Jul 30	Apache Zeppelin: LDAP filter injection in LdapRealm — incomplete fix of CVE-2024-31867 Affected: 0.11.1 before 0.12.1
CVE-2026-44616	6.5	1%	Jul 30	Apache Zeppelin: LDAP injection in ActiveDirectoryGroupRealm filter construction Affected: 0.6.0 before 0.12.1
CVE-2026-44613	6.1	0%	Jul 30	Apache Zeppelin: Cross-site request forgery in REST and WebSocket request handling Affected: 0.6.0 before 0.12.1
CVE-2024-41177	6.1	1%	Aug 3	Apache Zeppelin: XSS in the Helium module Affected: before 0.12.0
CVE-2024-51775	5.3	0%	Aug 3	Apache Zeppelin: Command Injection via CSWSH Affected: 0.11.1 before 0.12.0
CVE-2024-52279	5.3	1%	Aug 3	Apache Zeppelin: Arbitrary file read by adding malicious JDBC connection string Affected: 0.11.1 before 0.12.0