Apache / Inlong
42 CVEs
| CVE ID | Description | Severity | CVSS | Published |
|---|---|---|---|---|
| CVE-2026-63046 | Apache InLong: Agent Installer — Command Injection to RCE via Default Credentials | HIGH | 8.8 | Aug 21, 2026 |
| CVE-2026-63044 | Apache InLong: Authenticated SSRF via POST /api/node/testConnection | MEDIUM | 5.4 | Aug 20, 2026 |
| CVE-2026-63043 | Apache InLong: Agent path traversal via unvalidated file source path | HIGH | 7.5 | Aug 20, 2026 |
| CVE-2026-63042 | Apache InLong: Missing authorization on DataNode management endpoints | HIGH | 8.1 | Aug 20, 2026 |
| CVE-2026-63040 | Apache InLong: Missing authorization in StreamSource forceDelete | HIGH | 8.1 | Aug 20, 2026 |
| CVE-2026-63039 | Apache InLong: SQL Injection via Unvalidated MyBatis Dollar-Sign Interpolation in AuditAlertRuleService | CRITICAL | 9.8 | Aug 20, 2026 |
| CVE-2026-63038 | Apache InLong: SQL Injection via String Concatenation Vulnerability Report | CRITICAL | 9.8 | Aug 20, 2026 |
| CVE-2026-63037 | Apache InLong: Unauthenticated SQL injection in Manager OpenAPI audit alert rule list endpoint | CRITICAL | 9.8 | Aug 20, 2026 |
| CVE-2026-63016 | Apache InLong: Ordinary users can create new packages | MEDIUM | 5.3 | Aug 20, 2026 |
| CVE-2026-63015 | Apache InLong: Non-template responsible persons can view template information | MEDIUM | 4.3 | Aug 20, 2026 |
| CVE-2025-27531 | Apache InLong: An arbitrary file read vulnerability for JDBC | HIGH | 8.1 | Jun 6, 2025 |
| CVE-2025-27528 | Apache InLong: JDBC Vulnerability for Invisible Character Bypass Leading to Arbitrary File Read | MEDIUM | 6.6 | May 28, 2025 |
| CVE-2025-27526 | Apache InLong: JDBC Vulnerability For URLEncode and backspace bypass | MEDIUM | 6.5 | May 28, 2025 |
| CVE-2025-27522 | Apache InLong: JDBC Vulnerability during verification processing | HIGH | 8.1 | May 28, 2025 |
| CVE-2024-36268 | Apache InLong TubeMQ Client: Remote Code Execution vulnerability | HIGH | 7.2 | Aug 2, 2024 |
| CVE-2024-26579 | Apache Inlong JDBC Vulnerability | CRITICAL | 9.8 | May 8, 2024 |
| CVE-2024-26580 | Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability | CRITICAL | 9.3 | Mar 6, 2024 |
| CVE-2023-51784 | Apache InLong: Remote Code Execution vulnerability in Apache InLong Manager | CRITICAL | 9.8 | Jan 3, 2024 |
| CVE-2023-51785 | Apache InLong: Arbitrary File Read Vulnerability in Apache InLong Manager | HIGH | 7.5 | Jan 3, 2024 |
| CVE-2023-46227 | Apache inlong has an Arbitrary File Read Vulnerability | HIGH | 7.5 | Oct 19, 2023 |
| CVE-2023-43666 | Apache InLong: General user Unauthorized access User Management | MEDIUM | 6.5 | Oct 16, 2023 |
| CVE-2023-43667 | Apache InLong: Log Injection in Global functions | HIGH | 7.5 | Oct 16, 2023 |
| CVE-2023-43668 | Apache InLong: Jdbc Connection Security Bypass in InLong | CRITICAL | 9.8 | Oct 16, 2023 |
| CVE-2023-35088 | Apache InLong: SQL injection in audit endpoint | CRITICAL | 9.3 | Jul 25, 2023 |
| CVE-2023-34434 | Apache InLong: JDBC URL bypassing by allowLoadLocalInfileInPath param | HIGH | 8.7 | Jul 25, 2023 |
Showing 1 to 25 of 42 CVEs