WaratekVRT Sign in
Reset
More filters (2)
Columns
Including CVEs outside Waratek scope✕Vendor org.apache.kylin✕Product kylin-server✕
Overview 7 matches · 5 protected · 1 exploited · 0 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5
7matches 5protected71.4% 1exploited14.3% 0CISA KEV0.0% 1public PoC14.3% 1EPSS ≥ 0.514.3%
Protected by Waratek 5 71.4% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 2 28.6% Outside Waratek scope 0 0.0% Not applicable 0 0.0% Withdrawn CVE 0 0.0%
Critical 4 57.1% High 3 42.9% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 5 71.4% partly blocked 0 0.0% not blocked 2 28.6% not established 0 0.0% unrecorded 0 0.0%
Exploited 1 14.3% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 1 14.3% No public exploit 5 71.4%
split by peak 2 / quarter
No exploit published: 2Protected by Waratek: 5 High: 3Critical: 4 not blocked: 2blocked by ARMR today: 5 No public exploit: 5Forecast only: 1Exploited: 1
Q1 201 Protected by Waratek1 High1 blocked by ARMR today1 No public exploit1 Q2 200 Q3 202 Protected by Waratek2 Critical2 blocked by ARMR today2 Exploited1 No public exploit1 Q4 200 Q1 210 Q2 210 Q3 210 Q4 210 Q1 220 Q2 220 Q3 220 Q4 222 Protected by Waratek2 Critical2 blocked by ARMR today2 Forecast only1 No public exploit1 Q1 230 Q2 230 Q3 230 Q4 230 Q1 240 Q2 240 Q3 240 Q4 240 Q1 250 Q2 250 Q3 250 Q4 252 No exploit published2 High2 not blocked2 No public exploit2
Q2 20Q4 20Q2 21Q4 21Q2 22Q4 22Q2 23Q4 23Q2 24Q4 24Q2 25Q4 25
7 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2025-61735 High 2025-10-02 No exploit published No public exploit Server-Side Request Forgery (SSRF) vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. You are fine as long as the Kylin's system and project admin access is well protected. Users are recommended to upgrade to version 5.0.3, which fixes the issue.
CVE-2025-61734 High 2025-10-02 No exploit published No public exploit Files or Directories Accessible to External Parties vulnerability in Apache Kylin. You are fine as long as the Kylin's system and project admin access is well protected. This issue affects Apache Kylin: from 4.0.0 through 5.0.2. Users are recommended to upgrade to version 5.0.3, which fixes the issue.
CVE-2022-44621 Critical 2022-12-30 Protected by Waratek No public exploit Diagnosis Controller miss parameter validation, so user may attacked by command injection via HTTP Request.
CVE-2022-24697 Critical 2022-10-13 Protected by Waratek Forecast only Kylin's cube designer function has a command injection vulnerability when overwriting system parameters in the configuration overwrites menu. RCE can be implemented by closing the single quotation marks around the parameter value of “-- conf=” to inject any operating system command into the command line parameters. This vulnerability affects Kylin 2 version 2.6.5 and earlier, Kylin 3 version 3.1.2 and earlier, and Kylin 4 version 4.0.1 and earlier.
CVE-2020-13926 Critical 2020-07-14 Protected by Waratek No public exploit Kylin concatenates and executes a Hive SQL in Hive CLI or beeline when building a new segment; some part of the HQL is from system configurations, while the configuration can be overwritten by certain rest api, which makes SQL injection attack is possible. Users of all previous versions after 2.0 should upgrade to 3.1.0.
CVE-2020-13925 Critical 2020-07-14 Protected by Waratek Exploited Similar to CVE-2020-1956, Kylin has one more restful API which concatenates the API inputs into OS commands and then executes them on the server; while the reported API misses necessary input validation, which causes the hackers to have the possibility to execute OS command remotely. Users of all previous versions after 2.3 should upgrade to 3.1.0.
CVE-2020-1937 High 2020-02-24 Protected by Waratek No public exploit Kylin has some restful apis which will concatenate SQLs with the user input string, a user is likely to be able to run malicious database queries.