WaratekVRT Sign in

Critical Org.apache.dolphinscheduler CVEs

8 CVEs, 2 protected by Waratek

Reset
More filters (1)
Columns
Vendor org.apache.dolphinscheduler✕
Overview 8 matches · 2 protected · 0 exploited · 0 CISA KEV · 0 public PoC · 0 EPSS ≥ 0.5
8matches 2protected25.0% 0exploited0.0% 0CISA KEV0.0% 0public PoC0.0% 0EPSS ≥ 0.50.0%
Protected by Waratek 2 25.0% Rule in development 0 0.0% Mitigation candidate 0 0.0% No exploit published 6 75.0%
Critical 8 100.0% High 0 0.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%
blocked by ARMR today 2 25.0% partly blocked 0 0.0% not blocked 6 75.0% not established 0 0.0% unrecorded 0 0.0%
Exploited 0 0.0% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 8 100.0%
split by peak 2 / quarter
No exploit published: 6Protected by Waratek: 2 Critical: 8 not blocked: 6blocked by ARMR today: 2 No public exploit: 8
Q4 201 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q1 210 Q2 210 Q3 210 Q4 210 Q1 220 Q2 220 Q3 220 Q4 221 Protected by Waratek1 Critical1 blocked by ARMR today1 No public exploit1 Q1 231 No exploit published1 Critical1 not blocked1 No public exploit1 Q2 230 Q3 230 Q4 230 Q1 241 No exploit published1 Critical1 not blocked1 No public exploit1 Q2 240 Q3 241 No exploit published1 Critical1 not blocked1 No public exploit1 Q4 240 Q1 250 Q2 250 Q3 251 No exploit published1 Critical1 not blocked1 No public exploit1 Q4 250 Q1 260 Q2 262 No exploit published2 Critical2 not blocked2 No public exploit2
Q4 20Q2 21Q4 21Q2 22Q4 22Q2 23Q4 23Q2 24Q4 24Q2 25Q4 25Q2 26
8 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.
CVE Severity Published▾ Status Exploitation Description
CVE-2026-32967 Critical 2026-06-17 No exploit published No public exploit Incorrect Authorization vulnerability of `/v2` experimental interface in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.
CVE-2026-32966 Critical 2026-06-17 No exploit published No public exploit DataSource API Missing Authorization Check Leads to Arbitrary Data Source Metadata Disclosure in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.4.2. Users are recommended to upgrade to version 3.4.2, which fixes the issue.
CVE-2024-43166 Critical 2025-09-03 No exploit published No public exploit Incorrect Default Permissions vulnerability in Apache DolphinScheduler. This issue affects Apache DolphinScheduler: before 3.2.2. Users are recommended to upgrade to version 3.3.1, which fixes the issue.
CVE-2024-43202 Critical 2024-08-20 No exploit published No public exploit Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.2. We recommend users to upgrade Apache DolphinScheduler to version 3.2.2, which fixes the issue.
CVE-2023-49109 Critical 2024-02-20 No exploit published No public exploit Exposure of Remote Code Execution in Apache Dolphinscheduler. This issue affects Apache DolphinScheduler: before 3.2.1. We recommend users to upgrade Apache DolphinScheduler to version 3.2.1, which fixes the issue.
CVE-2022-45875 Critical 2023-01-04 No exploit published No public exploit Improper validation of script alert plugin parameters in Apache DolphinScheduler to avoid remote command execution vulnerability. This issue affects Apache DolphinScheduler version 3.0.1 and prior versions; version 3.1.0 and prior versions. This attack can be performed only by authenticated users which can login to DS.
CVE-2022-45462 Critical 2022-11-23 Protected by Waratek No public exploit Alarm instance management has command injection when there is a specific command configured. It is only for logged-in users. We recommend you upgrade to version 2.0.6 or higher
CVE-2020-11974 Critical 2020-12-18 Protected by Waratek No public exploit In DolphinScheduler 1.2.0 and 1.2.1, with mysql connectorj a remote code execution vulnerability exists when choosing mysql as database.