Apache Software Foundation Apache Kylin vulnerabilities

12 CVEs affecting Apache Software Foundation Apache Kylin, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-69080, published 2026-10-16.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2026-108743, published 2026-10-16. EPSS: 1% chance of exploitation in the next 30 days. Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public…
CVE-2026-63618, published 2026-10-16. High severity, CVSS 7.5. EPSS: 0.4% chance of exploitation in the next 30 days. Exposure of Sensitive Information (system level configuration info) to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are…
CVE-2026-64610, published 2026-10-16. EPSS: 0.4% chance of exploitation in the next 30 days. Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin: from 4 through…
CVE-2026-64959, published 2026-10-16. EPSS: 0.3% chance of exploitation in the next 30 days. Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services…
CVE-2026-108709, published 2026-10-16. EPSS: 0.3% chance of exploitation in the next 30 days. Authentication bypass within in-house network in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are…
CVE-2026-68573, published 2026-10-16. EPSS: 0.2% chance of exploitation in the next 30 days. Improper Authentication vulnerability in Apache Kylin. Unauthenticated user may access to system cleanup actions. Impact most to the kylin services that are directly exposed to public network, which…
CVE-2026-68571, published 2026-10-16. EPSS: 0.2% chance of exploitation in the next 30 days. Improper Control of Generation of Code ('Code Injection') vulnerability in Apache Kylin. Special parameter in JDBC URL can lead to code injection. Impact most to the kylin services that are directly…
CVE-2026-69080, published 2026-10-16. EPSS: 0.2% chance of exploitation in the next 30 days. Exposure of SQL Black List to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version 5.0.5,…
CVE-2026-69077, published 2026-10-16. EPSS: 0.2% chance of exploitation in the next 30 days. Exposure of unauthorized cross-project job manipulation vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house…
CVE-2026-69076, published 2026-10-16. EPSS: 0.2% chance of exploitation in the next 30 days. Exposure of Job Discard to an Unauthorized Actor vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin…

Latest

CVE-2026-68572, published 2026-10-16. EPSS: 0.2% chance of exploitation in the next 30 days. Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Kylin. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade to version…