Known vulnerabilities in Apache Zeppelin
Vendor:
Apache Foundation
Software:
Apache Zeppelin
Software CPE:
cpe:2.3:a:apache_foundation:zeppelin:*:*:*:*:*:*:*:*
Website:
https://www.apache.org
Total vulnerabilities:
6
Public exploits:
0
Known exploited (KEV):
0
Highest CVSSv4 Score:
7.2
Breakdown by Severity Chart
Vulnerabilities (6)
| Vulnerability | CWE-ID | CSH Severity | Public Exploit | KEV | First fixed release | Published | Bulletins |
|---|---|---|---|---|---|---|---|
| #VU145156 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') CVE-2026-44617 |
CWE-90 | Low | 0.12.1 | 25.08.2026 |
SB2026082550 |
||
| #VU145155 - Improper Neutralization of Special Elements used in an LDAP Query ('LDAP Injection') CVE-2026-44616 |
CWE-90 | Low | 0.12.1 | 25.08.2026 |
SB2026082550 |
||
| #VU145154 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') CVE-2026-44615 |
CWE-22 | Medium | 0.12.1 | 25.08.2026 |
SB2026082550 |
||
| #VU145153 - Cross-Site Request Forgery (CSRF) CVE-2026-44613 |
CWE-352 | Low | 0.12.1 | 25.08.2026 |
SB2026082550 |
||
| #VU70448 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') CVE-2022-46870 |
CWE-79 | Low | 0.8.2 | 20.12.2022 |
SB2022122012 |
||
| #VU70447 - Improper Access Control CVE-2021-28655 |
CWE-284 | Low | 0.10.0 | 20.12.2022 |
SB2022122013 |