Known Vulnerabilities for Zeppelin by Apache
Listed below are 10 of the newest known vulnerabilities associated with "Zeppelin" by "Apache".
These CVEs are retrieved based on exact matches on listed software, hardware, and vendor information (CPE data) as well as a keyword search to ensure the newest vulnerabilities with no officially listed software information are still displayed.
Data on known vulnerable versions is also displayed based on information from known CPEs
Known Vulnerabilities
| CVE | Shortened Description | Severity | Publish Date | Last Modified |
|---|---|---|---|---|
| CVE-2026-44617 json | LDAP filter injection vulnerability in Apache Zeppelin. LdapRealm used RFC 4514 distinguished-name escaping when constructing... | Not Provided | 2026-07-30 | 2026-07-31 |
| CVE-2026-44616 json | LDAP injection vulnerability in Apache Zeppelin. ActiveDirectoryGroupRealm constructed LDAP search filters without escaping u... | Not Provided | 2026-07-30 | 2026-07-31 |
| CVE-2026-44615 json | Path traversal vulnerability in Apache Zeppelin. When FileSystemNotebookRepo is configured, an authenticated attacker with pe... | Not Provided | 2026-07-31 | 2026-07-31 |
| CVE-2026-44613 json | Cross-Site Request Forgery (CSRF) vulnerability in Apache Zeppelin. The default CORS configuration allowed cross-origin state... | Not Provided | 2026-07-30 | 2026-08-07 |
| CVE-2022-46870 json | An Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Apache Zeppelin allo... | 5.4 - MEDIUM | 2022-12-16 | 2023-11-07 |
| CVE-2021-28655 json | The improper Input Validation vulnerability in "”Move folder to Trash” feature of Apache Zeppelin allows an attacker to d... | 6.5 - MEDIUM | 2022-12-16 | 2023-11-07 |
| CVE-2021-27578 json | Cross Site Scripting vulnerability in markdown interpreter of Apache Zeppelin allows an attacker to inject malicious scripts.... | 6.1 - MEDIUM | 2021-09-02 | 2023-11-24 |
| CVE-2020-13929 json | Authentication bypass vulnerability in Apache Zeppelin allows an attacker to bypass Zeppelin authentication mechanism to act ... | 7.5 - HIGH | 2021-09-02 | 2023-11-24 |
| CVE-2019-10095 json | bash command injection vulnerability in Apache Zeppelin allows an attacker to inject system commands into Spark interpreter s... | 9.8 - CRITICAL | 2021-09-02 | 2023-11-24 |
| CVE-2018-1328 json | Apache Zeppelin prior to 0.8.0 had a stored XSS issue via Note permissions. Issue reported by "Josna Joseph". | 6.1 - MEDIUM | 2019-04-23 | 2023-11-07 |