Apache Hop Security Vulnerability Scans
Last Updated: 07 Nov 2025 00:24:28
This vulnerabilities overview will be availabule in full until 31 Dec 2025. A reduced version will remain available as of 2026.
↑Development
Severity Breakdown
| Severity | Count |
|---|---|
| HIGH | 11 |
| MEDIUM | 8 |
| LOW | 2 |
Details for version: Development
CVE Details for Version: Development
| Severity | Score | CVE ID | Description |
|---|---|---|---|
| HIGH | 8.8 | CVE-2020-9492 | CVE-2020-9492: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| HIGH | 8.7 | CVE-2023-52428 | CVE-2023-52428: Uncontrolled Resource Consumption |
| HIGH | 8.1 | CVE-2025-59250 | CVE-2025-59250: Improper Input Validation |
| HIGH | 7.7 | CVE-2024-47072 | CVE-2024-47072: Stack-based Buffer Overflow |
| HIGH | 7.5 | CVE-2021-31684 | CVE-2021-31684: Out-of-bounds Read |
| HIGH | 7.5 | CVE-2022-41404 | CVE-2022-41404: Uncontrolled Resource Consumption |
| HIGH | 7.5 | CVE-2023-1370 | CVE-2023-1370: Uncontrolled Recursion |
| HIGH | 7.5 | CVE-2023-28118 | kaml has potential denial of service while parsing input with anchors and aliases |
| HIGH | 7.5 | CVE-2024-21634 | CVE-2024-21634: Allocation of Resources Without Limits or Throttling |
| HIGH | 7.5 | CVE-2025-41249 | CVE-2025-41249: Improper Authorization |
| HIGH | 7.5 | CVE-2025-55163 | netty: netty-codec-http2: Netty MadeYouReset HTTP/2 DDoS Vulnerability |
| MEDIUM | 6.5 | CVE-2024-45993 | CVE-2024-45993 |
| MEDIUM | 6.5 | CVE-2025-48924 | CVE-2025-48924: Uncontrolled Recursion |
| MEDIUM | 5.8 | CVE-2024-58103 | Wire has Uncontrolled Recursion on Nested Groups |
| MEDIUM | 5.8 | CVE-2025-53864 | CVE-2025-53864: Uncontrolled Recursion |
| MEDIUM | 5.5 | CVE-2024-35255 | CVE-2024-35255: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') |
| MEDIUM | 5.1 | CVE-2024-38808 | CVE-2024-38808: Allocation of Resources Without Limits or Throttling |
| MEDIUM | 4.8 | CVE-2024-38827 | CVE-2024-38827: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 4.3 | CVE-2021-39194 | Improper Handling of Missing Values in kaml |
| LOW | 3.2 | CVE-2025-46394 | CVE-2025-46394 |
| LOW | 2.5 | CVE-2024-58251 | CVE-2024-58251 |
↑2.15.0
Severity Breakdown
| Severity | Count |
|---|---|
| CRITICAL | 1 |
| HIGH | 17 |
| MEDIUM | 23 |
| LOW | 7 |
Details for version: 2.15.0
CVE Details for Version: 2.15.0
| Severity | Score | CVE ID | Description |
|---|---|---|---|
| CRITICAL | 9.3 | CVE-2025-54988 | CVE-2025-54988: Improper Restriction of XML External Entity Reference |
| HIGH | 8.8 | CVE-2020-9492 | CVE-2020-9492: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| HIGH | 8.8 | CVE-2025-48734 | CVE-2025-48734: Improper Access Control |
| HIGH | 8.7 | CVE-2023-52428 | CVE-2023-52428: Uncontrolled Resource Consumption |
| HIGH | 8.2 | CVE-2025-55163 | CVE-2025-55163: Allocation of Resources Without Limits or Throttling |
| HIGH | 8.1 | CVE-2025-59250 | CVE-2025-59250: Improper Input Validation |
| HIGH | 7.7 | CVE-2024-47072 | CVE-2024-47072: Stack-based Buffer Overflow |
| HIGH | 7.7 | CVE-2025-59419 | CVE-2025-59419: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
| HIGH | 7.5 | CVE-2021-31684 | CVE-2021-31684: Out-of-bounds Read |
| HIGH | 7.5 | CVE-2022-41404 | CVE-2022-41404: Uncontrolled Resource Consumption |
| HIGH | 7.5 | CVE-2023-1370 | CVE-2023-1370: Uncontrolled Recursion |
| HIGH | 7.5 | CVE-2023-28118 | kaml has potential denial of service while parsing input with anchors and aliases |
| HIGH | 7.5 | CVE-2024-21634 | CVE-2024-21634: Allocation of Resources Without Limits or Throttling |
| HIGH | 7.5 | CVE-2025-41249 | CVE-2025-41249: Improper Authorization |
| HIGH | 7.5 | CVE-2025-59375 | CVE-2025-59375 |
| HIGH | 7.5 | CVE-2025-9086 | CVE-2025-9086 |
| HIGH | 7.5 | CVE-2025-9230 | CVE-2025-9230 |
| HIGH | 7.2 | CVE-2024-13009 | CVE-2024-13009: Improper Resource Shutdown or Release |
| MEDIUM | 6.9 | CVE-2025-31672 | CVE-2025-31672: Improper Input Validation |
| MEDIUM | 6.9 | CVE-2025-58050 | CVE-2025-58050 |
| MEDIUM | 6.9 | CVE-2025-58057 | CVE-2025-58057: Improper Handling of Highly Compressed Data (Data Amplification) |
| MEDIUM | 6.5 | CVE-2024-45993 | CVE-2024-45993 |
| MEDIUM | 6.5 | CVE-2025-48924 | CVE-2025-48924: Uncontrolled Recursion |
| MEDIUM | 6.5 | CVE-2025-9231 | CVE-2025-9231 |
| MEDIUM | 6.3 | CVE-2024-6763 | CVE-2024-6763: Improper Validation of Syntactic Correctness of Input |
| MEDIUM | 5.9 | CVE-2024-8184 | CVE-2024-8184: Uncontrolled Resource Consumption |
| MEDIUM | 5.9 | CVE-2025-9232 | CVE-2025-9232 |
| MEDIUM | 5.8 | CVE-2024-58103 | Wire has Uncontrolled Recursion on Nested Groups |
| MEDIUM | 5.8 | CVE-2025-53864 | CVE-2025-53864: Uncontrolled Recursion |
| MEDIUM | 5.5 | CVE-2024-35255 | CVE-2024-35255: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') |
| MEDIUM | 5.5 | CVE-2025-53057 | openjdk: Enhance certificate handling (Oracle CPU 2025-10) |
| MEDIUM | 5.5 | CVE-2025-53066 | openjdk: Enhance Path Factories (Oracle CPU 2025-10) |
| MEDIUM | 5.3 | CVE-2021-34429 | CVE-2021-34429: Exposure of Sensitive Information to an Unauthorized Actor |
| MEDIUM | 5.3 | CVE-2023-26048 | CVE-2023-26048: Uncontrolled Resource Consumption |
| MEDIUM | 5.3 | CVE-2023-40167 | CVE-2023-40167: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 5.3 | CVE-2024-9823 | CVE-2024-9823: Uncontrolled Resource Consumption |
| MEDIUM | 5.3 | CVE-2025-10148 | CVE-2025-10148 |
| MEDIUM | 5.1 | CVE-2024-38808 | CVE-2024-38808: Allocation of Resources Without Limits or Throttling |
| MEDIUM | 4.8 | CVE-2024-38827 | CVE-2024-38827: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 4.3 | CVE-2021-39194 | Improper Handling of Missing Values in kaml |
| MEDIUM | 4.3 | CVE-2023-41900 | CVE-2023-41900: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| LOW | 3.9 | GHSA-58qw-p7qm-5rvh | GHSA-58qw-p7qm-5rvh: Improper Restriction of XML External Entity Reference |
| LOW | 3.5 | CVE-2023-36479 | CVE-2023-36479: Improper Neutralization of Quoting Syntax |
| LOW | 3.2 | CVE-2025-46394 | CVE-2025-46394 |
| LOW | 3.1 | CVE-2025-58056 | CVE-2025-58056: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') |
| LOW | 2.7 | CVE-2022-2047 | CVE-2022-2047: Improper Input Validation |
| LOW | 2.5 | CVE-2024-58251 | CVE-2024-58251 |
| LOW | 2.4 | CVE-2023-26049 | CVE-2023-26049: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
↑2.14.0
Severity Breakdown
| Severity | Count |
|---|---|
| CRITICAL | 1 |
| HIGH | 23 |
| MEDIUM | 28 |
| LOW | 8 |
Details for version: 2.14.0
CVE Details for Version: 2.14.0
| Severity | Score | CVE ID | Description |
|---|---|---|---|
| CRITICAL | 9.3 | CVE-2025-54988 | CVE-2025-54988: Improper Restriction of XML External Entity Reference |
| HIGH | 8.8 | CVE-2020-9492 | CVE-2020-9492: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| HIGH | 8.8 | CVE-2025-48734 | CVE-2025-48734: Improper Access Control |
| HIGH | 8.7 | CVE-2023-52428 | CVE-2023-52428: Uncontrolled Resource Consumption |
| HIGH | 8.6 | CVE-2025-50059 | CVE-2025-50059 |
| HIGH | 8.2 | CVE-2025-49146 | CVE-2025-49146: Improper Authentication |
| HIGH | 8.2 | CVE-2025-55163 | CVE-2025-55163: Allocation of Resources Without Limits or Throttling |
| HIGH | 8.1 | CVE-2025-30749 | CVE-2025-30749 |
| HIGH | 8.1 | CVE-2025-50106 | CVE-2025-50106 |
| HIGH | 8.1 | CVE-2025-59250 | CVE-2025-59250: Improper Input Validation |
| HIGH | 7.7 | CVE-2024-47072 | CVE-2024-47072: Stack-based Buffer Overflow |
| HIGH | 7.7 | CVE-2025-59419 | CVE-2025-59419: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
| HIGH | 7.5 | CVE-2021-31684 | CVE-2021-31684: Out-of-bounds Read |
| HIGH | 7.5 | CVE-2022-41404 | CVE-2022-41404: Uncontrolled Resource Consumption |
| HIGH | 7.5 | CVE-2023-1370 | CVE-2023-1370: Uncontrolled Recursion |
| HIGH | 7.5 | CVE-2023-28118 | kaml has potential denial of service while parsing input with anchors and aliases |
| HIGH | 7.5 | CVE-2024-21634 | CVE-2024-21634: Allocation of Resources Without Limits or Throttling |
| HIGH | 7.5 | CVE-2025-41249 | CVE-2025-41249: Improper Authorization |
| HIGH | 7.5 | CVE-2025-53066 | CVE-2025-53066 |
| HIGH | 7.5 | CVE-2025-5399 | CVE-2025-5399 |
| HIGH | 7.5 | CVE-2025-59375 | CVE-2025-59375 |
| HIGH | 7.5 | CVE-2025-9086 | CVE-2025-9086 |
| HIGH | 7.5 | CVE-2025-9230 | CVE-2025-9230 |
| HIGH | 7.2 | CVE-2024-13009 | CVE-2024-13009: Improper Resource Shutdown or Release |
| MEDIUM | 6.9 | CVE-2025-31672 | CVE-2025-31672: Improper Input Validation |
| MEDIUM | 6.9 | CVE-2025-58057 | CVE-2025-58057: Improper Handling of Highly Compressed Data (Data Amplification) |
| MEDIUM | 6.8 | CVE-2025-4949 | CVE-2025-4949: Improper Restriction of XML External Entity Reference |
| MEDIUM | 6.5 | CVE-2024-45993 | CVE-2024-45993 |
| MEDIUM | 6.5 | CVE-2025-48924 | CVE-2025-48924: Uncontrolled Recursion |
| MEDIUM | 6.5 | CVE-2025-4947 | CVE-2025-4947 |
| MEDIUM | 6.5 | CVE-2025-9231 | CVE-2025-9231 |
| MEDIUM | 6.3 | CVE-2024-6763 | CVE-2024-6763: Improper Validation of Syntactic Correctness of Input |
| MEDIUM | 6.2 | CVE-2025-27817 | CVE-2025-27817: Server-Side Request Forgery (SSRF) |
| MEDIUM | 6.1 | CVE-2025-22227 | CVE-2025-22227: Exposure of Sensitive Information to an Unauthorized Actor |
| MEDIUM | 5.9 | CVE-2024-8184 | CVE-2024-8184: Uncontrolled Resource Consumption |
| MEDIUM | 5.9 | CVE-2025-53057 | CVE-2025-53057 |
| MEDIUM | 5.9 | CVE-2025-9232 | CVE-2025-9232 |
| MEDIUM | 5.8 | CVE-2024-58103 | Wire has Uncontrolled Recursion on Nested Groups |
| MEDIUM | 5.8 | CVE-2025-53864 | CVE-2025-53864: Uncontrolled Recursion |
| MEDIUM | 5.5 | CVE-2023-2976 | CVE-2023-2976: Creation of Temporary File in Directory with Insecure Permissions |
| MEDIUM | 5.5 | CVE-2024-35255 | CVE-2024-35255: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') |
| MEDIUM | 5.3 | CVE-2021-34429 | CVE-2021-34429: Exposure of Sensitive Information to an Unauthorized Actor |
| MEDIUM | 5.3 | CVE-2023-26048 | CVE-2023-26048: Uncontrolled Resource Consumption |
| MEDIUM | 5.3 | CVE-2023-40167 | CVE-2023-40167: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 5.3 | CVE-2024-9823 | CVE-2024-9823: Uncontrolled Resource Consumption |
| MEDIUM | 5.3 | CVE-2025-10148 | CVE-2025-10148 |
| MEDIUM | 5.1 | CVE-2024-38808 | CVE-2024-38808: Allocation of Resources Without Limits or Throttling |
| MEDIUM | 4.8 | CVE-2024-38827 | CVE-2024-38827: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 4.8 | CVE-2025-30754 | CVE-2025-30754 |
| MEDIUM | 4.8 | CVE-2025-5025 | CVE-2025-5025 |
| MEDIUM | 4.3 | CVE-2021-39194 | Improper Handling of Missing Values in kaml |
| MEDIUM | 4.3 | CVE-2023-41900 | CVE-2023-41900: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| LOW | 3.9 | GHSA-58qw-p7qm-5rvh | GHSA-58qw-p7qm-5rvh: Improper Restriction of XML External Entity Reference |
| LOW | 3.5 | CVE-2023-36479 | CVE-2023-36479: Improper Neutralization of Quoting Syntax |
| LOW | 3.3 | CVE-2020-8908 | CVE-2020-8908: Improper Handling of Alternate Encoding |
| LOW | 3.2 | CVE-2025-46394 | CVE-2025-46394 |
| LOW | 3.1 | CVE-2025-58056 | CVE-2025-58056: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') |
| LOW | 2.7 | CVE-2022-2047 | CVE-2022-2047: Improper Input Validation |
| LOW | 2.5 | CVE-2024-58251 | CVE-2024-58251 |
| LOW | 2.4 | CVE-2023-26049 | CVE-2023-26049: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
↑2.13.0
Severity Breakdown
| Severity | Count |
|---|---|
| CRITICAL | 1 |
| HIGH | 28 |
| MEDIUM | 32 |
| LOW | 8 |
Details for version: 2.13.0
CVE Details for Version: 2.13.0
| Severity | Score | CVE ID | Description |
|---|---|---|---|
| CRITICAL | 9.3 | CVE-2025-54988 | CVE-2025-54988: Improper Restriction of XML External Entity Reference |
| HIGH | 8.8 | CVE-2020-9492 | CVE-2020-9492: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| HIGH | 8.8 | CVE-2025-48734 | CVE-2025-48734: Improper Access Control |
| HIGH | 8.7 | CVE-2023-52428 | CVE-2023-52428: Uncontrolled Resource Consumption |
| HIGH | 8.7 | CVE-2024-23945 | CVE-2024-23945: Generation of Error Message Containing Sensitive Information |
| HIGH | 8.7 | CVE-2024-47554 | CVE-2024-47554: Uncontrolled Resource Consumption |
| HIGH | 8.6 | CVE-2025-50059 | CVE-2025-50059 |
| HIGH | 8.2 | CVE-2025-49146 | CVE-2025-49146: Improper Authentication |
| HIGH | 8.2 | CVE-2025-55163 | CVE-2025-55163: Allocation of Resources Without Limits or Throttling |
| HIGH | 8.1 | CVE-2025-30749 | CVE-2025-30749 |
| HIGH | 8.1 | CVE-2025-50106 | CVE-2025-50106 |
| HIGH | 8.1 | CVE-2025-59250 | CVE-2025-59250: Improper Input Validation |
| HIGH | 7.7 | CVE-2024-47072 | CVE-2024-47072: Stack-based Buffer Overflow |
| HIGH | 7.7 | CVE-2025-59419 | CVE-2025-59419: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
| HIGH | 7.5 | CVE-2021-31684 | CVE-2021-31684: Out-of-bounds Read |
| HIGH | 7.5 | CVE-2021-34538 | CVE-2021-34538: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| HIGH | 7.5 | CVE-2022-41404 | CVE-2022-41404: Uncontrolled Resource Consumption |
| HIGH | 7.5 | CVE-2023-1370 | CVE-2023-1370: Uncontrolled Recursion |
| HIGH | 7.5 | CVE-2023-28118 | kaml has potential denial of service while parsing input with anchors and aliases |
| HIGH | 7.5 | CVE-2024-21634 | CVE-2024-21634: Allocation of Resources Without Limits or Throttling |
| HIGH | 7.5 | CVE-2024-57699 | CVE-2024-57699: Uncontrolled Recursion |
| HIGH | 7.5 | CVE-2025-41249 | CVE-2025-41249: Improper Authorization |
| HIGH | 7.5 | CVE-2025-53066 | CVE-2025-53066 |
| HIGH | 7.5 | CVE-2025-5399 | CVE-2025-5399 |
| HIGH | 7.5 | CVE-2025-59375 | CVE-2025-59375 |
| HIGH | 7.5 | CVE-2025-9086 | CVE-2025-9086 |
| HIGH | 7.5 | CVE-2025-9230 | CVE-2025-9230 |
| HIGH | 7.2 | CVE-2024-13009 | CVE-2024-13009: Improper Resource Shutdown or Release |
| HIGH | 7.1 | CVE-2025-46762 | CVE-2025-46762: External Control of File Name or Path |
| MEDIUM | 6.9 | CVE-2025-31672 | CVE-2025-31672: Improper Input Validation |
| MEDIUM | 6.9 | CVE-2025-58057 | CVE-2025-58057: Improper Handling of Highly Compressed Data (Data Amplification) |
| MEDIUM | 6.8 | CVE-2024-31141 | CVE-2024-31141: Improper Privilege Management |
| MEDIUM | 6.8 | CVE-2025-4949 | CVE-2025-4949: Improper Restriction of XML External Entity Reference |
| MEDIUM | 6.7 | CVE-2024-26308 | CVE-2024-26308: Allocation of Resources Without Limits or Throttling |
| MEDIUM | 6.5 | CVE-2024-45993 | CVE-2024-45993 |
| MEDIUM | 6.5 | CVE-2025-48924 | CVE-2025-48924: Uncontrolled Recursion |
| MEDIUM | 6.5 | CVE-2025-4947 | CVE-2025-4947 |
| MEDIUM | 6.5 | CVE-2025-9231 | CVE-2025-9231 |
| MEDIUM | 6.3 | CVE-2024-6763 | CVE-2024-6763: Improper Validation of Syntactic Correctness of Input |
| MEDIUM | 6.2 | CVE-2025-27817 | CVE-2025-27817: Server-Side Request Forgery (SSRF) |
| MEDIUM | 6.1 | CVE-2025-22227 | CVE-2025-22227: Exposure of Sensitive Information to an Unauthorized Actor |
| MEDIUM | 5.9 | CVE-2024-25710 | CVE-2024-25710: Loop with Unreachable Exit Condition ('Infinite Loop') |
| MEDIUM | 5.9 | CVE-2024-8184 | CVE-2024-8184: Uncontrolled Resource Consumption |
| MEDIUM | 5.9 | CVE-2025-53057 | CVE-2025-53057 |
| MEDIUM | 5.9 | CVE-2025-9232 | CVE-2025-9232 |
| MEDIUM | 5.8 | CVE-2024-58103 | Wire has Uncontrolled Recursion on Nested Groups |
| MEDIUM | 5.8 | CVE-2025-53864 | CVE-2025-53864: Uncontrolled Recursion |
| MEDIUM | 5.5 | CVE-2023-2976 | CVE-2023-2976: Creation of Temporary File in Directory with Insecure Permissions |
| MEDIUM | 5.5 | CVE-2024-35255 | CVE-2024-35255: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') |
| MEDIUM | 5.3 | CVE-2021-34429 | CVE-2021-34429: Exposure of Sensitive Information to an Unauthorized Actor |
| MEDIUM | 5.3 | CVE-2023-26048 | CVE-2023-26048: Uncontrolled Resource Consumption |
| MEDIUM | 5.3 | CVE-2023-40167 | CVE-2023-40167: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 5.3 | CVE-2024-21742 | CVE-2024-21742: Improper Input Validation |
| MEDIUM | 5.3 | CVE-2024-9823 | CVE-2024-9823: Uncontrolled Resource Consumption |
| MEDIUM | 5.3 | CVE-2025-10148 | CVE-2025-10148 |
| MEDIUM | 5.1 | CVE-2024-38808 | CVE-2024-38808: Allocation of Resources Without Limits or Throttling |
| MEDIUM | 4.8 | CVE-2024-38827 | CVE-2024-38827: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 4.8 | CVE-2025-30754 | CVE-2025-30754 |
| MEDIUM | 4.8 | CVE-2025-5025 | CVE-2025-5025 |
| MEDIUM | 4.3 | CVE-2021-39194 | Improper Handling of Missing Values in kaml |
| MEDIUM | 4.3 | CVE-2023-41900 | CVE-2023-41900: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| LOW | 3.9 | GHSA-58qw-p7qm-5rvh | GHSA-58qw-p7qm-5rvh: Improper Restriction of XML External Entity Reference |
| LOW | 3.5 | CVE-2023-36479 | CVE-2023-36479: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| LOW | 3.3 | CVE-2020-8908 | CVE-2020-8908: Improper Handling of Alternate Encoding |
| LOW | 3.2 | CVE-2025-46394 | CVE-2025-46394 |
| LOW | 3.1 | CVE-2025-58056 | CVE-2025-58056: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') |
| LOW | 2.7 | CVE-2022-2047 | CVE-2022-2047: Improper Input Validation |
| LOW | 2.5 | CVE-2024-58251 | CVE-2024-58251 |
| LOW | 2.4 | CVE-2023-26049 | CVE-2023-26049: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
↑2.12.0
Severity Breakdown
| Severity | Count |
|---|---|
| CRITICAL | 3 |
| HIGH | 43 |
| MEDIUM | 43 |
| LOW | 10 |
Details for version: 2.12.0
CVE Details for Version: 2.12.0
| Severity | Score | CVE ID | Description |
|---|---|---|---|
| CRITICAL | 10.0 | CVE-2025-30065 | CVE-2025-30065: Deserialization of Untrusted Data |
| CRITICAL | 9.8 | CVE-2023-25613 | CVE-2023-25613: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| CRITICAL | 9.3 | CVE-2025-54988 | CVE-2025-54988: Improper Restriction of XML External Entity Reference |
| HIGH | 8.8 | CVE-2020-9492 | CVE-2020-9492: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| HIGH | 8.8 | CVE-2025-48734 | CVE-2025-48734: Improper Access Control |
| HIGH | 8.7 | CVE-2023-52428 | CVE-2023-52428: Uncontrolled Resource Consumption |
| HIGH | 8.7 | CVE-2024-7254 | CVE-2024-7254: Improper Input Validation |
| HIGH | 8.6 | CVE-2025-50059 | CVE-2025-50059 |
| HIGH | 8.3 | CVE-2025-31498 | CVE-2025-31498 |
| HIGH | 8.2 | CVE-2025-49146 | CVE-2025-49146: Improper Authentication |
| HIGH | 8.2 | CVE-2025-55163 | CVE-2025-55163: Allocation of Resources Without Limits or Throttling |
| HIGH | 8.1 | CVE-2025-30749 | CVE-2025-30749 |
| HIGH | 8.1 | CVE-2025-50106 | CVE-2025-50106 |
| HIGH | 8.1 | CVE-2025-59250 | CVE-2025-59250: Improper Input Validation |
| HIGH | 7.7 | CVE-2024-47072 | CVE-2024-47072: Stack-based Buffer Overflow |
| HIGH | 7.7 | CVE-2025-23083 | CVE-2025-23083 |
| HIGH | 7.5 | CVE-2019-16869 | CVE-2019-16869: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') |
| HIGH | 7.5 | CVE-2021-22569 | CVE-2021-22569: Incorrect Behavior Order |
| HIGH | 7.5 | CVE-2021-31684 | CVE-2021-31684: Out-of-bounds Read |
| HIGH | 7.5 | CVE-2021-37136 | CVE-2021-37136: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| HIGH | 7.5 | CVE-2022-3509 | CVE-2022-3509: Uncontrolled Resource Consumption |
| HIGH | 7.5 | CVE-2022-3510 | CVE-2022-3510: Uncontrolled Resource Consumption |
| HIGH | 7.5 | CVE-2022-41404 | CVE-2022-41404: Uncontrolled Resource Consumption |
| HIGH | 7.5 | CVE-2022-41881 | CVE-2022-41881: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| HIGH | 7.5 | CVE-2023-1370 | CVE-2023-1370: Uncontrolled Recursion |
| HIGH | 7.5 | CVE-2023-28118 | kaml has potential denial of service while parsing input with anchors and aliases |
| HIGH | 7.5 | CVE-2023-34054 | CVE-2023-34054 |
| HIGH | 7.5 | CVE-2023-34062 | CVE-2023-34062: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
| HIGH | 7.5 | CVE-2023-34455 | CVE-2023-34455: Allocation of Resources Without Limits or Throttling |
| HIGH | 7.5 | CVE-2023-43642 | CVE-2023-43642: Allocation of Resources Without Limits or Throttling |
| HIGH | 7.5 | CVE-2024-21634 | CVE-2024-21634: Allocation of Resources Without Limits or Throttling |
| HIGH | 7.5 | CVE-2024-57699 | CVE-2024-57699: Uncontrolled Recursion |
| HIGH | 7.5 | CVE-2024-8176 | CVE-2024-8176 |
| HIGH | 7.5 | CVE-2025-24970 | CVE-2025-24970: Improper Input Validation |
| HIGH | 7.5 | CVE-2025-27553 | CVE-2025-27553: Relative Path Traversal |
| HIGH | 7.5 | CVE-2025-41249 | CVE-2025-41249: Improper Authorization |
| HIGH | 7.5 | CVE-2025-53066 | CVE-2025-53066 |
| HIGH | 7.5 | CVE-2025-5399 | CVE-2025-5399 |
| HIGH | 7.5 | CVE-2025-59375 | CVE-2025-59375 |
| HIGH | 7.5 | CVE-2025-9086 | CVE-2025-9086 |
| HIGH | 7.5 | CVE-2025-9230 | CVE-2025-9230 |
| HIGH | 7.4 | CVE-2025-21587 | CVE-2025-21587 |
| HIGH | 7.3 | CVE-2025-31344 | CVE-2025-31344 |
| HIGH | 7.2 | CVE-2024-13009 | CVE-2024-13009: Improper Resource Shutdown or Release |
| HIGH | 7.1 | CVE-2025-46762 | CVE-2025-46762: External Control of File Name or Path |
| HIGH | 7.0 | CVE-2024-25638 | CVE-2024-25638: Insufficient Verification of Data Authenticity |
| MEDIUM | 6.9 | CVE-2024-29133 | CVE-2024-29133: Out-of-bounds Write |
| MEDIUM | 6.9 | CVE-2025-30474 | CVE-2025-30474: Exposure of Sensitive Information to an Unauthorized Actor |
| MEDIUM | 6.9 | CVE-2025-31672 | CVE-2025-31672: Improper Input Validation |
| MEDIUM | 6.9 | CVE-2025-58057 | CVE-2025-58057: Improper Handling of Highly Compressed Data (Data Amplification) |
| MEDIUM | 6.8 | CVE-2025-4949 | CVE-2025-4949: Improper Restriction of XML External Entity Reference |
| MEDIUM | 6.5 | CVE-2023-34462 | CVE-2023-34462: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 6.5 | CVE-2024-29131 | CVE-2024-29131: Out-of-bounds Write |
| MEDIUM | 6.5 | CVE-2024-45993 | CVE-2024-45993 |
| MEDIUM | 6.5 | CVE-2025-48924 | CVE-2025-48924: Uncontrolled Recursion |
| MEDIUM | 6.5 | CVE-2025-4947 | CVE-2025-4947 |
| MEDIUM | 6.5 | CVE-2025-9231 | CVE-2025-9231 |
| MEDIUM | 6.3 | CVE-2024-6763 | CVE-2024-6763: Improper Validation of Syntactic Correctness of Input |
| MEDIUM | 6.2 | CVE-2025-27817 | CVE-2025-27817: Server-Side Request Forgery (SSRF) |
| MEDIUM | 6.1 | CVE-2025-22227 | CVE-2025-22227: Exposure of Sensitive Information to an Unauthorized Actor |
| MEDIUM | 5.9 | CVE-2021-21295 | CVE-2021-21295: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 5.9 | CVE-2021-21409 | CVE-2021-21409: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 5.9 | CVE-2023-34453 | CVE-2023-34453: Integer Overflow or Wraparound |
| MEDIUM | 5.9 | CVE-2023-34454 | CVE-2023-34454: Integer Overflow or Wraparound |
| MEDIUM | 5.9 | CVE-2024-8184 | CVE-2024-8184: Uncontrolled Resource Consumption |
| MEDIUM | 5.9 | CVE-2025-53057 | CVE-2025-53057 |
| MEDIUM | 5.9 | CVE-2025-9232 | CVE-2025-9232 |
| MEDIUM | 5.8 | CVE-2024-58103 | Wire has Uncontrolled Recursion on Nested Groups |
| MEDIUM | 5.8 | CVE-2025-53864 | CVE-2025-53864: Uncontrolled Recursion |
| MEDIUM | 5.7 | CVE-2022-3171 | CVE-2022-3171: Improper Input Validation |
| MEDIUM | 5.6 | CVE-2025-30698 | CVE-2025-30698 |
| MEDIUM | 5.5 | CVE-2021-22570 | CVE-2021-22570: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 5.5 | CVE-2023-2976 | CVE-2023-2976: Creation of Temporary File in Directory with Insecure Permissions |
| MEDIUM | 5.5 | CVE-2024-35255 | CVE-2024-35255: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') |
| MEDIUM | 5.5 | CVE-2025-25193 | CVE-2025-25193: Uncontrolled Resource Consumption |
| MEDIUM | 5.4 | CVE-2024-47535 | CVE-2024-47535: Uncontrolled Resource Consumption |
| MEDIUM | 5.3 | CVE-2020-29582 | kotlin: vulnerable Java API was used for temporary file and folder creation which could result in information disclosure |
| MEDIUM | 5.3 | CVE-2021-34429 | CVE-2021-34429: Exposure of Sensitive Information to an Unauthorized Actor |
| MEDIUM | 5.3 | CVE-2022-24329 | kotlin: Not possible to lock dependencies for Multiplatform Gradle Projects |
| MEDIUM | 5.3 | CVE-2023-26048 | CVE-2023-26048: Uncontrolled Resource Consumption |
| MEDIUM | 5.3 | CVE-2023-40167 | CVE-2023-40167: Improper Handling of Length Parameter Inconsistency |
| MEDIUM | 5.3 | CVE-2024-9823 | CVE-2024-9823: Uncontrolled Resource Consumption |
| MEDIUM | 5.3 | CVE-2025-10148 | CVE-2025-10148 |
| MEDIUM | 5.1 | CVE-2024-38808 | CVE-2024-38808: Allocation of Resources Without Limits or Throttling |
| MEDIUM | 4.8 | CVE-2024-38827 | CVE-2024-38827: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 4.8 | CVE-2025-30754 | CVE-2025-30754 |
| MEDIUM | 4.8 | CVE-2025-5025 | CVE-2025-5025 |
| MEDIUM | 4.3 | CVE-2021-39194 | Improper Handling of Missing Values in kaml |
| MEDIUM | 4.3 | CVE-2023-41900 | CVE-2023-41900: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| LOW | 3.9 | GHSA-58qw-p7qm-5rvh | GHSA-58qw-p7qm-5rvh: Improper Restriction of XML External Entity Reference |
| LOW | 3.5 | CVE-2023-36479 | CVE-2023-36479: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| LOW | 3.3 | CVE-2020-8908 | CVE-2020-8908: Improper Handling of Alternate Encoding |
| LOW | 3.3 | CVE-2025-27496 | Snowflake JDBC Driver client-side encryption key in DEBUG logs |
| LOW | 3.2 | CVE-2025-46394 | CVE-2025-46394 |
| LOW | 3.1 | CVE-2025-58056 | CVE-2025-58056: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') |
| LOW | 2.7 | CVE-2022-2047 | CVE-2022-2047: Improper Input Validation |
| LOW | 2.5 | CVE-2024-58251 | CVE-2024-58251 |
| LOW | 2.4 | CVE-2023-26049 | CVE-2023-26049: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| LOW | 2.0 | CVE-2024-23454 | CVE-2024-23454: Improper Privilege Management |
↑2.11.0
Severity Breakdown
| Severity | Count |
|---|---|
| CRITICAL | 4 |
| HIGH | 47 |
| MEDIUM | 50 |
| LOW | 12 |
Details for version: 2.11.0
CVE Details for Version: 2.11.0
| Severity | Score | CVE ID | Description |
|---|---|---|---|
| CRITICAL | 10.0 | CVE-2025-30065 | CVE-2025-30065: Deserialization of Untrusted Data |
| CRITICAL | 9.8 | CVE-2023-25613 | CVE-2023-25613: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| CRITICAL | 9.8 | CVE-2025-0665 | CVE-2025-0665 |
| CRITICAL | 9.3 | CVE-2025-54988 | CVE-2025-54988: Improper Restriction of XML External Entity Reference |
| HIGH | 8.8 | CVE-2020-9492 | CVE-2020-9492: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| HIGH | 8.8 | CVE-2025-23015 | CVE-2025-23015: Privilege Defined With Unsafe Actions |
| HIGH | 8.8 | CVE-2025-48734 | CVE-2025-48734: Improper Access Control |
| HIGH | 8.7 | CVE-2023-52428 | CVE-2023-52428: Uncontrolled Resource Consumption |
| HIGH | 8.7 | CVE-2024-7254 | CVE-2024-7254: Improper Input Validation |
| HIGH | 8.6 | CVE-2025-50059 | CVE-2025-50059 |
| HIGH | 8.3 | CVE-2025-31498 | CVE-2025-31498 |
| HIGH | 8.2 | CVE-2025-49146 | CVE-2025-49146: Improper Authentication |
| HIGH | 8.2 | CVE-2025-55163 | CVE-2025-55163: Allocation of Resources Without Limits or Throttling |
| HIGH | 8.1 | CVE-2025-26519 | CVE-2025-26519 |
| HIGH | 8.1 | CVE-2025-30749 | CVE-2025-30749 |
| HIGH | 8.1 | CVE-2025-50106 | CVE-2025-50106 |
| HIGH | 8.1 | CVE-2025-59250 | CVE-2025-59250: Improper Input Validation |
| HIGH | 7.8 | CVE-2025-24789 | Snowflake JDBC allows an untrusted search path on Windows |
| HIGH | 7.7 | CVE-2024-47072 | CVE-2024-47072: Stack-based Buffer Overflow |
| HIGH | 7.7 | CVE-2025-23083 | CVE-2025-23083 |
| HIGH | 7.5 | CVE-2019-16869 | CVE-2019-16869: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') |
| HIGH | 7.5 | CVE-2021-22569 | CVE-2021-22569: Incorrect Behavior Order |
| HIGH | 7.5 | CVE-2021-31684 | CVE-2021-31684: Out-of-bounds Read |
| HIGH | 7.5 | CVE-2021-37136 | CVE-2021-37136: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| HIGH | 7.5 | CVE-2022-3509 | CVE-2022-3509: Uncontrolled Resource Consumption |
| HIGH | 7.5 | CVE-2022-3510 | CVE-2022-3510: Uncontrolled Resource Consumption |
| HIGH | 7.5 | CVE-2022-41404 | CVE-2022-41404: Uncontrolled Resource Consumption |
| HIGH | 7.5 | CVE-2022-41881 | CVE-2022-41881: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| HIGH | 7.5 | CVE-2023-1370 | CVE-2023-1370: Uncontrolled Recursion |
| HIGH | 7.5 | CVE-2023-28118 | kaml has potential denial of service while parsing input with anchors and aliases |
| HIGH | 7.5 | CVE-2023-34054 | CVE-2023-34054 |
| HIGH | 7.5 | CVE-2023-34062 | CVE-2023-34062: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
| HIGH | 7.5 | CVE-2023-34455 | CVE-2023-34455: Allocation of Resources Without Limits or Throttling |
| HIGH | 7.5 | CVE-2023-43642 | CVE-2023-43642: Allocation of Resources Without Limits or Throttling |
| HIGH | 7.5 | CVE-2024-21634 | CVE-2024-21634: Allocation of Resources Without Limits or Throttling |
| HIGH | 7.5 | CVE-2024-57699 | CVE-2024-57699: Uncontrolled Recursion |
| HIGH | 7.5 | CVE-2024-8176 | CVE-2024-8176 |
| HIGH | 7.5 | CVE-2025-24970 | CVE-2025-24970: Improper Input Validation |
| HIGH | 7.5 | CVE-2025-27553 | CVE-2025-27553: Relative Path Traversal |
| HIGH | 7.5 | CVE-2025-41249 | CVE-2025-41249: Improper Authorization |
| HIGH | 7.5 | CVE-2025-53066 | CVE-2025-53066 |
| HIGH | 7.5 | CVE-2025-5399 | CVE-2025-5399 |
| HIGH | 7.5 | CVE-2025-59375 | CVE-2025-59375 |
| HIGH | 7.5 | CVE-2025-9086 | CVE-2025-9086 |
| HIGH | 7.5 | CVE-2025-9230 | CVE-2025-9230 |
| HIGH | 7.4 | CVE-2025-21587 | CVE-2025-21587 |
| HIGH | 7.3 | CVE-2025-0725 | CVE-2025-0725 |
| HIGH | 7.3 | CVE-2025-31344 | CVE-2025-31344 |
| HIGH | 7.2 | CVE-2024-13009 | CVE-2024-13009: Improper Resource Shutdown or Release |
| HIGH | 7.1 | CVE-2025-46762 | CVE-2025-46762: External Control of File Name or Path |
| HIGH | 7.0 | CVE-2024-25638 | CVE-2024-25638: Insufficient Verification of Data Authenticity |
| MEDIUM | 6.9 | CVE-2024-29133 | CVE-2024-29133: Out-of-bounds Write |
| MEDIUM | 6.9 | CVE-2025-30474 | CVE-2025-30474: Exposure of Sensitive Information to an Unauthorized Actor |
| MEDIUM | 6.9 | CVE-2025-31672 | CVE-2025-31672: Improper Input Validation |
| MEDIUM | 6.9 | CVE-2025-58057 | CVE-2025-58057: Improper Handling of Highly Compressed Data (Data Amplification) |
| MEDIUM | 6.8 | CVE-2025-4949 | CVE-2025-4949: Improper Restriction of XML External Entity Reference |
| MEDIUM | 6.5 | CVE-2023-34462 | CVE-2023-34462: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 6.5 | CVE-2024-29131 | CVE-2024-29131: Out-of-bounds Write |
| MEDIUM | 6.5 | CVE-2024-45993 | CVE-2024-45993 |
| MEDIUM | 6.5 | CVE-2025-48924 | CVE-2025-48924: Uncontrolled Recursion |
| MEDIUM | 6.5 | CVE-2025-4947 | CVE-2025-4947 |
| MEDIUM | 6.5 | CVE-2025-9231 | CVE-2025-9231 |
| MEDIUM | 6.3 | CVE-2024-12797 | CVE-2024-12797 |
| MEDIUM | 6.3 | CVE-2024-6763 | CVE-2024-6763: Improper Validation of Syntactic Correctness of Input |
| MEDIUM | 6.2 | CVE-2025-27817 | CVE-2025-27817: Server-Side Request Forgery (SSRF) |
| MEDIUM | 6.1 | CVE-2025-22227 | CVE-2025-22227: Exposure of Sensitive Information to an Unauthorized Actor |
| MEDIUM | 5.9 | CVE-2021-21295 | CVE-2021-21295: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 5.9 | CVE-2021-21409 | CVE-2021-21409: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 5.9 | CVE-2023-34453 | CVE-2023-34453: Integer Overflow or Wraparound |
| MEDIUM | 5.9 | CVE-2023-34454 | CVE-2023-34454: Integer Overflow or Wraparound |
| MEDIUM | 5.9 | CVE-2024-27137 | CVE-2024-27137: Exposure of Resource to Wrong Sphere |
| MEDIUM | 5.9 | CVE-2024-8184 | CVE-2024-8184: Uncontrolled Resource Consumption |
| MEDIUM | 5.9 | CVE-2025-53057 | CVE-2025-53057 |
| MEDIUM | 5.9 | CVE-2025-9232 | CVE-2025-9232 |
| MEDIUM | 5.8 | CVE-2024-58103 | Wire has Uncontrolled Recursion on Nested Groups |
| MEDIUM | 5.8 | CVE-2025-53864 | CVE-2025-53864: Uncontrolled Recursion |
| MEDIUM | 5.7 | CVE-2022-3171 | CVE-2022-3171: Improper Input Validation |
| MEDIUM | 5.6 | CVE-2025-30698 | CVE-2025-30698 |
| MEDIUM | 5.5 | CVE-2021-22570 | CVE-2021-22570: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 5.5 | CVE-2023-2976 | CVE-2023-2976: Creation of Temporary File in Directory with Insecure Permissions |
| MEDIUM | 5.5 | CVE-2024-35255 | CVE-2024-35255: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') |
| MEDIUM | 5.5 | CVE-2025-25193 | CVE-2025-25193: Uncontrolled Resource Consumption |
| MEDIUM | 5.4 | CVE-2024-47535 | CVE-2024-47535: Uncontrolled Resource Consumption |
| MEDIUM | 5.4 | CVE-2025-24860 | CVE-2025-24860: Incorrect Authorization |
| MEDIUM | 5.3 | CVE-2020-29582 | kotlin: vulnerable Java API was used for temporary file and folder creation which could result in information disclosure |
| MEDIUM | 5.3 | CVE-2021-34429 | CVE-2021-34429: Exposure of Sensitive Information to an Unauthorized Actor |
| MEDIUM | 5.3 | CVE-2022-24329 | kotlin: Not possible to lock dependencies for Multiplatform Gradle Projects |
| MEDIUM | 5.3 | CVE-2023-26048 | CVE-2023-26048: Uncontrolled Resource Consumption |
| MEDIUM | 5.3 | CVE-2023-40167 | CVE-2023-40167: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 5.3 | CVE-2024-12133 | CVE-2024-12133 |
| MEDIUM | 5.3 | CVE-2024-9823 | CVE-2024-9823: Uncontrolled Resource Consumption |
| MEDIUM | 5.3 | CVE-2025-10148 | CVE-2025-10148 |
| MEDIUM | 5.1 | CVE-2024-38808 | CVE-2024-38808: Allocation of Resources Without Limits or Throttling |
| MEDIUM | 4.8 | CVE-2024-38827 | CVE-2024-38827: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 4.8 | CVE-2025-21502 | CVE-2025-21502 |
| MEDIUM | 4.8 | CVE-2025-30754 | CVE-2025-30754 |
| MEDIUM | 4.8 | CVE-2025-5025 | CVE-2025-5025 |
| MEDIUM | 4.4 | CVE-2025-24790 | Snowflake JDBC uses insecure temporary credential cache file permissions |
| MEDIUM | 4.3 | CVE-2021-39194 | Improper Handling of Missing Values in kaml |
| MEDIUM | 4.3 | CVE-2023-41900 | CVE-2023-41900: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 4.1 | CVE-2024-13176 | CVE-2024-13176 |
| LOW | 3.9 | GHSA-58qw-p7qm-5rvh | GHSA-58qw-p7qm-5rvh: Improper Restriction of XML External Entity Reference |
| LOW | 3.5 | CVE-2023-36479 | CVE-2023-36479: Improper Neutralization of Quoting Syntax |
| LOW | 3.4 | CVE-2024-11053 | CVE-2024-11053 |
| LOW | 3.4 | CVE-2025-0167 | CVE-2025-0167 |
| LOW | 3.3 | CVE-2020-8908 | CVE-2020-8908: Improper Handling of Alternate Encoding |
| LOW | 3.3 | CVE-2025-27496 | Snowflake JDBC Driver client-side encryption key in DEBUG logs |
| LOW | 3.2 | CVE-2025-46394 | CVE-2025-46394 |
| LOW | 3.1 | CVE-2025-58056 | CVE-2025-58056: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') |
| LOW | 2.7 | CVE-2022-2047 | CVE-2022-2047: Improper Input Validation |
| LOW | 2.5 | CVE-2024-58251 | CVE-2024-58251 |
| LOW | 2.4 | CVE-2023-26049 | CVE-2023-26049: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| LOW | 2.0 | CVE-2024-23454 | CVE-2024-23454: Improper Privilege Management |
↑2.10.0
Severity Breakdown
| Severity | Count |
|---|---|
| CRITICAL | 8 |
| HIGH | 48 |
| MEDIUM | 53 |
| LOW | 16 |
Details for version: 2.10.0
CVE Details for Version: 2.10.0
| Severity | Score | CVE ID | Description |
|---|---|---|---|
| CRITICAL | 10.0 | CVE-2025-30065 | CVE-2025-30065: Deserialization of Untrusted Data |
| CRITICAL | 9.8 | CVE-2021-37404 | CVE-2021-37404: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow') |
| CRITICAL | 9.8 | CVE-2022-25168 | CVE-2022-25168: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') |
| CRITICAL | 9.8 | CVE-2023-25613 | CVE-2023-25613: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| CRITICAL | 9.8 | CVE-2025-0665 | CVE-2025-0665 |
| CRITICAL | 9.3 | CVE-2024-47561 | CVE-2024-47561: Deserialization of Untrusted Data |
| CRITICAL | 9.3 | CVE-2025-54988 | CVE-2025-54988: Improper Restriction of XML External Entity Reference |
| CRITICAL | 9.1 | CVE-2023-44981 | zookeeper: Authorization Bypass in Apache ZooKeeper |
| HIGH | 8.8 | CVE-2018-8009 | CVE-2018-8009: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| HIGH | 8.8 | CVE-2018-8029 | CVE-2018-8029: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| HIGH | 8.8 | CVE-2020-9492 | CVE-2020-9492: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| HIGH | 8.8 | CVE-2025-23015 | CVE-2025-23015: Privilege Defined With Unsafe Actions |
| HIGH | 8.8 | CVE-2025-48734 | CVE-2025-48734: Improper Access Control |
| HIGH | 8.7 | CVE-2023-52428 | CVE-2023-52428: Uncontrolled Resource Consumption |
| HIGH | 8.7 | CVE-2024-7254 | CVE-2024-7254: Improper Input Validation |
| HIGH | 8.7 | CVE-2025-52999 | CVE-2025-52999: Stack-based Buffer Overflow |
| HIGH | 8.6 | CVE-2025-50059 | CVE-2025-50059 |
| HIGH | 8.3 | CVE-2025-31498 | CVE-2025-31498 |
| HIGH | 8.2 | CVE-2025-55163 | CVE-2025-55163: Allocation of Resources Without Limits or Throttling |
| HIGH | 8.1 | CVE-2025-26519 | CVE-2025-26519 |
| HIGH | 8.1 | CVE-2025-30749 | CVE-2025-30749 |
| HIGH | 8.1 | CVE-2025-50106 | CVE-2025-50106 |
| HIGH | 8.1 | CVE-2025-59250 | CVE-2025-59250: Improper Input Validation |
| HIGH | 7.8 | CVE-2025-24789 | Snowflake JDBC allows an untrusted search path on Windows |
| HIGH | 7.7 | CVE-2024-47072 | CVE-2024-47072: Stack-based Buffer Overflow |
| HIGH | 7.7 | CVE-2025-23083 | CVE-2025-23083 |
| HIGH | 7.5 | CVE-2017-5637 | zookeeper: Incorrect input validation with wchp/wchc four letter words |
| HIGH | 7.5 | CVE-2018-8012 | zookeeper: No authentication or authorization is enforced when a server joins a quorum |
| HIGH | 7.5 | CVE-2019-16869 | CVE-2019-16869: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') |
| HIGH | 7.5 | CVE-2021-31684 | CVE-2021-31684: Out-of-bounds Read |
| HIGH | 7.5 | CVE-2021-37136 | CVE-2021-37136: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| HIGH | 7.5 | CVE-2022-40150 | CVE-2022-40150: Uncontrolled Resource Consumption |
| HIGH | 7.5 | CVE-2022-41404 | CVE-2022-41404: Uncontrolled Resource Consumption |
| HIGH | 7.5 | CVE-2022-41881 | CVE-2022-41881: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| HIGH | 7.5 | CVE-2022-45685 | CVE-2022-45685: Out-of-bounds Write |
| HIGH | 7.5 | CVE-2022-45693 | CVE-2022-45693: Out-of-bounds Write |
| HIGH | 7.5 | CVE-2023-1370 | CVE-2023-1370: Uncontrolled Recursion |
| HIGH | 7.5 | CVE-2023-1436 | CVE-2023-1436: Uncontrolled Recursion |
| HIGH | 7.5 | CVE-2023-28118 | kaml has potential denial of service while parsing input with anchors and aliases |
| HIGH | 7.5 | CVE-2023-34054 | CVE-2023-34054: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| HIGH | 7.5 | CVE-2023-34062 | CVE-2023-34062: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') |
| HIGH | 7.5 | CVE-2024-21634 | CVE-2024-21634: Allocation of Resources Without Limits or Throttling |
| HIGH | 7.5 | CVE-2024-57699 | CVE-2024-57699: Uncontrolled Recursion |
| HIGH | 7.5 | CVE-2024-8176 | CVE-2024-8176 |
| HIGH | 7.5 | CVE-2025-24970 | CVE-2025-24970: Improper Input Validation |
| HIGH | 7.5 | CVE-2025-27553 | CVE-2025-27553: Relative Path Traversal |
| HIGH | 7.5 | CVE-2025-41249 | CVE-2025-41249: Improper Authorization |
| HIGH | 7.5 | CVE-2025-5399 | CVE-2025-5399 |
| HIGH | 7.5 | CVE-2025-59375 | CVE-2025-59375 |
| HIGH | 7.5 | CVE-2025-9086 | CVE-2025-9086 |
| HIGH | 7.5 | CVE-2025-9230 | CVE-2025-9230 |
| HIGH | 7.4 | CVE-2025-21587 | CVE-2025-21587 |
| HIGH | 7.3 | CVE-2025-0725 | CVE-2025-0725 |
| HIGH | 7.3 | CVE-2025-31344 | CVE-2025-31344 |
| HIGH | 7.2 | CVE-2024-13009 | CVE-2024-13009: Improper Resource Shutdown or Release |
| HIGH | 7.1 | CVE-2025-46762 | CVE-2025-46762: External Control of File Name or Path |
| MEDIUM | 6.9 | CVE-2024-29133 | CVE-2024-29133: Out-of-bounds Write |
| MEDIUM | 6.9 | CVE-2025-30474 | CVE-2025-30474: Exposure of Sensitive Information to an Unauthorized Actor |
| MEDIUM | 6.9 | CVE-2025-31672 | CVE-2025-31672: Improper Input Validation |
| MEDIUM | 6.9 | CVE-2025-58057 | CVE-2025-58057: Improper Handling of Highly Compressed Data (Data Amplification) |
| MEDIUM | 6.8 | CVE-2025-4949 | CVE-2025-4949: Improper Restriction of XML External Entity Reference |
| MEDIUM | 6.5 | CVE-2022-40149 | CVE-2022-40149: Stack-based Buffer Overflow |
| MEDIUM | 6.5 | CVE-2023-34462 | CVE-2023-34462: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 6.5 | CVE-2024-10524 | CVE-2024-10524 |
| MEDIUM | 6.5 | CVE-2024-29131 | CVE-2024-29131: Out-of-bounds Write |
| MEDIUM | 6.5 | CVE-2024-45993 | CVE-2024-45993 |
| MEDIUM | 6.5 | CVE-2024-9681 | CVE-2024-9681 |
| MEDIUM | 6.5 | CVE-2025-48924 | CVE-2025-48924: Uncontrolled Recursion |
| MEDIUM | 6.5 | CVE-2025-4947 | CVE-2025-4947 |
| MEDIUM | 6.5 | CVE-2025-9231 | CVE-2025-9231 |
| MEDIUM | 6.3 | CVE-2024-12797 | CVE-2024-12797 |
| MEDIUM | 6.3 | CVE-2024-6763 | CVE-2024-6763: Improper Validation of Syntactic Correctness of Input |
| MEDIUM | 6.2 | CVE-2025-27817 | CVE-2025-27817: Server-Side Request Forgery (SSRF) |
| MEDIUM | 6.1 | CVE-2025-22227 | CVE-2025-22227: Exposure of Sensitive Information to an Unauthorized Actor |
| MEDIUM | 5.9 | CVE-2019-0201 | zookeeper: Information disclosure in Apache ZooKeeper |
| MEDIUM | 5.9 | CVE-2021-21295 | CVE-2021-21295: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 5.9 | CVE-2021-21409 | CVE-2021-21409: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 5.9 | CVE-2024-27137 | CVE-2024-27137: Exposure of Resource to Wrong Sphere |
| MEDIUM | 5.9 | CVE-2024-43382 | Snowflake JDBC Security Advisory |
| MEDIUM | 5.9 | CVE-2024-50602 | CVE-2024-50602 |
| MEDIUM | 5.9 | CVE-2024-8184 | CVE-2024-8184: Uncontrolled Resource Consumption |
| MEDIUM | 5.9 | CVE-2025-9232 | CVE-2025-9232 |
| MEDIUM | 5.8 | CVE-2024-58103 | Wire has Uncontrolled Recursion on Nested Groups |
| MEDIUM | 5.8 | CVE-2025-53864 | CVE-2025-53864: Uncontrolled Recursion |
| MEDIUM | 5.6 | CVE-2025-30698 | CVE-2025-30698 |
| MEDIUM | 5.5 | CVE-2023-2976 | CVE-2023-2976: Creation of Temporary File in Directory with Insecure Permissions |
| MEDIUM | 5.5 | CVE-2024-35255 | CVE-2024-35255: Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition') |
| MEDIUM | 5.5 | CVE-2025-25193 | CVE-2025-25193: Uncontrolled Resource Consumption |
| MEDIUM | 5.4 | CVE-2024-47535 | CVE-2024-47535: Uncontrolled Resource Consumption |
| MEDIUM | 5.4 | CVE-2025-24860 | CVE-2025-24860: Incorrect Authorization |
| MEDIUM | 5.3 | CVE-2021-34429 | CVE-2021-34429: Exposure of Sensitive Information to an Unauthorized Actor |
| MEDIUM | 5.3 | CVE-2023-26048 | CVE-2023-26048: Uncontrolled Resource Consumption |
| MEDIUM | 5.3 | CVE-2023-40167 | CVE-2023-40167: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 5.3 | CVE-2024-12133 | CVE-2024-12133 |
| MEDIUM | 5.3 | CVE-2024-9823 | CVE-2024-9823: Uncontrolled Resource Consumption |
| MEDIUM | 5.3 | CVE-2025-10148 | CVE-2025-10148 |
| MEDIUM | 5.1 | CVE-2024-38808 | CVE-2024-38808: Allocation of Resources Without Limits or Throttling |
| MEDIUM | 4.8 | CVE-2024-21235 | CVE-2024-21235 |
| MEDIUM | 4.8 | CVE-2024-38827 | CVE-2024-38827: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 4.8 | CVE-2025-21502 | CVE-2025-21502 |
| MEDIUM | 4.8 | CVE-2025-30754 | CVE-2025-30754 |
| MEDIUM | 4.8 | CVE-2025-5025 | CVE-2025-5025 |
| MEDIUM | 4.4 | CVE-2013-2035 | CVE-2013-2035: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 4.4 | CVE-2025-24790 | Snowflake JDBC uses insecure temporary credential cache file permissions |
| MEDIUM | 4.3 | CVE-2010-1330 | CVE-2010-1330: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 4.3 | CVE-2021-39194 | Improper Handling of Missing Values in kaml |
| MEDIUM | 4.3 | CVE-2023-41900 | CVE-2023-41900: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| MEDIUM | 4.3 | CVE-2024-9143 | CVE-2024-9143 |
| MEDIUM | 4.1 | CVE-2024-13176 | CVE-2024-13176 |
| LOW | 3.9 | GHSA-58qw-p7qm-5rvh | GHSA-58qw-p7qm-5rvh: Improper Restriction of XML External Entity Reference |
| LOW | 3.7 | CVE-2024-21208 | CVE-2024-21208 |
| LOW | 3.7 | CVE-2024-21210 | CVE-2024-21210 |
| LOW | 3.7 | CVE-2024-21211 | CVE-2024-21211 |
| LOW | 3.7 | CVE-2024-21217 | CVE-2024-21217 |
| LOW | 3.5 | CVE-2023-36479 | CVE-2023-36479: Improper Neutralization of Quoting Syntax |
| LOW | 3.4 | CVE-2024-11053 | CVE-2024-11053 |
| LOW | 3.4 | CVE-2025-0167 | CVE-2025-0167 |
| LOW | 3.3 | CVE-2020-8908 | CVE-2020-8908: Improper Handling of Alternate Encoding |
| LOW | 3.3 | CVE-2025-27496 | Snowflake JDBC Driver client-side encryption key in DEBUG logs |
| LOW | 3.2 | CVE-2025-46394 | CVE-2025-46394 |
| LOW | 3.1 | CVE-2025-58056 | CVE-2025-58056: Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') |
| LOW | 2.7 | CVE-2022-2047 | CVE-2022-2047: Improper Input Validation |
| LOW | 2.5 | CVE-2024-58251 | CVE-2024-58251 |
| LOW | 2.4 | CVE-2023-26049 | CVE-2023-26049: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities |
| LOW | 2.0 | CVE-2024-23454 | CVE-2024-23454: Improper Privilege Management |