Apache · weakness class
SQL Injection
80 CVEs
Every dot is a CVE in what this vendor ships; the named ones are the most at risk.
- check available
- 2
- likely to be exploited
- 4
Every one of the 80 is a mark on the map. Named now: 53 to 78, most at risk first.
- Apache Kylin: SQL Injection Vulnerability in Catalog Cache Refresh API
- Apache Ranger: SQL Injection vulnerability in lookup functionality
- Apache Doris MCP Server: MCP SQL inject
- Apache Fineract: Boolean SQL Injection in Client Search API (orderBy parameter) leading to Local File Disclosure
- Apache Camel Neo4j: Cypher injection vulnerability in Camel-Neo4j component
- Apache StreamPark (incubating): Unchecked SQL query fields trigger SQL injection vulnerability
- Apache StreamPark: SQL injection vulnerability
- Apache Fineract: SQL injection vulnerability in Search API
- Apache VCL: SQL injection vulnerability in New Block Allocation form
- Apache OFBiz: SQL injection - performFind ignore-case values, MySQL/MariaDB
- Apache Syncope: SQL injection via sort parameter in Task search
- Apache Syncope: SQL injection via unsanitized entityKey and opEvent in Audit Events search
- Apache Syncope: Cypher Injection via FIQL Search on Neo4j Persistence
- Apache Fineract: SQL injection via ORDER BY parameters in the Center and datatables endpoints
- Apache Portable Runtime Utility: SQL Injection in apr_dbd_oracle
- Apache Doris MCP Server: SQL injection leading the authentication bypass
- Apache Gravitino: SQL misconfiguration can access or truncate files
- Apache Airflow Teradata provider: SQL injection via unvalidated Dag Params in the compute-cluster example Dag
- Apache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injectio…
- Apache Airflow Google provider: Google Drive query injection via unescaped file and folder names
- Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC, Apache Flink CDC: SQL injection via maliciously crafted identifiers
- Apache Griffin Hive Metastore Module: SQL Injection Vulnerability in Hive Metastore Module
- Apache Syncope: SQL injection via unsanitized opEvent in Audit Events search
- Apache Cocoon: SQL Injection
- Apache Hive: SQL injection vulnerability when processing delete column statistics requests via the HMS Thrift APIs
- Apache Kylin: Missing authentication on certain cache API endpoints
exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it
Zoom in on the map and the dots under the middle of it are named where they are.
Data as of 2026-11-15. CVE List through 2026-11-15 · EPSS of 2026-11-15 · CISA KEV checked 2026-11-15. Sources: the CVE List, CISA KEV, EPSS, NVD, nuclei templates and public bug bounty data.