CVE-2026-66084Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream EndpointCVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-66082Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow）CVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-66087Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint EndpointCVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-71896Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account InformationCVSSUnrated–Not in KEV0.3%EPSS1article
CVE-2026-71895Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes CredentialsCVSSUnrated–Not in KEV0.2%EPSS1article
CVE-2026-71183Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and PasswordsCVSSUnrated–Not in KEV0.2%EPSS1article
How these numbers are made
CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.
CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.
Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.
Product names are grouped by normalised names, with version and edition tails removed.
Fix listed refers to an advisory. Unknown fix status is counted as not listed.