CVE-2026-64610None▾ SunlitDeserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service. This issue affects Apache Kylin: from 4 through 5.0.4. Users are recommended to upgrade…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 2.8 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service.
This issue affects Apache Kylin: from 4 through 5.0.4.
Users are recommended to upgrade to version 5.0.5, which fixes the issue.
apache_kylin >= 4..0.0 <= 5.0.4Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Connected by shared product, vendor, weakness, or advisory.
CVE-2026-63618NoneApache Kylin: Low-Privilege Config Exposure
CVE-2026-63619NoneApache Kylin: Missing authorization and path-confinement on system meta dump
CVE-2026-68571NoneApache Kylin: JDBC URL Whitelist Verification Bypass
CVE-2026-64959NoneApache Kylin: Missing authentication on certain cache API endpoints
CVE-2026-96806NoneApache Airflow Keycloak provider: Keycloak auth manager: logout does not invalidate the session — JWTMiddleware mints an unrevoked replacement token
CVE-2026-94134NoneApache Airflow SSH provider, Apache Airflow SFTP provider: SSH hook disables host-key verification by default