Index

Search

Search the public record. Drafts and scheduled notes are not included.

news

Apache Kylin 5.0.5 fixes 21 CVEs, including critical CVE-2026-64959

Apache Kylin 5.0.5 fixes 21 CVEs announced on 16 October 2026. Apache rates CVE-2026-64959 critical: missing authentication on backend cache API endpoints can lead to SQL injection in 5.0.0 through 5.0.4. Apache says public-facing services are hit most. Not in CISA KEV as of check. No exploitation reported.

Published 4h ago

CriticalNo PoC

CVE-2026-64959

Apache Kylin missing authentication on backend cache API enables SQL injection

Auth bypass

Published 3d ago

HighNo PoC

CVE-2026-63618

Apache Kylin low-privilege users can read system configuration

Info disclosure

Published 3d ago