Apache Storm Ui (Apache Software Foundation) - vulnerabilities (CVEs)

3 CVEs, 0 in the last 30 days, 2 known versions, newest CVE from 2026-09-14. Vendor: Apache Software Foundation.

CVEs of Apache Storm Ui

• CVE-2026-82433 - CVSS 6.5 (medium), 2026-09-14: Description `getNimbusConf` returned the complete daemon configuration without redaction after only a user-level authorization check. Where the cluster is…
• CVE-2026-84179 - CVSS 6.5 (medium), 2026-09-14: Description getTopologyPageInfo merged the Nimbus daemon configuration with the topology's own configuration and returned the result without redaction in the…
• CVE-2026-35565 - CVSS 5.4 (medium), 2026-04-13: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Apache Storm UI Versions Affected: before 2.8.6 Description: The Storm UI visualization…