Product by Apache Software Foundation

    Apache Storm

    14 known vulnerabilities in Apache Storm (Apache Software Foundation), 0 of them actively exploited (CISA KEV).

    Key figures

    14

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    4

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority.

    Vulnerabilities in Apache Storm (Apache Software Foundation)
    SeverityCVETitleCVSSPublished
    CriticalCVE-2021-38294

    Shell Command Injection Vulnerability in Nimbus Thrift Server

    		9.8
    CriticalCVE-2021-40865

    Unsafe Pre-Authentication Deserialization In Workers

    		9.8
    CriticalCVE-2015-3188

    Apache Storm: Code Execution

    		9.8
    CriticalCVE-2018-11779

    Apache Storm: Deserialization of Untrusted Data

    		9.8
    HighCVE-2017-9799

    Apache Storm: security vulnerability

    		8.8
    HighCVE-2018-1331

    Apache Storm: Code Execution

    		8.8
    HighCVE-2014-0115

    Apache Storm: Path Traversal

    		7.5
    HighCVE-2026-35337

    Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling

    		8.8
    HighCVE-2019-0202

    Apache Storm: Exposure of Sensitive Information to an Unauthorized Actor

    		7.5
    MediumCVE-2018-8008

    Apache Storm: Path Traversal

    		5.5
    MediumCVE-2018-1332

    Apache Storm: security vulnerability

    		6.5
    MediumCVE-2026-35565

    Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Storm UI

    		5.4
    MediumCVE-2026-41081

    Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure

    		6.5
    MediumCVE-2023-43123

    Apache Storm: Exposure of Sensitive Information to an Unauthorized Actor

    		5.5

    All products by Apache Software Foundation