Apache Storm vulnerabilities

• apache storm prometheus reporter Apache Storm Prometheus Reporter: Disabling TLS verification for Prometheus Reporter also disables it for all other connections CVE-2026-40557 Fix available 4.8 MediumApril 27, 2026
• apache storm, apache software foundation storm client +1 more Apache Storm Client: Anonymous principal assigned on TLS client certificate verification failure CVE-2026-41081 Fix available 6.5 MediumApril 27, 2026
• apache storm, apache software foundation storm client +1 more Apache Storm Client: RCE through Unsafe Deserialization via Kerberos TGT Credential Handling CVE-2026-35337 Fix available 8.8 HighApril 13, 2026
• apache storm, apache software foundation storm ui +1 more Apache Storm UI: Stored Cross-Site Scripting (XSS) via Unsanitized Topology Metadata in Storm UI CVE-2026-35565 Fix available 5.4 MediumApril 13, 2026
• apache storm Apache Storm: Local Information Disclosure Vulnerability in Storm-core on Unix-Like systems due temporary files CVE-2023-43123 Fix available 5.5 MediumNovember 23, 2023
• apache storm Unsafe Pre-Authentication Deserialization In Workers CVE-2021-40865 Public exploitFix available EPSS 64.2% 9.8 CriticalOctober 25, 2021
• apache storm Shell Command Injection Vulnerability in Nimbus Thrift Server CVE-2021-38294 Public exploitFix available EPSS 83.8% 9.8 CriticalOctober 25, 2021
• apache storm Deserialization of Untrusted Data in Apache Storm CVE-2018-11779 Fix available 9.8 CriticalJuly 25, 2019
• apache storm Exposure of Sensitive Information in Apache Storm Logviewer CVE-2019-0202 Fix available 7.5 HighJuly 25, 2019
• apache storm Code execution in org.apache.storm:storm-core CVE-2018-1331 Fix available 8.8 HighJuly 10, 2018
• apache storm ZipSlip in org.apache.storm:storm-core CVE-2018-8008 Fix available 5.5 MediumJune 5, 2018
• apache storm Moderate severity vulnerability that affects org.apache.storm:storm-core CVE-2018-1332 Fix available 6.5 MediumJune 5, 2018
• apache storm Apache Storm log viewer path traversal vulnerability CVE-2014-0115 7.5 HighOctober 30, 2017
• apache storm Apache Storm it is possible for the owner of a topology to trick the supervisor to launch a worker as a different, non-root, user CVE-2017-9799 Fix available 8.8 HighAugust 9, 2017
• apache storm Apache Storm remote code execution vulnerability CVE-2015-3188 Fix available EPSS 14.4% 9.8 CriticalJanuary 13, 2017