apache hadoop

Name: apache hadoop
Brand: apache

productUS

cpe:2.3:a:apache:hadoop:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

7critical20high7medium1low

updated 2026-10-28

vulnerabilities (37)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2019-17195US	critical9.8	11.1% (96th)	Exploit	no fix	2019-10-15	= 3.2.1
CVE-2021-25642US	high8.8	2.30% (83rd)	Exploit	3.2.4	2022-08-25	3 versions
CVE-2018-8009US	high8.8	6.73% (94th)	—	no fix	2018-11-13	8 versions
CVE-2018-11768US	high7.5	6.61% (94th)	—	no fix	2019-10-04	14 versions
CVE-2017-3162US	high7.3	6.42% (94th)	—	no fix	2017-04-26	≤ 2.6.5
CVE-2018-11765US	high7.5	5.21% (92nd)	—	no fix	2020-09-30	3 versions
CVE-2012-1574US	medium6.5	4.77% (92nd)	—	no fix	2012-04-12	7 versions
CVE-2022-25168US	critical9.8	4.59% (92nd)	—	no fix	2022-08-04	3 versions
CVE-2020-9492US	high8.8OT elevated	4.49% (91st)	—	no fix	2021-01-26	3 versions
CVE-2022-26612US	critical9.8	4.24% (91st)	—	3.2.3	2022-04-07	3 versions
CVE-2021-33036US	high8.8	3.97% (90th)	—	3.2.3	2022-06-15	4 versions
CVE-2018-8029US	high8.8	3.91% (90th)	—	no fix	2019-05-30	5 versions
CVE-2017-3161US	medium6.1	3.87% (90th)	—	no fix	2017-04-26	≤ 2.6.5
CVE-2018-11767US	high7.4	3.73% (90th)	—	no fix	2019-03-21	3 versions
CVE-2016-3086US	critical9.8	3.65% (90th)	—	no fix	2017-09-05	8 versions
CVE-2017-15718US	critical9.8	3.57% (89th)	—	no fix	2018-01-24	2 versions
CVE-2018-1296US	high7.5	3.33% (89th)	—	no fix	2019-02-07	7 versions
CVE-2018-11766US	high8.8	3.24% (88th)	—	no fix	2018-11-27	2.7.4 → 2.7.6
CVE-2016-5393US	high8.8	3.14% (88th)	—	no fix	2016-11-29	8 versions
CVE-2014-3627US	medium5.0	3.00% (87th)	—	no fix	2014-12-05	26 versions
CVE-2021-37404US	critical9.8	2.99% (87th)	—	3.3.2	2022-06-13	4 versions
CVE-2012-2945US	high7.5	2.67% (86th)	—	no fix	2019-10-29	= 1.0.3
CVE-2012-3376US	high7.5	2.63% (85th)	—	no fix	2012-07-12	= 2.0.0
CVE-2016-6811US	high8.8	2.62% (85th)	—	no fix	2017-04-11	2.2.0 → 2.7.3
CVE-2018-11764US	high8.8OT elevated	2.39% (84th)	—	no fix	2020-10-21	= 3.0.0
CVE-2017-15713US	medium6.5	2.21% (83rd)	—	no fix	2018-01-19	12 versions
CVE-2023-26031US	high7.5	2.09% (82nd)	—	no fix	2023-11-16	3.3.1 → 3.3.4
CVE-2017-7669US	high7.5	1.80% (78th)	—	no fix	2017-06-05	2 versions
CVE-2014-0229US	medium6.5	1.60% (76th)	—	no fix	2017-03-23	22 versions
CVE-2012-4449US	critical9.8OT elevated	1.19% (68th)	—	no fix	2017-10-30	8 versions
CVE-2013-2192US	low3.2	1.07% (65th)	—	no fix	2014-01-24	23 versions
CVE-2025-27821US	—	0.91% (60th)	—	3.4.2	2026-01-26	3.2.0 → 3.4.2
CVE-2016-5001US	medium5.5	0.70% (53rd)	—	no fix	2017-08-30	3 versions
CVE-2015-7430US	high8.4	0.51% (43rd)	—	no fix	2016-01-02	4 versions
CVE-2024-23454US	—	0.41% (35th)	—	3.4.0	2024-09-25	< 3.4.0
CVE-2017-3166US	high7.8	0.32% (25th)	—	no fix	2017-11-13	10 versions
CVE-2015-1776US	medium6.2	0.32% (25th)	—	no fix	2016-04-19	5 versions

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-200Exposure of Sensitive Information to an Unauthorized Actor6 CVEs
CWE-264CWE-2645 CVEs
CWE-287Improper Authentication4 CVEs
CWE-22Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')3 CVEs
CWE-269Improper Privilege Management3 CVEs
CWE-59Improper Link Resolution Before File Access ('Link Following')3 CVEs
CWE-20Improper Input Validation2 CVEs
CWE-310CWE-3102 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE37 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan