CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,498 CVEs published, 357 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,498
Show in the list
Critical, last 7 days
357
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product apache_software_foundation:apache_dolphinscheduler. Show all products

15 CVEs, showing 1 to 15
CVESeverityTitlePublished
CVE-2026-49050High 8.8Apache DolphinScheduler: General user can mint admin access tokens via /access-tokens
Assigned by apache
Aug 25, 2026
CVE-2026-57590High 8.1Apache DolphinScheduler: Missing Authorization in Task Group APIs Allows Unauthorized Cross-Project Operations
Assigned by apache
Sep 24, 2026
CVE-2026-66083Medium 6.5Apache DolphinScheduler: Unauthorized Disclosure of Data Source Information via /datasources/unauth-datasource
Assigned by apache
Sep 29, 2026
CVE-2026-82804High 8.8Apache DolphinScheduler: Command Injection in the Alert Script Plugin
Assigned by apache
Sep 29, 2026
CVE-2026-81569Medium 4.3Apache DolphinScheduler: Improper Authorization in Sub-Workflow Tasks Allows Unauthorized Workflow Execution
Assigned by apache
Sep 29, 2026
CVE-2026-78214Medium 5.3Apache DolphinScheduler: Actuator Endpoint Authentication Bypass via Percent-Encoded Paths
Assigned by apache
Sep 29, 2026
CVE-2026-71899Medium 6.5Apache DolphinScheduler: Missing Authorization in query-dynamic-sub-workflows API Leads to Information Disclosure
Assigned by apache
Sep 29, 2026
CVE-2026-71898Medium 4.3Apache DolphinScheduler: Improper Authorization Allows Project Read-Only Users to Execute Workflows and Tamper with Workflow Definitions
Assigned by apache
Sep 29, 2026
CVE-2026-71897Medium 4.3Apache DolphinScheduler: Allows unauthorized workflow operations through batch-copy and batch-move endpoints
Assigned by apache
Sep 29, 2026
CVE-2026-66082Medium 6.5Apache DolphinScheduler: Cross-project authorization bypasses in DolphinScheduler API (schedule / workflow)
Assigned by apache
Oct 8, 2026
CVE-2026-66084High 8.1Apache DolphinScheduler: Project Authorization Bypass in the Task Definition with-upstream Endpoint
Assigned by apache
Oct 8, 2026
CVE-2026-66087High 8.1Apache DolphinScheduler: Project Authorization Bypass in the Task instance stop/savepoint Endpoint
Assigned by apache
Oct 8, 2026
CVE-2026-71183High 7.1Apache DolphinScheduler: Missing Authorization Checks Allow Disclosure of Data Source Information and Passwords
Assigned by apache
Oct 8, 2026
CVE-2026-71895High 7.1Apache DolphinScheduler: Missing Authorization Checks Allow Non-Admin Users to Retrieve Kubernetes Credentials
Assigned by apache
Oct 8, 2026
CVE-2026-71896Medium 6.5Apache DolphinScheduler: Missing Authorization Checks Allow Unauthorized Disclosure of User Account Information
Assigned by apache
Oct 8, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.