How many CVEs have a located fix in apache/kylin?

13 published CVEs have a fix traced to functions in apache/kylin, touching 57 functions across 36 files.

Which function in apache/kylin has been patched by the most CVEs?

runNativeCommand in core-common/src/main/java/org/apache/kylin/common/util/CliCommandExecutor.java has been changed by 3 CVE fixes, from 2020 to 2022.

How large is a typical CVE fix in apache/kylin?

The median fix changes 36 lines. 31% of fixes change 20 lines or fewer, and 8% change a single function.

How is a fix located to a function?

The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

RadicalNotion.AI

Log in Create an account

java

xml

#457 of 500 repositories

apache/kylin

Name: apache/kylin: functions patched by CVE fixes
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

Functions and files changed by CVE fixes in this repository.

Latest located fix October 2, 2025

13

CVE fixes located

Published CVEs

57

Functions patched

Distinct function sites

36

Files patched

Distinct source files

2020–2025

Years covered

By CVE publication date

Overview

13 published CVEs have a fix traced to functions in apache/kylin, the earliest published in 2020. Those fixes changed 57 distinct functions across 36 files, in 127 patch hunks.

Among the 500 repositories tracked here, apache/kylin ranks #457 by the number of CVEs with a located fix.

Most patched functions

Functions in apache/kylin changed by the most CVE fixes.

Most patched files

Files in apache/kylin changed by the most CVE fixes.

1src/common-server/src/main/java/org/apache/kylin/rest/controller/NBasicController.java3 CVEs · 4 functions
2core-common/src/main/java/org/apache/kylin/common/util/CliCommandExecutor.java3 CVEs · 3 functions
3src/common-service/src/main/java/org/apache/kylin/rest/service/ProjectService.java3 CVEs · 3 functions
4server-base/src/main/java/org/apache/kylin/rest/service/CubeService.java2 CVEs · 9 functions
5src/ops-server/src/main/java/org/apache/kylin/rest/controller/OpsController.java2 CVEs · 6 functions
6src/common-service/src/main/java/org/apache/kylin/rest/service/FileService.java2 CVEs · 3 functions
7core-common/src/main/java/org/apache/kylin/common/KylinConfigBase.java2 CVEs · 2 functions
8src/core-metadata/src/main/java/org/apache/kylin/metadata/resourcegroup/ResourceGroupManager.java2 CVEs · 2 functions
9core-common/src/main/java/org/apache/kylin/common/util/ServerMode.java2 CVEs · 1 functions
10server-base/src/main/java/org/apache/kylin/rest/service/StreamingV2Service.java2 CVEs · 1 functions

Fix size

How much code a CVE fix in apache/kylin changes, with backports counted once.

36

Median lines changed

Added plus removed, per CVE

31%

Fixes of 20 lines or fewer

Share of CVE fixes

8%

Fixes in a single function

Share of CVE fixes

Latest CVEs

The most recently published CVEs with a fix located in apache/kylin, and the functions each fix changed.

Apache Kylin: Server-Side Request Forgery
CVE-2025-61735checkServer getSafeAbsolutePath generateTempKeytab
High · CVSS 7.3
EPSS 0.5%2025-10-02
Apache Kylin: Authentication bypass
CVE-2025-61733updateUser updateUserWithoutAuth antMatchers
High · CVSS 7.5
EPSS 1.3%2025-10-02
Apache Kylin: improper restriction of file read
CVE-2025-61734checkServer getSafeAbsolutePath generateTempKeytab
High · CVSS 7.5
EPSS 19.8%2025-10-02
Apache Kylin: The remote code execution via jdbc url
CVE-2025-30067AbstractJdbcSourceConnectionValidator isSourceJdbcWhiteListEnabled JdbcSourceConnectionValidator
Low · CVSS 2.1
EPSS 0.9%2025-03-27
Apache Kylin Server-Side Request Forgery (SSRF) via `/kylin/api/xxx/diag` Endpoint
CVE-2024-48944decodeHost encodeHost
Low · CVSS 2.1
EPSS 0.6%2025-03-27
Apache Kylin has Insufficiently Protected Credentials
CVE-2023-29055exportAllToString
High · CVSS 7.5
EPSS 1.1%2024-01-29
Apache Kylin vulnerable to Command injection by Diagnosis Controller
CVE-2022-44621getSparkSubmitCmd generateSparkCmd dumpJobDiagnosisInfo
Critical · CVSS 9.8
EPSS 3.1%2022-12-30
Command Injection in Apache Kylin
CVE-2021-45456dumpProjectDiagnosisInfo getEncryptCipherIvSpec getCipher
Critical · CVSS 9.8
EPSS 88.9%2022-01-06
SQL Injection in Apache Kylin
CVE-2021-36774isCoordinatorCoLocate checkHostName calReplicaSetState
Medium · CVSS 6.5
EPSS 1.9%2022-01-06
Kylin can receive user input and load any class through Class.forName(...).
CVE-2021-31522getValidClass setParam
Critical · CVSS 9.8
EPSS 2.9%2022-01-06
Server-Side Request Forgery in Apache Kylin
CVE-2021-27738isCoordinatorCoLocate checkHostName calReplicaSetState
High · CVSS 7.5
EPSS 2.6%2022-01-06
Command Injection in Kylin
CISA KEV
CVE-2020-1956checkParameterWhiteList migrateCube runNativeCommand
High · CVSS 8.7
EPSS 97.3%2020-05-22

Get an alert for each new apache/kylin CVE, with the patched functions and AI-written analysis.

Monitor kylin CVEs

Other repositories

Repositories with a similar number of located CVE fixes.

apache/superset13 CVEs bagisto/bagisto13 CVEs better-auth/better-auth13 CVEs caddyserver/caddy13 CVEs cerebrate-project/cerebrate13 CVEs CoreWCF/CoreWCF13 CVEs craftcms/commerce13 CVEs debian/bind913 CVEs

Browse all repositories

Frequently asked questions

Common questions about CVE fixes in apache/kylin.

How many CVEs have a located fix in apache/kylin?: 13 published CVEs have a fix traced to functions in apache/kylin, touching 57 functions across 36 files.
Which function in apache/kylin has been patched by the most CVEs?: runNativeCommand in core-common/src/main/java/org/apache/kylin/common/util/CliCommandExecutor.java has been changed by 3 CVE fixes, from 2020 to 2022.
How large is a typical CVE fix in apache/kylin?: The median fix changes 36 lines. 31% of fixes change 20 lines or fewer, and 8% change a single function.
How is a fix located to a function?: The upstream fix commit for each CVE is fetched and its diff is split into hunks. Each hunk is attributed to the function, method or type it changes, using the definition the diff itself names. Backports of the same fix to stable branches are counted once.

References

Fix locations are computed by RadicalNotion.AI from the upstream patch diff of each CVE. CVE data is sourced from the CVE Program.

Track apache/kylin CVEs

Get an alert when a new CVE lands in this repository, with the patched functions and AI-written remediation guidance.

Create an account See pricing