CVE-2026-24713

CriticalCVSS 9.8/10Last modified Jun 17, 2026

Description

Improper Input Validation vulnerability in Apache IoTDB.

This issue affects Apache IoTDB: from 1.0.0 before 1.3.7, from 2.0.0 before 2.0.7.

Users are recommended to upgrade to version 1.3.7 or 2.0.7, which fixes the issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-20CWE-917

Affected software

VendorProductVersions
Apache Software FoundationApache IoTDB>= 1.0.0, < 1.3.7; >= 2.0.0, < 2.0.7

References

Timeline

Published
Mar 9, 2026
Last modified
Jun 17, 2026
NVD status
Analyzed

Related CVEs from 2026

CVE-2026-247148.7Some end of service NETGEAR products provide "TelnetEnable" functionality, which allows a magic packet to activate telnet service on the boxCVE-2026-247155.3An observable timing discrepancy vulnerability has been reported to affect QuRouter. If exploited, the vulnerability could allow remote attaCVE-2026-247167.2A NULL pointer dereference vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an aCVE-2026-247176.5A path traversal vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administratCVE-2026-247185.3A path traversal vulnerability has been reported to affect Qsync Central. If a remote attacker gains a user account, they can then exploit tCVE-2026-247197.2A command injection vulnerability has been reported to affect several QNAP operating system versions. If a remote attacker gains an administCVE-2026-24728.1Stored Cross-Site Scripting (XSS) in the _genai/_evals_visualization component of Google Cloud Vertex AI SDK (google-cloud-aiplatform) versiCVE-2026-247206.5An allocation of resources without limits or throttling vulnerability has been reported to affect File Station 6. If a remote attacker gainsCVE-2026-247216.5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can theCVE-2026-247226.5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can theCVE-2026-247236.5A NULL pointer dereference vulnerability has been reported to affect File Station 5. If a remote attacker gains a user account, they can theCVE-2026-247248.1An incorrect authorization vulnerability has been reported to affect File Station 6. If a remote attacker gains a user account, they can the
CVE-2026-24713: Critical severity, CVSS 9.8 | Vulnix