CVE-2026-64610

CriticalCVSS 9.8/10Last modified Oct 20, 2026

Description

Deserialization of Untrusted Data vulnerability in Apache Kylin. Unsafe Java deserialization could happen from a broken external cache service.

This issue affects Apache Kylin: from 4 through 5.0.4.

Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-502

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Oct 16, 2026
Last modified
Oct 20, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-646117.5A flaw was found in libcupsfilters. The cfIEEE1284NormalizeMakeModel() function enters an infinite loop when processing a printer-advertisedCVE-2026-646127.5A flaw was found in libcupsfilters and cups-filters. The PNG image reading function creates a libpng reader without installing an error recoCVE-2026-646136.2Data::Buffer::Shared versions before 0.05 for Perl create a world-readable mmap backing file and open it without O_NOFOLLOW. The segment isCVE-2026-646143.8Data::Deque::Shared versions before 0.06 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The sCVE-2026-646153.3Data::Graph::Shared versions before 0.04 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The sCVE-2026-646163.3Data::NDArray::Shared versions before 0.02 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. TheCVE-2026-646173.8Data::PubSub::Shared versions before 0.07 for Perl create a world-readable mmap backing file and open it without O_EXCL or O_NOFOLLOW. The CVE-2026-646197.5FileCodeBox before 2.4 contains a rate-limit bypass vulnerability in the IPRateLimit class that allows unauthenticated attackers to circumveCVE-2026-646209.1FreeRDP before 3.28.0 (affected <=3.27.1) contains a heap-based buffer overflow in crypto_rsa_common() (libfreerdp/crypto/crypto.c). The funCVE-2026-646217.3FreeRDP before 3.28.0 (affected 3.x through 3.27.1) contains a double-free vulnerability in freerdp_client_rdp_file_apply_to_settings() (cliCVE-2026-646227.5Network-AI (npm: network-ai) versions 5.12.2 through 5.13.3 fail to apply the configured authorization check (checkAuth/secret) to the ApproCVE-2026-646238.6Network-AI before 5.13.4 contains an improper cryptographic signature verification vulnerability in APSAdapter where the default local verif
CVE-2026-64610: Critical severity, CVSS 9.8 | Vulnix