CVE-2026-64959

CriticalCVSS 9.8/10Last modified Oct 20, 2026

Description

Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection'), Missing Authentication for Critical Function vulnerability in Apache Kylin. Impact most to the kylin services that are directly exposed to public network, which is not common. In-house kylin deployments are mostly not impacted.

This issue affects Apache Kylin: from 5 through 5.0.4. Certain backend cache API misses required authentication and can cause execution of injected SQL.

Users are recommended to upgrade to version 5.0.5, which fixes the issue.

Metrics

CVSS 3.1 9.8/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-89 CWE-306

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published: Oct 16, 2026
Last modified: Oct 20, 2026
NVD status: Awaiting Analysis

Related CVEs from 2026

CVE-2026-64965.4A vulnerability was found in prasathmani TinyFileManager up to 2.6. Affected is an unknown function of the file /filemanager.php of the comp CVE-2026-649608.7ATutor Gameme module allows users to upload files of any type and extension without restriction. Due to improper handling of file uploads, f CVE-2026-649616.3ATutor is vulnerable to authentication bypass . Although a token validation check is present in the auto-login functionality, the values req CVE-2026-649625.1ATutor is vulnerable to Cross-Site Request Forgery (CSRF) in profile update functionality. An attacker can craft a malicious website which, CVE-2026-649632.3A path traversal vulnerability in ATutor allows an authenticated user to access files from other course directories when the AT_FORCE_GET_FI CVE-2026-649646.3ATutor generates predictable email confirmation tokens due to the use of insufficiently random values in the account confirmation functional CVE-2026-649655.3ATutor is vulnerable to Missing Authorization Check on Test and Question Import endpoints. A low-privileged authenticated user (e.g. a stud CVE-2026-649668.7ATutor is vulnerable to a Path Traversal vulnerability in ZIP extraction functionality. An attacker with instructor privileges can upload an CVE-2026-649676.9A path traversal vulnerability in ATutor's error log viewer allows an attacker with administrative privileges to access arbitrary files outs CVE-2026-649685.1ATutor is vulnerable to Server-Side request forgery in import functionalities. An authenticated administrator can make the server request ar CVE-2026-649695.3ATutor is vulnerable to Insecure Direct Object Reference (IDOR) attack in profile picture related endpoints. Any authenticated user, includi CVE-2026-64976.3A vulnerability was determined in prasathmani TinyFileManager up to 2.6. Affected by this vulnerability is an unknown functionality of the f