Skip to content

/

ZeroHour

ZeroHour aggregates public sources — security and AI press, vendor advisories, NVD, CISA KEV, FIRST EPSS, leak-site trackers and Have I Been Pwned — and classifies them with AI. Summaries can be wrong: read the original. All times are UTC.

News CVEs Incidents Tags Daily brief Traffic Sources RSS & API Kiosk Health Sitemap

Home
News feed
Exploited now

Security

CVEs
Ransomware & breaches
Threat actors & entities
IOCs

AI

AI & models

Explore

Tags
Daily brief
Analytics
Traffic & readers
Ask the feed
Sources

You

Watchlist
Saved
RSS, API & alerts

07:57 UTC· 6m ago

#apache-storm — news, CVEs and analysis · ZeroHour

today 46 visits · 59 views · 7 reads·all time 17K views

Tag

#apache-storm

0 stories this week · 11 this month · 11 in 6 months · mostly security

stories per day · 30 days

Related#information-disclosure 4 #blobstore 3 #denial-of-service 2 #nimbus 2 #privilege-escalation 2 #storm-client 2 #worker-launcher 2 #access-control 1 #acl 1 #authorization-bypass 1 #cors 1 #credential-disclosure 1 #cross-tenant 1 #cve 1 #cve-2026-82427 1 #cve-2026-82428 1 #cve-2026-82429 1 #cve-2026-82430 1

11 stories, newest first · one card per story

oss-security·13d ago

Re: CVE-2026-82434: Apache Storm Nimbus, Apache Storm Client: Disclosure of the Topology ZooKeeper Credential to Read-Only Users and to Logs

#apache-storm #credential-disclosure #cve

CVE-2026-82434

oss-security·13d ago

CVE-2026-84179: Apache Storm Nimbus, Apache Storm UI: Disclosure of Unredacted Merged Daemon Configuration via the Topology Page

#apache-storm #cve-2026-84179 #information-disclosure

CVE-2026-84179

oss-security·13d ago

CVE-2026-82441: Apache Storm Nimbus: Cross-Tenant Blob Deletion and Cluster Denial of Service via Unvalidated Topology Dependency Keys

#apache-storm #blobstore #cve-2026-82441

CVE-2026-82441

1

oss-security·13d ago

CVE-2026-82439: Apache Storm DRPC: Unauthenticated Unbounded Memory Growth in DRPC

#apache-storm #cve-2026-82439 #denial-of-service

CVE-2026-82439

oss-security·13d ago

CVE-2026-82438: Apache Storm Webapp: Authenticated API Responses Exposed to Arbitrary Web Origins

#apache-storm #cors #cve-2026-82438

CVE-2026-82438

1

oss-security·13d ago

CVE-2026-82437: Apache Storm Logviewer: Log Access Controls Not Enforced by Logviewer

#access-control #apache-storm #cve-2026-82437

CVE-2026-82437

oss-security·13d ago

CVE-2026-82431: Apache Storm Client: Authorization Bypass When nimbus.groups Is Configured Without nimbus.users

#acl #apache-storm #authorization-bypass

CVE-2026-82431

oss-security·13d ago high

CVE-2026-82430: Apache Storm Worker Launcher: Local Privilege Escalation to Root via Container Command Files Chowned to the Tenant

#apache-storm #cve-2026-82430 #docker

CVE-2026-82430

oss-security·13d ago high

CVE-2026-82429: Apache Storm Worker Launcher: Local Privilege Escalation to Root via a Time-of-Check Race in the Worker Launcher

#apache-storm #cve-2026-82429 #privilege-escalation

CVE-2026-82429

oss-security·13d ago

CVE-2026-82428: Apache Storm Client: Cross-Tenant Dependency Jar Substitution via Predictable Blob Keys

#apache-storm #blobstore #cross-tenant

CVE-2026-82428

1

oss-security·13d ago

CVE-2026-82427: Apache Storm Nimbus: Path Traversal as the Supervisor User via Unsanitised Blobstore Map Local Name

#apache-storm #blobstore #cve-2026-82427

CVE-2026-82427

1