https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 05:25:29 +0000 https://cve.radiocsirt.org/vuln/bit-spark-2026-32773 <p><strong>Affected:</strong> Bitnami: spark</p> <p>There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.</p> <p>This CVE is marked as &#34;low&#34; since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.</p> <p>Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.</p> <p><strong>Affected:</strong> Bitnami: spark</p> <p>There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.</p> <p>This CVE is marked as &#34;low&#34; since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.</p> <p>Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.</p> https://cve.radiocsirt.org/vuln/bit-spark-2026-32773 https://cve.radiocsirt.org/vuln/euvd-2026-362938 EUVD-2026-362938 https://cve.radiocsirt.org/vuln/euvd-2026-362938 https://cve.radiocsirt.org/vuln/fkie_cve-2026-32773 <p>There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.</p> <p>This CVE is marked as &#34;low&#34; since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.</p> <p>Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.</p> <p>There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.</p> <p>This CVE is marked as &#34;low&#34; since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.</p> <p>Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-32773 https://cve.radiocsirt.org/vuln/ghsa-9437-39hj-3c93 <p><strong>Affected:</strong> PyPI: pyspark, Maven: org.apache.spark:spark-core_2.12, Maven: org.apache.spark:spark-core_2.13</p> <p>There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.</p> <p>This CVE is marked as &#34;low&#34; since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.</p> <p>Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.</p> <p><strong>Affected:</strong> PyPI: pyspark, Maven: org.apache.spark:spark-core_2.12, Maven: org.apache.spark:spark-core_2.13</p> <p>There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.</p> <p>This CVE is marked as &#34;low&#34; since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.</p> <p>Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.</p> https://cve.radiocsirt.org/vuln/ghsa-9437-39hj-3c93 https://cve.radiocsirt.org/vuln/pysec-2026-3966 <p><strong>Affected:</strong> PyPI: pyspark</p> <p>There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.</p> <p>This CVE is marked as &#34;low&#34; since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.</p> <p>Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.</p> <p><strong>Affected:</strong> PyPI: pyspark</p> <p>There is a lack of XSS escaping in the Spark History Server prior to 3.5.8 which allows a malicious Spark job to generate arbitrary unescaped frontend code which could lead to a minimal privilege escalation in browser. Users are encouraged to upgrade to Spark 3.5.8 or later.</p> <p>This CVE is marked as &#34;low&#34; since the path to exploit requires both relatively high permissions (ability to launch a Spark job) and requires tricking a user with higher permissions to log in and visit the Spark history web page.</p> <p>Users are encouraged to upgrade their Spark history servers to Spark 3.5.8 or later.</p> https://cve.radiocsirt.org/vuln/pysec-2026-3966