Talend
20 CVEs across 12 Talend products. Browse Talend vulnerabilities, severities, and proof-of-concept exploits.
Talend products with known CVEs
| CVE | Severity | Score | Published | Summary |
|---|---|---|---|---|
CVE-2026-9057 | High | 8.2 | 2026-05-20 | A broken access control issue has been identified in the Talend Administration Center, that allows a user with “View” permission to modify the Talend Studio up… |
CVE-2026-9056 | Medium | 5.4 | 2026-05-20 | A stored cross-site scripting vulnerability has been found in the Talend Administration Center. An attacker with permission to manage servers can store a XSS p… |
CVE-2026-6264 | Critical | 9.8 | 2026-04-14 | A critical vulnerability in the Talend JobServer and Talend Runtime allows unauthenticated remote code execution via the JMX monitoring port. The attack vector… |
CVE-2023-36301 | High | 7.5 | 2023-06-26 | Talend Data Catalog before 8.0-20230221 contain a directory traversal vulnerability in HeaderImageServlet. |
CVE-2023-33247 | High | 7.5 | 2023-05-26 | Talend Data Catalog remote harvesting server before 8.0-20230413 contains a /upgrade endpoint that allows an unauthenticated WAR file to be deployed on the ser… |
CVE-2023-31444 | High | 7.5 | 2023-04-28 | In Talend Studio before 7.3.1-R2022-10 and 8.x before 8.0.1-R2022-09, microservices allow unauthenticated access to the Jolokia endpoint of the microservice. T… |
CVE-2023-26264 | Medium | 5.5 | 2023-04-13 | All versions of Talend Data Catalog before 8.0-20220907 are potentially vulnerable to XML External Entity (XXE) attacks in the license parsing code. |
CVE-2023-26263 | Medium | 5.5 | 2023-04-13 | All versions of Talend Data Catalog before 8.0-20230110 are potentially vulnerable to XML External Entity (XXE) attacks in the /MIMBWebServices/license endpoin… |
CVE-2022-45589 | High | 7.2 | 2023-02-06 | All versions before 8.0.1-R2022-10-RT and 7.3.1-R2022-09-RT of the Talend ESB Runtime are potentially vulnerable to SQL Injection attacks in the provisioning s… |
CVE-2022-45588 | High | 7.8 | 2023-02-03 | All versions before R2022-09 of Talend's Remote Engine Gen 2 are potentially vulnerable to XML External Entity (XXE) type of attacks. Users should download the… |
CVE-2022-30332 | Medium | 5.3 | 2023-01-10 | In Talend Administration Center 7.3.1.20200219 before TAC-15950, the Forgot Password feature provides different error messages for invalid reset attempts depen… |
CVE-2021-4311 | Medium | 5.5 | 2023-01-09 | A vulnerability classified as problematic was found in Talend Open Studio for MDM. This vulnerability affects unknown code of the component XML Handler. The ma… |
CVE-2022-4818 | Medium | 5.5 | 2022-12-28 | A vulnerability was found in Talend Open Studio for MDM. It has been declared as problematic. Affected by this vulnerability is an unknown functionality of the… |
CVE-2022-31648 | Medium | 6.1 | 2022-05-26 | Talend Administration Center is vulnerable to a reflected Cross-Site Scripting (XSS) issue in the SSO login endpoint. The issue is fixed for versions 8.0.x in… |
CVE-2022-29943 | Medium | 6.5 | 2022-05-04 | Talend Administration Center has a vulnerability that allows an authenticated user to use XML External Entity (XXE) processing to achieve read access as root o… |
CVE-2022-29942 | Medium | 6.5 | 2022-05-04 | Talend Administration Center has a vulnerability that allows an authenticated user to use the Service Registry 'Add' functionality to perform SSRF HTTP GET req… |
CVE-2021-42837 | Critical | 9.8 | 2021-11-05 | An issue was discovered in Talend Data Catalog before 7.3-20210930. After setting up SAML/OAuth, authentication is not correctly enforced on the native login p… |
CVE-2021-40684 | Critical | 9.1 | 2021-09-22 | Talend ESB Runtime in all versions from 5.1 to 7.3.1-R2021-09, 7.2.1-R2021-09, 7.1.1-R2021-09, has an unauthenticated Jolokia HTTP endpoint which allows remote… |
CVE-2014-2228 | Critical | 9.8 | 2020-02-19 | The XStream extension in HP Fortify SCA before 2.2 RC3 allows remote attackers to execute arbitrary code via unsafe deserialization of XML messages. |
CVE-2012-2656 | High | 7.5 | 2019-12-18 | An XML eXternal Entity (XXE) issue exists in Restlet 1.1.10 in an endpoint using XML transport, which lets a remote attacker obtain sensitive information. |