Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.apache.zeppelin/zeppelin-web@0.8.1
purl pkg:maven/org.apache.zeppelin/zeppelin-web@0.8.1
Next non-vulnerable version 0.12.0
Latest non-vulnerable version 0.12.0
Risk 3.1
Vulnerabilities affecting this package (2)
Vulnerability Summary Fixed by
VCID-a4r7-fqkb-f7e2
Aliases:
CVE-2021-28656
GHSA-prvg-rh5h-74jr
Cross-Site Request Forgery (CSRF) vulnerability in Credential page of Apache Zeppelin allows an attacker to submit malicious request. This issue affects Apache Zeppelin Apache Zeppelin version 0.9.0 and prior versions.
0.9.0-preview1
Affected by 1 other vulnerability.
VCID-uybq-u79b-9ues
Aliases:
CVE-2024-41177
GHSA-p288-459w-jxj6
Incomplete Blacklist to Cross-Site Scripting vulnerability in Apache Zeppelin. This issue affects Apache Zeppelin: before 0.12.0. Users are recommended to upgrade to version 0.12.0, which fixes the issue.
0.12.0
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-06-12T20:08:27.833787+00:00 GitLab Importer Affected by VCID-uybq-u79b-9ues https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.zeppelin/zeppelin-web/CVE-2024-41177.yml 38.6.0
2026-06-12T19:24:47.766434+00:00 GitLab Importer Affected by VCID-a4r7-fqkb-f7e2 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.apache.zeppelin/zeppelin-web/CVE-2021-28656.yml 38.6.0