https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-55976.htmlhttps://patchthecve.com/cve/CVE-2026-55976.htmlMon, 28 Sep 2026 23:10:00 +0000CRITICAL 9.1: Server-Side Request Forgery (SSRF) in Avro SerDe schema resolution in Apache Hive before 4.2.1 allows an authenticated remote attacker with CREATE TABLE privilege to cause the Hive server to fetch an attacker-controlled URL when resolving the avro.schema.url table property on an Avro table that is shttps://patchthecve.com/cve/CVE-2026-53561.htmlhttps://patchthecve.com/cve/CVE-2026-53561.htmlMon, 28 Sep 2026 23:10:00 +0000HIGH 7.4: An improper authentication vulnerability in HiveServer2 SAML bearer-token validation in Apache Hive 4.0.0 through 4.2.0 (and later unreleased branches) on deployments using HTTP transport with hive.server2.authentication=SAML allows an unauthenticated network attacker to authenticate as an arbitraryhttps://patchthecve.com/cve/CVE-2026-49845.htmlhttps://patchthecve.com/cve/CVE-2026-49845.htmlMon, 28 Sep 2026 23:10:00 +0000CRITICAL 9.8: SQL injection in Hive Metastore direct SQL partition-name resolution in Apache Hive before 4.2.1 on all platforms allows authenticated users with access to Hive Metastore APIs to read, modify, or affect unintended partition metadata (including statistics updates, truncation targets, and file-metadat