https://patchthecve.com/CVEs with upgrade or downgrade fix stepshttps://patchthecve.com/cve/CVE-2026-63046.htmlhttps://patchthecve.com/cve/CVE-2026-63046.htmlFri, 16 Oct 2026 15:10:00 +0000HIGH 8.8: Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache InLong. Agent Installer's ModuleManager executes arbitrary shell commands via ExcuteLinux.exeCmd() with no filtering or whitelist validation. This issue affects Apache InLong: from 2.0.0 befohttps://patchthecve.com/cve/CVE-2026-63044.htmlhttps://patchthecve.com/cve/CVE-2026-63044.htmlSun, 18 Oct 2026 20:10:00 +0000MEDIUM 5.4: Server-Side Request Forgery (SSRF) vulnerability in Apache InLong.  Any authenticated user (no admin role required) can cause the InLong Manager server to make outbound HTTP requests or TCP connections to arbitrary internal hosts and ports. This issue affects Apache InLong: from 2.0.0 before 2.4.0.https://patchthecve.com/cve/CVE-2026-63043.htmlhttps://patchthecve.com/cve/CVE-2026-63043.htmlSun, 18 Oct 2026 20:10:00 +0000HIGH 7.5: Relative Path Traversal vulnerability in Apache InLong. Arbitrary file read from the Agent host filesystem. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1]  https://github.com/apache/inlong/pulhttps://patchthecve.com/cve/CVE-2026-63042.htmlhttps://patchthecve.com/cve/CVE-2026-63042.htmlSun, 18 Oct 2026 20:10:00 +0000HIGH 8.1: Files or Directories Accessible to External Parties vulnerability in Apache InLong. Any user who can authenticate to the manager can create, modify and delete Data Node definitions. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 https://patchthecve.com/cve/CVE-2026-63040.htmlhttps://patchthecve.com/cve/CVE-2026-63040.htmlSun, 18 Oct 2026 20:10:00 +0000HIGH 8.1: Files or Directories Accessible to External Parties vulnerability in Apache InLong. StreamSource performs no authorization check, any authenticated user can logically delete ALL stream sources. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLohttps://patchthecve.com/cve/CVE-2026-63039.htmlhttps://patchthecve.com/cve/CVE-2026-63039.htmlSun, 18 Oct 2026 20:10:00 +0000CRITICAL 9.8: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject the string value into the SQL statement, enabling SQL injection. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised tohttps://patchthecve.com/cve/CVE-2026-63038.htmlhttps://patchthecve.com/cve/CVE-2026-63038.htmlSun, 18 Oct 2026 20:10:00 +0000CRITICAL 9.8: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This allows an attacker to inject arbitrary SQL code through the dbName, tableName, schemaName, and username parameters.  This issue affects Apache InLong: from 2.0.0 before 2.4.0. https://patchthecve.com/cve/CVE-2026-63037.htmlhttps://patchthecve.com/cve/CVE-2026-63037.htmlSun, 18 Oct 2026 20:10:00 +0000CRITICAL 9.8: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection') vulnerability in Apache InLong. This appears to allow SQL injection in the ORDER BY clause against the Manager backend database. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to uphttps://patchthecve.com/cve/CVE-2026-63016.htmlhttps://patchthecve.com/cve/CVE-2026-63016.htmlSun, 18 Oct 2026 20:10:00 +0000MEDIUM 5.3: Uncontrolled Resource Consumption vulnerability in Apache InLong. Users could affect operational configuration or allow upload of non-official packages. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve ihttps://patchthecve.com/cve/CVE-2026-63015.htmlhttps://patchthecve.com/cve/CVE-2026-63015.htmlSun, 18 Oct 2026 20:10:00 +0000MEDIUM 4.3: Uncontrolled Resource Consumption vulnerability in Apache InLong. Non-template responsible persons can view template information. This issue affects Apache InLong: from 2.0.0 before 2.4.0. Users are advised to upgrade to Apache InLong's 2.4.0 or cherry-pick [1] to solve it. [1] https://gith