Every CVE whose affected-product data names Apache Calcite, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.
CVEs (3)
CVE-2022-39135 — CVSS 9.8 (critical): Apache Calcite 1.22.0 introduced the SQL operators EXISTS_NODE, EXTRACT_XML, XML_TRANSFORM and EXTRACT_VALUE do not restrict XML External…
CVE-2026-46718 — CVSS 6.5 (medium): Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') vulnerability in Apache Calcite. This issue affects…
CVE-2020-13955 — CVSS 5.9 (medium): HttpUtils#getURLConnection method disables explicitly hostname verification for HTTPS connections making clients vulnerable to…