Vantara Pentaho Data Integration And Analytics vulnerabilities

2 known vulnerabilities in Vantara Pentaho Data Integration And Analytics from Hitachi. 2 are rated high or critical. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.7 High severity

  Pentaho Data Integration and Analytics: Improper Restriction of XML External Entity Reference

  CVE-2026-2253May 27, 2026Hitachi Vantara

  Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.7 and 11.0.0.0, including 9.3.x and 8.3.x, does not prevent certain XML parsers from resolving external entities.

• 9.1 Critical severity

  Pentaho Data Integration and Analytics: Missing Authorization

  CVE-2025-11158Mar 10, 2026Hitachi Vantara

  Hitachi Vantara Pentaho Data Integration & Analytics versions before 10.2.0.6, including 9.3.x and 8.3.x, do not restrict Groovy scripts in new PRPT reports published by users, allowing insertion of arbitrary scripts and leading to a RCE.