Security Bulletin:Multiple security vulnerabilities in IBM Process Automation Manager Open Edition Starter Kit for Banking

Summary In addition to many updates of operating system level packages, Multiple vulnerabilities were addressed in IBM Process Automation Manager Open Edition Starter Kit for Banking -9.4.2 Vulnerability Details CVEID:CVE-2026-13676 DESCRIPTION: fast-uri versions 2.3.1 through 3.1.2 and 4.0.0 fai...

ROOT-APP-MAVEN-CVE-2025-27817 CVE-2025-27817 in io.root.org.apache.kafka:kafka-clients - Patched by Root

Root has patched CVE-2025-27817 in the io.root.org.apache.kafka:kafka-clients package for Root:Maven. Multiple fixed versions available...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationRuntime and IntegrationServer operands that use Kafka are vulnerable to loss of confidentiality (CVE-2025-27817, CVE-2025-27818)

Summary Apache Kafka Client is used by IBM App Connect Enterprise Certified Container when running flows that connect to a Kafka server. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that use Kafka Client are vulnerable to loss of confidentiality...

Security Bulletin: security vulnerabilities are addressed with IBM Business Automation Insights iFixes for December 2025.

Summary Security vulnerabilities are addressed with IBM Business Automation Insights 24.0.1-IF006 and 25.0.0-IF003. These vulnerabilities have been also addressed in 24.0.0-IF005. Vulnerability Details CVEID:CVE-2025-48976 DESCRIPTION: Allocation of resources for multipart headers with insufficie...

Security Bulletin: Vulnerabilities in Apache Kafka Client affects IBM watsonx Orchestrate with watsonx Assistant Cartridge

Summary Summary: Potential vulnerability in Apache Kafka Client has been identified that affects IBM watsonx Orchestrate with watsonx Assistant Cartridge - UAB Component. The vulnerability has been addressed. Refer to details for additional information. Vulnerability Details CVEID:CVE-2025-27817...

Security Bulletin: Security vulnerabilities in Apache kafka-client may affect IBM Business Automation Workflow - CVE-2025-27817, CVE-2025-27818

Summary IBM Business Automation Workflow packages a copy of Apache kafka-client with known vulnerabilities. Vulnerability Details CVEID:CVE-2025-27818 DESCRIPTION: A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to the cluster resource,...

Security Bulletin: There is a vulnerability in kafka-clients-3.8.0.jar used by IBM Maximo Asset Management application (CVE-2025-27817,CVE-2025-27818)

Summary There is a vulnerability in kafka-clients-3.8.0.jar used by IBM Maximo Asset Management application CVE-2025-27817,CVE-2025-27818 Vulnerability Details CVEID:CVE-2025-27817 DESCRIPTION: A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apach...

Security Bulletin: There is a vulnerability in kafka-clients-3.8.0.jar used by IBM Maximo Manage application in IBM Maximo Application Suite (CVE-2025-27817)

Summary There is a vulnerability in kafka-clients-3.8.0.jar used by IBM Maximo Manage application in IBM Maximo Application Suite. Vulnerability Details CVEID:CVE-2025-27817 DESCRIPTION: A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka...

Exploit for Server-Side Request Forgery in Apache Kafka

Disclaimer: The vulnerabilities described in this article and...

Photon OS 5.0: Kafka PHSA-2025-5.0-0537

An update of the kafka package has been released. %NASLMINLEVEL 80900 C Tenable, Inc. The descriptive text and package checks in this plugin were extracted from VMware Security Advisory PHSA-2025-5.0-0537. The text itself is copyright C VMware, Inc. include'compat.inc'; if description...

CVE-2025-27817 vulnerabilities

Vulnerabilities for packages: thingsboard, apache-nifi, logstash, wildfly, opensearch, zipkin, apicurio-registry, druid, strimzi-kafka-operator...

CVE-2025-27817 vulnerabilities

Vulnerabilities for packages: wildfly, apache-nifi, strimzi-kafka-operator, apicurio-registry, thingsboard, logstash, opensearch, druid, zipkin...

CVE-2025-27817

A flaw was found in apache-kafka. The Kafka client improperly handles configuration data for SASL/OAUTHBEARER connections, allowing an attacker to specify a crafted token endpoint URL. This allows for arbitrary file reads and server-side request forgery SSRF by a malicious client. Consequently,...

ai.intelliswarm:swarmai-eval (>=1.0.6 <=1.0.28), ai.intelliswarm:swarmai-rag (=1.0.28) +3069 more potentially affected by CVE-2025-27817 via org.apache.kafka:kafka-clients (>=3.1.0 <=3.9.0)

org.apache.kafka:kafka-clients MAVEN version =3.1.0, =1.0.6, =1.0.6, =0.1, =3.0.1, =2.8.4-alpha2, =1.0.0, =1.0.0-beta, =0.0.1-alpha1, =0.0.1, =0.0.4, =0.1.0, =1.0.0.RELEASE, =1.0.2.RELEASE and more Source cves: CVE-2025-27817 Source advisory: OSV:GHSA-VGQ5-3255-V292...

ai.intelliswarm:swarmai-eval (>=1.0.6 <=1.0.28), ai.intelliswarm:swarmai-rag (=1.0.28) +3069 more potentially affected by CVE-2025-27817 via org.apache.kafka:kafka-clients (>=3.1.0 <=3.9.0)

org.apache.kafka:kafka-clients MAVEN version =3.1.0, =1.0.6, =1.0.6, =0.1, =3.0.1, =2.8.4-alpha2, =1.0.0, =1.0.0-beta, =0.0.1-alpha1, =0.0.1, =0.0.4, =0.1.0, =1.0.0.RELEASE, =1.0.2.RELEASE and more Source cves: CVE-2025-27817 Source advisory: SNYK:JAVA-ORGAPACHEKAFKA-10336719...

CVE-2025-27817 Apache Kafka Client: Arbitrary file read and SSRF vulnerability

A possible arbitrary file read and SSRF vulnerability has been identified in Apache Kafka Client. Apache Kafka Clients accept configuration data for setting the SASL/OAUTHBEARER connection with the brokers, including "sasl.oauthbearer.token.endpoint.url" and "sasl.oauthbearer.jwks.endpoint.url"...

CVE-2024-27817

The issue was addressed with improved checks. This issue is fixed in iOS 16.7.8 and iPadOS 16.7.8, iOS 17.5 and iPadOS 17.5, macOS Monterey 12.7.5, macOS Sonoma 14.5, macOS Ventura 13.6.7, tvOS 17.5, visionOS 1.2. An app may be able to execute arbitrary code with kernel privileges...

CVE-2022-27817

SWHKD 1.1.5 consumes the keyboard events of unintended users. This could potentially cause an information leak, but is usually a denial of functionality...

CVE-2024-27817

CVE-2024-27817 is an Apple vulnerability where an app may execute arbitrary code with kernel privileges due to the issue being addressed with improved checks. Affected platforms include macOS (Ventura 13.6.7; Monterey 12.7.5; Sonoma 14.5), iOS and iPadOS (16.7.8 and 17.5), watchOS not specified, ...

About the security content of visionOS 1.2

About the security content of visionOS 1.2 This document describes the security content of visionOS 1.2. About Apple security updates For our customers' protection, Apple doesn't disclose, discuss, or confirm security issues until an investigation has occurred and patches or releases are availabl...