Apache Kafka Client - Arbitrary File Read

Apache Kafka Client contains arbitrary file read and server-side request forgery caused by untrusted configuration of sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url, letting attackers read files or send requests to unintended locations, exploit requires untrusted party...

CLEANSTART-2026-CH37263 Security fixes in kafka 4.0.1-r3

Package kafka version 4.0.1-r3 fixes 7 vulnerabilities: CVE-2026-25679, CVE-2026-27137, CVE-2026-27138, CVE-2026-27139, CVE-2026-27142...

CVE-2026-10051 vulnerabilities

Vulnerabilities for packages: solr, neo4j, akhq, confluent-kafka, strimzi-kafka-operator...

CVE-2026-6790 vulnerabilities

Vulnerabilities for packages: confluent-kafka, neo4j, akhq, solr...

CVE-2026-10050 vulnerabilities

Vulnerabilities for packages: solr, neo4j, akhq, apache-tika, confluent-kafka, tez...

GHSA-7P3P-8QV8-M2VH vulnerabilities

Vulnerabilities for packages: confluent-kafka, neo4j, akhq, solr...

GHSA-W7X5-G22V-XQHR vulnerabilities

Vulnerabilities for packages: solr, neo4j, akhq, confluent-kafka, strimzi-kafka-operator...

CVE-2026-8384 vulnerabilities

Vulnerabilities for packages: solr, neo4j, akhq, confluent-kafka, strimzi-kafka-operator...

GHSA-2FVJ-HGJ9-J2GR vulnerabilities

Vulnerabilities for packages: solr, neo4j, akhq, apache-tika, confluent-kafka, tez...

GHSA-F4V5-65JJ-PCR2 vulnerabilities

Vulnerabilities for packages: solr, neo4j, akhq, confluent-kafka, strimzi-kafka-operator...

Kafka UI 0.7.1 Command Injection

An issue discovered in provectus kafka-ui 0.4.0 through 0.7.1 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/topic/messages. id: CVE-2023-52251 info: name: Kafka UI 0.7.1 Command Injection author: yhy0,iamnoooob severity: high description: | An...

CVE-2026-56816 vulnerabilities

Vulnerabilities for packages: opensearch-fips, apache-hop, strimzi-kafka-operator, strimzi-kafka-operator-fips, opensearch, camunda, camunda-zeebe, apache-hop-fips...

GHSA-HPCC-26XQ-25FV vulnerabilities

Vulnerabilities for packages: opensearch-fips, apache-hop, strimzi-kafka-operator, strimzi-kafka-operator-fips, opensearch, camunda, camunda-zeebe, apache-hop-fips...

GHSA-HPCC-26XQ-25FV vulnerabilities

Vulnerabilities for packages: opensearch, strimzi-kafka-operator...

CVE-2026-56816 vulnerabilities

Vulnerabilities for packages: opensearch, strimzi-kafka-operator...

Apache Druid Kafka Connect - Remote Code Execution

The vulnerability has the potential to enable a remote attacker with authentication to run any code on the system. This is due to unsafe deserialization that occurs during the configuration of the connector through the Kafka Connect REST API id: CVE-2023-25194 info: name: Apache Druid Kafka Conne...

GHSA-XX22-P4CH-683R vulnerabilities

Vulnerabilities for packages: debezium-connector-informix, cassandra, kafka, apache-pulsar, debezium-connector-vitess, debezium-connector-spanner, akhq, wildfly, debezium-connector-db2, thingsboard, confluent-kafka, cassandra-reaper, strimzi-kafka-operator, apicurio-registry...

CVE-2026-59949 vulnerabilities

Vulnerabilities for packages: debezium-connector-informix, cassandra, kafka, apache-pulsar, debezium-connector-vitess, debezium-connector-spanner, akhq, wildfly, debezium-connector-db2, thingsboard, confluent-kafka, cassandra-reaper, strimzi-kafka-operator, apicurio-registry...

CVE-2026-59949 vulnerabilities

Vulnerabilities for packages: hono, spark-kubernetes-operator, apicurio-registry, wildfly, apicurio-registry-fips, kafbat-ui, confluent-kafka, dependency-track-apiserver, cassandra-reaper, debezium-connector-informix, kafka-bridge-fips, strimzi-kafka-operator, confluent-kafka-jre-bcfips,...

GHSA-XX22-P4CH-683R vulnerabilities

Vulnerabilities for packages: hono, spark-kubernetes-operator, apicurio-registry, wildfly, apicurio-registry-fips, kafbat-ui, confluent-kafka, dependency-track-apiserver, cassandra-reaper, debezium-connector-informix, kafka-bridge-fips, strimzi-kafka-operator, confluent-kafka-jre-bcfips,...