Missing Authentication for Critical Function

Overview Affected versions of this package are vulnerable to Missing Authentication for Critical Function through the Spring Boot Actuator endpoints exposed on the tracing API port in zipkin-server/src/main/resources/zipkin-server-shared.yml. An attacker can read sensitive runtime data by sending...

io.zipkin:benchmarks (2.22.1) potentially affected by CVE-2026-82265 via io.zipkin:zipkin-server (2.22.1)

io.zipkin:zipkin-server MAVEN version 2.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.zipkin:zipkin-server and may be impacted: - io.zipkin:benchmarks 2.22.1 Source cves: CVE-2026-82265 Source advisory: SNYK:JAVA-IOZIPKIN-19477049...

CVE-2026-61634 vulnerabilities

Vulnerabilities for packages: cassandra-reaper, zipkin, druid, nuxeo, logstash-fips, traccar-fips, thingsboard, traccar, logstash, conductor, conductor-fips...

GHSA-6G32-PXV4-2WFJ vulnerabilities

Vulnerabilities for packages: cassandra-reaper, zipkin, druid, nuxeo, logstash-fips, traccar-fips, thingsboard, traccar, logstash, conductor, conductor-fips...

CVE-2026-63337 vulnerabilities

Vulnerabilities for packages: cassandra-reaper, zipkin, druid, nuxeo, logstash-fips, traccar-fips, thingsboard, traccar, logstash, conductor, conductor-fips...

CVE-2026-69219 vulnerabilities

Vulnerabilities for packages: cassandra-reaper, zipkin, druid, nuxeo, logstash-fips, traccar-fips, thingsboard, traccar, logstash, conductor, conductor-fips...

GHSA-5XWG-CFVJ-GFF5 vulnerabilities

Vulnerabilities for packages: thingsboard, druid, cassandra-reaper, zipkin, logstash...

GHSA-6G32-PXV4-2WFJ vulnerabilities

Vulnerabilities for packages: thingsboard, druid, cassandra-reaper, zipkin, logstash...

CVE-2026-61634 vulnerabilities

Vulnerabilities for packages: thingsboard, druid, cassandra-reaper, zipkin, logstash...

CVE-2026-63335 vulnerabilities

Vulnerabilities for packages: thingsboard, druid, cassandra-reaper, zipkin, logstash...

GHSA-93J5-89VC-PPH4 vulnerabilities

Vulnerabilities for packages: thingsboard, druid, cassandra-reaper, zipkin, logstash...

GHSA-68MJ-5WR7-6FGG vulnerabilities

Vulnerabilities for packages: thingsboard, druid, cassandra-reaper, zipkin, logstash...

Sensitive Information Exposure

io.zipkin, zipkin-server is vulnerable to Sensitive Information Exposure. The vulnerability is due to the presence of an unprotected /heapdump endpoint associated with Spring Boot Actuator, which allows an attacker to retrieve memory dumps and potentially extract sensitive data. Note: There is a...

io.zipkin:benchmarks (2.22.1) potentially affected by CVE-2025-53602 via io.zipkin:zipkin-server (2.22.1)

io.zipkin:zipkin-server MAVEN version 2.22.1 is affected by a known vulnerability. The following packages have a transitive dependency on io.zipkin:zipkin-server and may be impacted: - io.zipkin:benchmarks 2.22.1 Source cves: CVE-2025-53602 Source advisory: SNYK:JAVA-IOZIPKIN-10639631...

GHSA-794X-8X6X-QPFC Zipkin Server vulnerable to Insecure Resource Initialization through its /heapdump endpoint

Zipkin through 3.5.1 has a /heapdump endpoint associated with the use of Spring Boot Actuator, a similar issue to CVE-2025-48927...

Zipkin Server vulnerable to Insecure Resource Initialization through its /heapdump endpoint

Zipkin through 3.5.1 has a /heapdump endpoint associated with the use of Spring Boot Actuator, a similar issue to CVE-2025-48927...