CVE-2026-40490 vulnerabilities

Vulnerabilities for packages: tez, apache-pulsar, druid...

CVE-2026-40490 vulnerabilities

Vulnerabilities for packages: pinot, apache-pulsar-fips, apache-pulsar, druid, tez, pinot-fips...

GHSA-CMXV-58FP-FM3G vulnerabilities

Vulnerabilities for packages: pinot, apache-pulsar-fips, apache-pulsar, druid, tez, pinot-fips...

GHSA-CRHR-QQJ8-RPXC vulnerabilities

Vulnerabilities for packages: spark-fips, zookeeper, solr, apache-activemq-artemis, apache-pulsar, spark-kubernetes-operator-fips, kserve-modelmesh, tez, zookeeper-fips, spark, spark-kubernetes-operator, kafka, wso2is, druid, apache-nifi, akhq, pinot, thingsboard, strimzi-kafka-operator, seata,...

CVE-2026-24308 vulnerabilities

Vulnerabilities for packages: spark-fips, zookeeper, solr, apache-activemq-artemis, apache-pulsar, spark-kubernetes-operator-fips, kserve-modelmesh, tez, zookeeper-fips, spark, spark-kubernetes-operator, kafka, wso2is, druid, apache-nifi, akhq, pinot, thingsboard, strimzi-kafka-operator, seata,...

GHSA-RP46-R563-JRC7 vulnerabilities

Vulnerabilities for packages: wavefront-proxy, akhq, apache-pulsar, spark, celeborn, druid, logstash...

CVE-2025-33042 vulnerabilities

Vulnerabilities for packages: wavefront-proxy, akhq, apache-pulsar, spark, celeborn, druid, logstash...

CVE-2023-31007

Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication data expires if the client connected through the Pulsar Proxy when the broker is configured with authenticateOriginalAuthData=false or if a...

CVE-2022-33683

Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middl...

CVE-2022-33684

The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureConnection is disabled via configuration. This vulnerability allows an attacker to perform a man in the middle attack and intercept and/or...

CVE-2025-46392 vulnerabilities

Vulnerabilities for packages: apache-pulsar...

GHSA-PVP8-3XJ6-8C6X vulnerabilities

Vulnerabilities for packages: apache-pulsar...

GHSA-PVP8-3XJ6-8C6X vulnerabilities

Vulnerabilities for packages: wso2is...

CVE-2025-46392 vulnerabilities

Vulnerabilities for packages: wso2is...

CVE-2024-29371 vulnerabilities

Vulnerabilities for packages: apache-pulsar, kafka, strimzi-kafka-operator...

GHSA-3677-XXCR-WJQV vulnerabilities

Vulnerabilities for packages: apache-pulsar, kafka, strimzi-kafka-operator...

GHSA-3677-XXCR-WJQV vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, hadoop-fips, confluent-common-docker, kafka, kayenta, apache-pulsar, kayenta-fips...

CVE-2024-29371 vulnerabilities

Vulnerabilities for packages: strimzi-kafka-operator, hadoop-fips, confluent-common-docker, kafka, kayenta, apache-pulsar, kayenta-fips...

This Week in Spring – December 16th, 2025

Hi, Spring fans! Welcome to another installment of This Week in Spring! And what a week it’s been! We’ve got around nine shopping days ’til Christmas, and the New Year is almost here! Things are moving so quickly and the Spring community is no exception! Let's dive into this week's wonderful...

CVE-2025-11965 vulnerabilities

Vulnerabilities for packages: keycloak, apache-pulsar, strimzi-kafka-operator...