GHSA-CC37-9Q2J-3HFV vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.1, keycloak-fips, pinot-fips, knative-kafka-broker, pinot, management-api-for-apache-cassandra-4.0, knative-kafka-broker-fips, apache-pulsar, seata, celeborn, tez, thingsboard, management-api-for-apache-cassandra-5.0, trino,...

CVE-2026-47244 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.1, keycloak-fips, pinot-fips, knative-kafka-broker, pinot, wazuh-indexer, flyway, management-api-for-apache-cassandra-4.0, knative-kafka-broker-fips, reposilite, apache-pulsar, airbyte-server-fips, commercial-elasticsearch, seata...

CVE-2026-45536 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.1, keycloak-fips, pinot-fips, pinot, flyway, management-api-for-apache-cassandra-4.0, solr, apache-pulsar, airbyte-server-fips, kafka, seata, celeborn, tez, wildfly, grpc-java-fips, zookeeper, camunda-zeebe, apache-nifi, akhq,...

GHSA-5X3R-WRVG-RP6Q vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.1, keycloak-fips, pinot-fips, knative-kafka-broker, pinot, wazuh-indexer, flyway, management-api-for-apache-cassandra-4.0, knative-kafka-broker-fips, reposilite, apache-pulsar, airbyte-server-fips, commercial-elasticsearch, seata...

CVE-2026-47691 vulnerabilities

Vulnerabilities for packages: management-api-for-apache-cassandra-4.1, keycloak-fips, pinot-fips, knative-kafka-broker, pinot, flyway, management-api-for-apache-cassandra-4.0, knative-kafka-broker-fips, apache-pulsar, airbyte-server-fips, commercial-elasticsearch, seata, celeborn, sonarqube, tez,...

CVE-2026-6860 vulnerabilities

Vulnerabilities for packages: apache-pulsar, wildfly, keycloak, spark, druid, apicurio-registry, strimzi-kafka-operator...

GHSA-3G76-F9XQ-8VP6 vulnerabilities

Vulnerabilities for packages: apache-pulsar, wildfly, keycloak, spark, druid, apicurio-registry, strimzi-kafka-operator...

This Week in Spring - May 5th, 2026

Hi, Spring fans! Welcome to another installment of This Week in Spring! It's May 5th, 2026, and I'm in Mainz, Germany, for the legendary JAX conference! It's been infinitely far too long since I've been at this amazing show, and I'm oh-so happy to be back here! Tonight, after my two talks here, I...

CVE-2026-5598 vulnerabilities

Vulnerabilities for packages: apache-pulsar, ruby3.4-bouncy-castle-java, jruby, ruby4.0-bouncy-castle-java, wildfly, keycloak, apache-nifi, ruby3.2-bouncy-castle-java, sonarqube, spark, kserve-modelmesh, gradle, druid, zipkin, logstash, jenkins, ruby3.3-bouncy-castle-java, thingsboard...

CVE-2026-40490 vulnerabilities

Vulnerabilities for packages: tez, druid, apache-pulsar...

GHSA-P93R-85WP-75V3 vulnerabilities

Vulnerabilities for packages: apache-pulsar, ruby3.4-bouncy-castle-java, jruby, ruby4.0-bouncy-castle-java, wildfly, keycloak, apache-nifi, ruby3.2-bouncy-castle-java, sonarqube, spark, kserve-modelmesh, gradle, druid, zipkin, logstash, jenkins, ruby3.3-bouncy-castle-java, thingsboard...

GHSA-CMXV-58FP-FM3G vulnerabilities

Vulnerabilities for packages: tez, druid, apache-pulsar...

GHSA-CMXV-58FP-FM3G vulnerabilities

Vulnerabilities for packages: pinot-fips, apache-pulsar-fips, tez, druid, pinot, apache-pulsar...

CVE-2026-40490 vulnerabilities

Vulnerabilities for packages: pinot-fips, apache-pulsar-fips, tez, druid, pinot, apache-pulsar...

CVE-2026-24308 vulnerabilities

Vulnerabilities for packages: pinot, wso2is, solr, apache-pulsar, kafka, seata, tez, zookeeper, apache-nifi, akhq, thingsboard, trino, apache-activemq-artemis, druid, spark-fips, zookeeper-fips, strimzi-kafka-operator, kserve-modelmesh, spark-kubernetes-operator-fips, apache-pulsar-fips,...

GHSA-CRHR-QQJ8-RPXC vulnerabilities

Vulnerabilities for packages: pinot, wso2is, solr, apache-pulsar, kafka, seata, tez, zookeeper, apache-nifi, akhq, thingsboard, trino, apache-activemq-artemis, druid, spark-fips, zookeeper-fips, strimzi-kafka-operator, kserve-modelmesh, spark-kubernetes-operator-fips, apache-pulsar-fips,...

CVE-2025-33042 vulnerabilities

Vulnerabilities for packages: apache-pulsar, celeborn, akhq, spark, druid, logstash, wavefront-proxy...

GHSA-RP46-R563-JRC7 vulnerabilities

Vulnerabilities for packages: apache-pulsar, celeborn, akhq, spark, druid, logstash, wavefront-proxy...

CVE-2023-31007

Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication data expires if the client connected through the Pulsar Proxy when the broker is configured with authenticateOriginalAuthData=false or if a...

CVE-2022-33683

Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via configuration. The Pulsar Admin Client's intra-cluster and geo-replication HTTPS connections are vulnerable to man in the middl...