Provectus kafka-ui <=0.7.2 - Remote Code Execution

Provectus kafka-ui versions 0.7.0 through 0.7.2 are vulnerable to code injection in the /api/smartfilters/testexecutions endpoint. The filterCode parameter is evaluated as a Groovy expression without sandboxing, allowing an unauthenticated attacker to execute arbitrary code and operating-system...

CVE-2023-52251-POC

CVE-2023-52251-POC Existe una vulnerabilidad de ejecución remota de código en provectus/kafka-ui. No hay parche al momento de escribir esto, pero el proveedor fue notificado por nosotros y por el equipo de VINCE sin recibir respuesta. El informe se envió el 27 de septiembre de 2023 a provectus...

kcatcher

Captura lo que acecha en tus clústeres de Kafka. Introducción Kcatcher es una utilidad de línea de comandos para enumerar y evaluar configuraciones de clústeres de Kafka. Se conecta a clústeres de Apache Kafka y recupera información detallada sobre brokers, temas, ACL e incluso mensajes de muestr...

CVE-2025-27817

免责申明： 本文所描述的漏洞及其复现步骤仅供网络安全研究与教育目的使用。任何人不得将本文提供的信息用于非法目的或未经授权的系统测试。作者不对任何由于使用本文信息而导致的直接或间接损害承担责任。如涉及侵权，请及时与我们联系，我们将尽快处理并删除相关内容。 博客地址： https://blog.csdn.net/xc214/article/details/148698902?spm=1001.2014.3001.5501 纷传地址： 25hvv poc实时更新中 https://pc.fenchuan8.com//index?forum=101158&yqm=DGR4X...

cve-2023-34040

CVE-2023-34040 Ejecución remota de código por deserialización en Spring Kafka POST /messages/send HTTP/1.1 Host: 127.0.0.1:8899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/116.0.0.0...

Security Bulletin: Multiple Vulnerabilities in IBM Event Streams

Summary Multiple vulnerabilities were addressed in IBM Event Streams version 13.0.3 Vulnerability Details CVEID:CVE-2026-33557 DESCRIPTION: A possible security vulnerability has been identified in Apache Kafka. By default, the broker property sasl.oauthbearer.jwt.validator.class is set to...

cve-2023-25194

Apache Druid CVE-2023-25194 CVE-2023-25194 es una vulnerabilidad de deserialización que afecta a Apache Kafka. Este go-exploit demuestra la explotación de CVE-2023-25194 contra Apache Druid usando Kafka. Este tipo de ataque normalmente requiere una infraestructura de atacante LDAP JNDI que...

CVE-2026-15911-Confluent_Kafka

CVE-2026-15911: Verificación de certificados TLS deshabilitada para HashiCorp Vault KMS en confluent-kafka Severidad: Alta, CVSS 3.1 7.4 Vector v3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Afectado: confluent-kafka = 2.8.0, = 2.14.2 Corregido en: 2.15.0 CWE: CWE-295 Validación de certificad...

CVE-2026-49098

CVE-2026-49098 — Inyección de cabecera kafka.OVERRIDETOPIC de camel-kafka Reproductores de prueba de concepto ejecutables para la misma vulnerabilidad de Apache Camel, uno por runtime: Runtime| Directorio| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 +...

Apache Kafka Client - Arbitrary File Read

Apache Kafka Client contains arbitrary file read and server-side request forgery caused by untrusted configuration of sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url, letting attackers read files or send requests to unintended locations, exploit requires untrusted party...

OPENSUSE-SU-2026:12006-1 python313-confluent-kafka-2.15.1-1.1 on GA media

These are all security issues fixed in the python313-confluent-kafka-2.15.1-1.1 package on the GA media of openSUSE Tumbleweed...

GHSA-642R-3GJ9-2PJ5 vulnerabilities

Vulnerabilities for packages: infinispan, keycloak, sonarqube, apicurio-registry, apache-tika, akhq, flyway, opensearch, trino, tez, scala, apache-nifi-registry, spdx-tools-java, cass-config-builder, wildfly, keycloak-config-cli, dependency-track, druid, strimzi-kafka-operator, gradle, apache-nif...

CVE-2026-68494 vulnerabilities

Vulnerabilities for packages: infinispan, keycloak, sonarqube, apicurio-registry, apache-tika, akhq, flyway, opensearch, trino, tez, scala, apache-nifi-registry, spdx-tools-java, cass-config-builder, wildfly, keycloak-config-cli, dependency-track, druid, strimzi-kafka-operator, gradle, apache-nif...

CVE-2023-34040

CVE-2023-34040 此PoC克隆自 https://github.com/Contrast-Security-OSS/Spring-Kafka-POC-CVE-2023-34040 关于我们的分析过程，请访问主仓库中的PDF文件。...

kroxylicious-pqc-filter

Filtro de cifrado de registros PQC de Kroxylicious Un complemento de filtro de Kroxylicious que proporciona cifrado transparente a nivel de registro Post-Cuántico PQC para Apache Kafka mediante encapsulación de claves ML-KEM FIPS 203 con cifrado simétrico AES-256-GCM. Los productores y consumidor...

CVE-2026-89425 vulnerabilities

Vulnerabilities for packages: mongodb-search, traccar-fips, apache-pulsar-fips, wildfly, dependency-track-apiserver, spdx-tools-java, geoserver, mongodb-search-fips, apache-pulsar, s3proxy-fips, ontop-fips, camunda, cassandra, apache-nifi-registry, logstash-fips, automq-fips,...

GHSA-7HHH-6RMP-J9QF vulnerabilities

Vulnerabilities for packages: mongodb-search, traccar-fips, apache-pulsar-fips, wildfly, dependency-track-apiserver, spdx-tools-java, geoserver, mongodb-search-fips, apache-pulsar, s3proxy-fips, ontop-fips, camunda, cassandra, apache-nifi-registry, logstash-fips, automq-fips,...

CVE-2026-89407 vulnerabilities

Vulnerabilities for packages: mongodb-search, traccar-fips, apache-pulsar-fips, wildfly, dependency-track-apiserver, spdx-tools-java, geoserver, mongodb-search-fips, apache-pulsar, s3proxy-fips, ontop-fips, camunda, cassandra, apache-nifi-registry, logstash-fips, automq-fips,...

GHSA-P6PP-M3F8-5C89 vulnerabilities

Vulnerabilities for packages: mongodb-search, traccar-fips, apache-pulsar-fips, wildfly, dependency-track-apiserver, spdx-tools-java, geoserver, mongodb-search-fips, apache-pulsar, s3proxy-fips, ontop-fips, camunda, cassandra, apache-nifi-registry, logstash-fips, automq-fips,...

CVE-2026-89425 vulnerabilities

Vulnerabilities for packages: wavefront-proxy, cassandra, management-api-for-apache-cassandra-5.0, opensearch, tez, jenkins-plugin-manager, neo4j, thingsboard, celeborn, spdx-tools-java, cass-config-builder, cassandra-reaper, wildfly, keycloak-config-cli, strimzi-kafka-oauth, dependency-track,...