CVE-2023-52251-POC

CVE-2023-52251-POC There is a Remote Code Execution vulnerability provectus/kafka-ui. There is no patch as of writing this, but the vendor is notified by us and the team over at VINCE without any response. Report was sent Sep 27, 2023 to provectus both via email and github security. Remediation W...

kcatcher

Catch what's lurking in your Kafka clusters. Introduction Kcatcher is a command-line utility for enumerating and evaluating Kafka cluster configurations. It connects to Apache Kafka clusters and retrieves detailed information about brokers, topics, ACLs, and even samples messages. Perfect for...

CVE-2025-27817

Disclaimer: The vulnerabilities and reproduction steps described in this document are for cybersecurity research and educational purposes only. No one may use the information provided in this document for illegal purposes or unauthorized system testing. The author assumes no liability for any...

cve-2023-34040

CVE-2023-34040 Ejecución remota de código por deserialización en Spring Kafka POST /messages/send HTTP/1.1 Host: 127.0.0.1:8899 Cache-Control: max-age=0 Upgrade-Insecure-Requests: 1 User-Agent: Mozilla/5.0 Macintosh; Intel Mac OS X 10157 AppleWebKit/537.36 KHTML, like Gecko Chrome/116.0.0.0...

Provectus kafka-ui <=0.7.2 - Remote Code Execution

Provectus kafka-ui versions 0.7.0 through 0.7.2 are vulnerable to code injection in the /api/smartfilters/testexecutions endpoint. The filterCode parameter is evaluated as a Groovy expression without sandboxing, allowing an unauthenticated attacker to execute arbitrary code and operating-system...

Security Bulletin: Multiple Vulnerabilities in IBM Event Streams

Summary Multiple vulnerabilities were addressed in IBM Event Streams version 13.0.3 Vulnerability Details CVEID:CVE-2026-33557 DESCRIPTION: A possible security vulnerability has been identified in Apache Kafka. By default, the broker property sasl.oauthbearer.jwt.validator.class is set to...

cve-2023-25194

Apache Druid CVE-2023-25194 CVE-2023-25194 es una vulnerabilidad de deserialización que afecta a Apache Kafka. Este go-exploit demuestra la explotación de CVE-2023-25194 contra Apache Druid usando Kafka. Este tipo de ataque normalmente requiere una infraestructura de atacante LDAP JNDI que...

CVE-2026-15911-Confluent_Kafka

CVE-2026-15911: Disabled TLS Certificate Verification for HashiCorp Vault KMS in confluent-kafka Severity: High, CVSS 3.1 7.4 Vector v3.1: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N Affected: confluent-kafka = 2.8.0, = 2.14.2 Fixed in: 2.15.0 CWE: CWE-295 Improper Certificate Validation...

CVE-2026-49098

CVE-2026-49098 — camel-kafka kafka.OVERRIDETOPIC Header Injection Runnable proof-of-concept reproducers for the same Apache Camel vulnerability, one per runtime: Runtime| Directory| Stack ---|---|--- Camel Spring Boot| camel-spring-boot/| Spring Boot 3.2.0 + camel-spring-boot 4.18.2 Camel Quarkus...

Apache Kafka Client - Arbitrary File Read

Apache Kafka Client contains arbitrary file read and server-side request forgery caused by untrusted configuration of sasl.oauthbearer.token.endpoint.url and sasl.oauthbearer.jwks.endpoint.url, letting attackers read files or send requests to unintended locations, exploit requires untrusted party...

OPENSUSE-SU-2026:12006-1 python313-confluent-kafka-2.15.1-1.1 on GA media

These are all security issues fixed in the python313-confluent-kafka-2.15.1-1.1 package on the GA media of openSUSE Tumbleweed...

GHSA-642R-3GJ9-2PJ5 vulnerabilities

Vulnerabilities for packages: infinispan, keycloak, sonarqube, apicurio-registry, apache-tika, akhq, flyway, opensearch, trino, tez, scala, apache-nifi-registry, spdx-tools-java, cass-config-builder, wildfly, keycloak-config-cli, dependency-track, druid, strimzi-kafka-operator, gradle, apache-nif...

CVE-2026-68494 vulnerabilities

Vulnerabilities for packages: infinispan, keycloak, sonarqube, apicurio-registry, apache-tika, akhq, flyway, opensearch, trino, tez, scala, apache-nifi-registry, spdx-tools-java, cass-config-builder, wildfly, keycloak-config-cli, dependency-track, druid, strimzi-kafka-operator, gradle, apache-nif...

CVE-2023-34040

CVE-2023-34040 This PoC is cloned from https://github.com/Contrast-Security-OSS/Spring-Kafka-POC-CVE-2023-34040 About our analyzing process, please visit PDF file on the main repo...

kroxylicious-pqc-filter

Kroxylicious PQC Record Encryption Filter A Kroxylicious filter plugin that provides transparent Post-Quantum Cryptography PQC record-level encryption for Apache Kafka using ML-KEM FIPS 203 key encapsulation with AES-256-GCM symmetric encryption. Kafka producers and consumers require zero code...

CVE-2026-89425 vulnerabilities

Vulnerabilities for packages: mongodb-search, traccar-fips, apache-pulsar-fips, wildfly, dependency-track-apiserver, spdx-tools-java, geoserver, mongodb-search-fips, apache-pulsar, s3proxy-fips, ontop-fips, camunda, cassandra, apache-nifi-registry, logstash-fips, automq-fips,...

GHSA-7HHH-6RMP-J9QF vulnerabilities

Vulnerabilities for packages: mongodb-search, traccar-fips, apache-pulsar-fips, wildfly, dependency-track-apiserver, spdx-tools-java, geoserver, mongodb-search-fips, apache-pulsar, s3proxy-fips, ontop-fips, camunda, cassandra, apache-nifi-registry, logstash-fips, automq-fips,...

CVE-2026-89407 vulnerabilities

Vulnerabilities for packages: mongodb-search, traccar-fips, apache-pulsar-fips, wildfly, dependency-track-apiserver, spdx-tools-java, geoserver, mongodb-search-fips, apache-pulsar, s3proxy-fips, ontop-fips, camunda, cassandra, apache-nifi-registry, logstash-fips, automq-fips,...

GHSA-P6PP-M3F8-5C89 vulnerabilities

Vulnerabilities for packages: mongodb-search, traccar-fips, apache-pulsar-fips, wildfly, dependency-track-apiserver, spdx-tools-java, geoserver, mongodb-search-fips, apache-pulsar, s3proxy-fips, ontop-fips, camunda, cassandra, apache-nifi-registry, logstash-fips, automq-fips,...

GHSA-7HHH-6RMP-J9QF vulnerabilities

Vulnerabilities for packages: wavefront-proxy, cassandra, management-api-for-apache-cassandra-5.0, opensearch, tez, jenkins-plugin-manager, neo4j, thingsboard, celeborn, spdx-tools-java, cass-config-builder, cassandra-reaper, wildfly, keycloak-config-cli, strimzi-kafka-oauth, dependency-track,...