CLEANSTART-2026-ZF38801 Security fixes in kafka-fips 3.8.1-r11

Package kafka-fips version 3.8.1-r11 fixes 4 vulnerabilities: ghsa-mj4r-2hfc-f8p6, ghsa-rwm7-x88c-3g2p, CVE-2026-42583, CVE-2026-42577...

CVE-2026-33557 Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication

A possible security vulnerability has been identified in Apache Kafka. By default, the broker property sasl.oauthbearer.jwt.validator.class is set to org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator. It accepts any JWT token without validating its signature, issuer, or audience. A...

EUVD-2022-6777

Malicious code in bioql PyPI...

EUVD-2022-5820

Malicious code in bioql PyPI...

CVE-2025-27818

A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to the cluster resource, or Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, whic...

CVE-2025-27818

A security vulnerability in Apache Kafka allows an authenticated operator with access to alterConfig or the Kafka Connect REST API to inject an arbitrary SASL JAAS config . By setting the sasl.jaas.config property to com.sun.security.auth.module.LdapLoginModule via specific override properties, a...

CVE-2025-27818 Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration

A possible security vulnerability has been identified in Apache Kafka. This requires access to a alterConfig to the cluster resource, or Kafka Connect worker, and the ability to create/modify connectors on it with an arbitrary Kafka client SASL JAAS config and a SASL-based security protocol, whic...

com.hbasesoft.framework:framework-message-kafka (>=4.3.1, <=4.3.4), io.github.embeddedkafka:embedded-kafka-connect_2.12 (3.8.0) +3 more potentially affected by CVE-2024-56128 via org.apache.kafka:kafka_2.12 (3.8.0)

org.apache.kafka:kafka2.12 MAVEN version 3.8.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.kafka:kafka2.12 and may be impacted: - com.hbasesoft.framework:framework-message-kafka =4.3.1, =4.3.4 -...

OPENSUSE-SU-2022:0038-1 Security update for kafka

This update for kafka, kafka-kit fixes following issues: - Remove JDBCAppender, JMSSink, chainsaw from log4j jars during build to prevent bsc1194842, CVE-2022-23302, bsc1194843, CVE-2022-23305, bsc1194844, CVE-2022-23307 - Rebuild with kafka-kit change to Remove JMSAppender from log4j jars during...