CVE-2023-52251-POC

CVE-2023-52251-POC There is a Remote Code Execution vulnerability provectus/kafka-ui. There is no patch as of writing this, but the vendor is notified by us and the team over at VINCE without any response. Report was sent Sep 27, 2023 to provectus both via email and github security. Remediation W...

Provectus kafka-ui <=0.7.2 - Remote Code Execution

Provectus kafka-ui versions 0.7.0 through 0.7.2 are vulnerable to code injection in the /api/smartfilters/testexecutions endpoint. The filterCode parameter is evaluated as a Groovy expression without sandboxing, allowing an unauthenticated attacker to execute arbitrary code and operating-system...

Kafka UI 0.7.1 Command Injection

An issue discovered in provectus kafka-ui 0.4.0 through 0.7.1 allows remote attackers to execute arbitrary code via the q parameter of /api/clusters/local/topics/topic/messages. id: CVE-2023-52251 info: name: Kafka UI 0.7.1 Command Injection author: yhy0,iamnoooob severity: high description: | An...

CLEANSTART-2026-QY34934 Security fix for ghsa-prj3-ccx8-p6x4 applied in: cloudwatch-exporter 0.16.0-r0, incubator-kie-kogito-data-index-ephemeral 10.1.0-r1, kafka-ui 1.2.0-r1, kafka-ui 1.3.0-r1, kogito-apps 10.1.0-r0, kserve-modelmesh 0.12.0-r16, stargate 1.0.90-r4, stargate 2.0.44-r4

ghsa-prj3-ccx8-p6x4 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MZ20029 Security fix for CVE-2026-1225 applied in: cassandra 5.0.6-r2, cassandra 5.0.8-r1, cassandra-fips 4.0.19-r3, cassandra-fips 4.1.10-r2, cassandra-fips 5.0.6-r2, cassandra-reaper-fips 3.6.1-r3, cassandra-reaper-fips 3.7.1-r4, cassandra-reaper-fips 3.8.0-r9, cassandra-reaper-fips 4.0.1-r1, cassandra-reaper-fips 4.0.2-r1, cassandra-reaper-fips 4.1.1-r1, cloud-config-server 4.3.2-r3, confluent-common-docker 7.6.9-r3, kafka-ui 1.3.0-r2, kafka-ui 1.4.2-r5, kserve-modelmesh 0.10.0-r0, kserve-modelmesh 0.12.0-r0, schema-registry 7.7.8-r1, sonarqube 25.12.0.117093-r2, stargate 1.0.90-r4, stargate 2.0.44-r4, thingsboard 4.3.0.1-r2, thingsboard 4.3.1-r0, trino 479-r0

CVE-2026-1225 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-NJ85552 Security fix for ghsa-4q2v-9p7v-3v22 applied in: elasticsearch 9.3.5-r0, kafka-ui 1.2.0-r1, kafka-ui 1.3.0-r1, thingsboard 4.0.2-r0, thingsboard 4.1-r0

ghsa-4q2v-9p7v-3v22 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CC58014 Security fix for ghsa-rc42-6c7j-7h5r applied in: kafka-ui 1.2.0-r1, kafka-ui 1.3.0-r1

ghsa-rc42-6c7j-7h5r affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-UT02343 Security fix for ghsa-4wp7-92pw-q264 applied in: kafka-ui 1.2.0-r1, kafka-ui 1.3.0-r1

ghsa-4wp7-92pw-q264 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-FD72989 Security fix for ghsa-6r3c-xf4w-jxjm applied in: kafka-ui 1.2.0-r1, kafka-ui 1.3.0-r1

ghsa-6r3c-xf4w-jxjm affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-BH37333 Security fix for ghsa-jmp9-x22r-554x applied in: kafka-ui 1.2.0-r1, kafka-ui 1.3.0-r1

ghsa-jmp9-x22r-554x affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MT60008 Security fix for ghsa-hh3m-g4qj-4835 applied in: kafka-ui 1.2.0-r1, kafka-ui 1.3.0-r1

ghsa-hh3m-g4qj-4835 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VH43982 Security fix for ghsa-8v5q-rhf3-jphm applied in: kafka-ui 1.2.0-r1, kafka-ui 1.3.0-r1

ghsa-8v5q-rhf3-jphm affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QB26194 Security fix for ghsa-mg83-c7gq-rv5c applied in: kafka-ui 1.2.0-r1, kafka-ui 1.3.0-r1

ghsa-mg83-c7gq-rv5c affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-MW19809 Security fix for CVE-2026-22735 applied in: activemq 5.19.8-r3, activemq 6.1.8-r1, activemq 6.2.3-r0, apache-nifi 2.6.0-r3, kafka-ui 1.2.0-r4, kafka-ui 1.3.0-r2, kafka-ui 1.4.2-r5, thingsboard 4.3.0.1-r2

CVE-2026-22735 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-RU90125 Security fix for ghsa-9pp5-9c7g-4r83 applied in: kafka-ui 1.2.0-r1, kafka-ui 1.3.0-r1

ghsa-9pp5-9c7g-4r83 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DU72906 Security fix for CVE-2026-22737 applied in: activemq 5.19.8-r3, activemq 6.1.8-r1, activemq 6.2.3-r0, kafka-ui 1.2.0-r4, kafka-ui 1.3.0-r2, kafka-ui 1.4.2-r5, thingsboard 4.3.0.1-r2

CVE-2026-22737 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-DZ61403 Security fix for CVE-2026-22732 applied in: apache-nifi 2.7.2-r2, kafka-ui 1.2.0-r4, kafka-ui 1.3.0-r2, kafka-ui 1.4.2-r5, thingsboard 4.3.0.1-r3, thingsboard 4.3.1-r1

CVE-2026-22732 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-LS72691 Security fix for ghsa-6hcq-hmm3-jj3c applied in: kafka-ui 1.2.0-r4, kafka-ui 1.3.0-r2, kafka-ui 1.4.2-r5

ghsa-6hcq-hmm3-jj3c affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-WO59717 Security fix for ghsa-mf92-479x-3373 applied in: kafka-ui 1.2.0-r4, kafka-ui 1.3.0-r2, kafka-ui 1.4.2-r5, thingsboard 4.3.1-r1

ghsa-mf92-479x-3373 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-CP60630 Security fix for ghsa-4773-3jfm-qmx3 applied in: kafka-ui 1.2.0-r4, kafka-ui 1.3.0-r2, kafka-ui 1.4.2-r5

ghsa-4773-3jfm-qmx3 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...