GHSA-WH89-7897-X99H vulnerabilities

Vulnerabilities for packages: floci-az, keycloak, zipkin, apache-pulsar-fips, knative-kafka-broker, hono, pinot, keycloak-fips, apicurio-registry, management-api-for-apache-cassandra-5.0, floci, apache-hop, apache-hop-fips, celeborn, apache-pulsar, request-9047-keycloak-fips,...

CVE-2026-55851 vulnerabilities

Vulnerabilities for packages: floci-az, keycloak, zipkin, apache-pulsar-fips, knative-kafka-broker, hono, pinot, keycloak-fips, apicurio-registry, management-api-for-apache-cassandra-5.0, floci, apache-hop, apache-hop-fips, celeborn, apache-pulsar, request-9047-keycloak-fips,...

GHSA-Q6CQ-MHR2-JMR5 vulnerabilities

Vulnerabilities for packages: floci-az, keycloak, zipkin, apache-pulsar-fips, knative-kafka-broker, hono, pinot, keycloak-fips, apicurio-registry, management-api-for-apache-cassandra-5.0, floci, apache-hop, apache-hop-fips, celeborn, apache-pulsar, request-9047-keycloak-fips,...

CVE-2026-59919 vulnerabilities

Vulnerabilities for packages: floci-az, keycloak, zipkin, apache-pulsar-fips, knative-kafka-broker, hono, pinot, keycloak-fips, apicurio-registry, management-api-for-apache-cassandra-5.0, floci, apache-hop, apache-hop-fips, celeborn, apache-pulsar, request-9047-keycloak-fips,...

CVE-2026-56741 vulnerabilities

Vulnerabilities for packages: hadoop-fips, spark, zookeeper-fips, confluent-kafka-jre-bcfips, apache-pulsar-fips, pinot, apache-nifi, spark-fips, kafka, zookeeper, apache-hop, apache-camel-karavan-devmode, kafka-fips, apache-hop-fips, hadoop-client-modules, confluent-kafka, apache-pulsar, druid,...

CVE-2026-56740 vulnerabilities

Vulnerabilities for packages: hadoop-fips, spark, zookeeper-fips, confluent-kafka-jre-bcfips, apache-pulsar-fips, pinot, apache-nifi, spark-fips, kafka, zookeeper, apache-hop, apache-camel-karavan-devmode, kafka-fips, apache-hop-fips, hadoop-client-modules, confluent-kafka, apache-pulsar, druid,...

CVE-2026-56741 vulnerabilities

Vulnerabilities for packages: druid, apache-pulsar, kafka, tez, zookeeper, confluent-kafka, apache-nifi...

CVE-2026-56740 vulnerabilities

Vulnerabilities for packages: druid, apache-pulsar, kafka, tez, zookeeper, confluent-kafka, apache-nifi...

PYSEC-2026-901 Apache Pulsar Disabled Certificate Validation for OAuth Client Credential Requests makes C++/Python Clients vulnerable to MITM attack

The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureConnection is disabled via configuration. This vulnerability allows an attacker to perform a man in the middle attack and intercept and/or...

GHSA-47QP-HQVX-6R3F vulnerabilities

Vulnerabilities for packages: hadoop-fips, spark, zookeeper-fips, confluent-kafka-jre-bcfips, apache-pulsar-fips, pinot, apache-nifi, spark-fips, kafka, zookeeper, apache-hop, apache-camel-karavan-devmode, kafka-fips, apache-hop-fips, hadoop-client-modules, confluent-kafka, apache-pulsar, druid,...

GHSA-2R2C-CX56-8933 vulnerabilities

Vulnerabilities for packages: hadoop-fips, spark, zookeeper-fips, confluent-kafka-jre-bcfips, apache-pulsar-fips, pinot, apache-nifi, spark-fips, kafka, zookeeper, apache-hop, apache-camel-karavan-devmode, kafka-fips, apache-hop-fips, hadoop-client-modules, confluent-kafka, apache-pulsar, druid,...

ai.new-wave:spring-agent-app (>=0.1.0 <=0.3.0), ai.new-wave:spring-agent-core (>=0.1.0 <=0.3.0) +4472 more potentially affected by CVE-2026-50010 via io.netty:netty-handler (>=4.2.0.Alpha1 <=4.2.14.Final)

io.netty:netty-handler MAVEN version =4.2.0.Alpha1, =0.1.0, =0.1.0, =4.7.4, =4.7.4, =4.7.3, =4.7.3, =4.7.3, =4.7.3, =4.7.3, =26.3.0, =26.3.0, =26.3.0, =26.3.2 and more Source cves: CVE-2026-50010 Source advisory: SNYK:JAVA-IONETTY-17334567...

CVE-2026-41732

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...

EUVD-2026-35909

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...

CVE-2026-41732

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...

VMware Spring for Apache Pulsar 代码问题漏洞

VMware Spring for Apache Pulsar is a Pulsar messaging integration framework developed by the company VMware. Versions of VMware Spring for Apache Pulsar such as 2.0.0, 1.2.0, and 1.1.0 have code vulnerabilities. These vulnerabilities stem from the use of JsonPulsarHeaderMapper to check header typ...

CVE-2026-41732

CVE-2026-41732 affects Spring for Apache Pulsar due to JsonPulsarHeaderMapper using a prefix-based check on trusted packages, causing trust to cascade to subpackages. An empty trusted-packages config can default to trusting all packages. This exposes potential deserialization risk by allowing acc...

CVE-2026-41732 In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...

CVE-2026-41732 In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...

CVE-2026-41732 In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization

JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...