836 matches found
CVE-2026-41732
JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...
EUVD-2026-35909
JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...
CVE-2026-41732
JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...
VMware Spring for Apache Pulsar 代码问题漏洞
VMware Spring for Apache Pulsar is a Pulsar messaging integration framework developed by the company VMware. Versions of VMware Spring for Apache Pulsar such as 2.0.0, 1.2.0, and 1.1.0 have code vulnerabilities. These vulnerabilities stem from the use of JsonPulsarHeaderMapper to check header typ...
CVE-2026-41732
CVE-2026-41732 affects Spring for Apache Pulsar due to JsonPulsarHeaderMapper using a prefix-based check on trusted packages, causing trust to cascade to subpackages. An empty trusted-packages config can default to trusting all packages. This exposes potential deserialization risk by allowing acc...
CVE-2026-41732 In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization
JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...
CVE-2026-41732 In Spring for Apache Pulsar, overly broad trusted-package matching in header mapper exposes JDK classes to deserialization
JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...
GHSA-W573-9FFJ-6FF9 vulnerabilities
Vulnerabilities for packages: cassandra-reaper, airbyte-server, thingsboard, seata, spark-kubernetes-operator, infinispan, zookeeper-fips, flyway, apache-pulsar, cassandra, trino, s3proxy-fips, kserve-modelmesh, spark, kafka, localstack, apache-hop, neo4j, management-api-for-apache-cassandra-4.1,...
CVE-2026-45673 vulnerabilities
Vulnerabilities for packages: airbyte-server, commercial-elasticsearch, thingsboard, seata, spark-kubernetes-operator, infinispan, knative-kafka-broker-fips, kafka-bridge, apache-pulsar, flyway, apicurio-registry, selenium, elasticsearch-fips, s3proxy-fips, trino, spark, apache-hop,...
CVE-2026-47244 vulnerabilities
Vulnerabilities for packages: airbyte-server, commercial-elasticsearch, thingsboard, seata, spark-kubernetes-operator, infinispan, knative-kafka-broker-fips, kafka-bridge, apache-pulsar, apicurio-registry, elasticsearch-fips, trino, kserve-modelmesh, spark, apache-camel-karavan-devmode, apache-ho...
GHSA-676X-F7GG-47VC vulnerabilities
Vulnerabilities for packages: airbyte-server, commercial-elasticsearch, thingsboard, seata, spark-kubernetes-operator, infinispan, knative-kafka-broker-fips, kafka-bridge, apache-pulsar, flyway, apicurio-registry, selenium, elasticsearch-fips, s3proxy-fips, trino, spark, apache-hop,...
GHSA-CC37-9Q2J-3HFV vulnerabilities
Vulnerabilities for packages: seata, knative-kafka-broker-fips, celeborn, apache-pulsar, apicurio-registry, trino, apache-hop, neo4j, management-api-for-apache-cassandra-4.1, keycloak-fips, zipkin, pinot, pinot-fips, request-9047-keycloak-fips, apache-hop-fips,...
GHSA-5PVG-856G-CP85 vulnerabilities
Vulnerabilities for packages: airbyte-server, commercial-elasticsearch, thingsboard, seata, spark-kubernetes-operator, infinispan, knative-kafka-broker-fips, kafka-bridge, apache-pulsar, flyway, apicurio-registry, selenium, elasticsearch-fips, s3proxy-fips, trino, spark, apache-hop,...
GHSA-5X3R-WRVG-RP6Q vulnerabilities
Vulnerabilities for packages: airbyte-server, commercial-elasticsearch, thingsboard, seata, spark-kubernetes-operator, infinispan, knative-kafka-broker-fips, kafka-bridge, apache-pulsar, apicurio-registry, elasticsearch-fips, trino, kserve-modelmesh, spark, apache-camel-karavan-devmode, apache-ho...
GHSA-XMV7-R254-6Q78 vulnerabilities
Vulnerabilities for packages: airbyte-server, commercial-elasticsearch, thingsboard, seata, spark-kubernetes-operator, infinispan, knative-kafka-broker-fips, kafka-bridge, apache-pulsar, flyway, apicurio-registry, selenium, elasticsearch-fips, s3proxy-fips, trino, spark, apache-hop,...
CVE-2026-45536 vulnerabilities
Vulnerabilities for packages: cassandra-reaper, airbyte-server, thingsboard, seata, spark-kubernetes-operator, infinispan, zookeeper-fips, flyway, apache-pulsar, cassandra, trino, s3proxy-fips, kserve-modelmesh, spark, kafka, localstack, apache-hop, neo4j, management-api-for-apache-cassandra-4.1,...
CVE-2026-45674 vulnerabilities
Vulnerabilities for packages: airbyte-server, commercial-elasticsearch, thingsboard, seata, spark-kubernetes-operator, infinispan, knative-kafka-broker-fips, kafka-bridge, apache-pulsar, flyway, apicurio-registry, selenium, elasticsearch-fips, s3proxy-fips, trino, spark, apache-hop,...
CVE-2026-44893 vulnerabilities
Vulnerabilities for packages: seata, knative-kafka-broker-fips, celeborn, apache-pulsar, apicurio-registry, trino, apache-hop, neo4j, management-api-for-apache-cassandra-4.1, keycloak-fips, zipkin, pinot, pinot-fips, request-9047-keycloak-fips, apache-hop-fips,...
CVE-2026-47691 vulnerabilities
Vulnerabilities for packages: airbyte-server, commercial-elasticsearch, thingsboard, seata, spark-kubernetes-operator, infinispan, knative-kafka-broker-fips, kafka-bridge, apache-pulsar, flyway, apicurio-registry, selenium, elasticsearch-fips, s3proxy-fips, trino, spark, apache-hop,...
PT-2026-48328
JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...