759 matches found
CVE-2026-41732
CVE-2026-41732...
GHSA-8C42-7QJ2-3J46 vulnerabilities
Vulnerabilities for packages: apicurio-registry, zipkin, keycloak, thingsboard, opensearch, tez, wildfly, management-api-for-apache-cassandra-5.0, apache-activemq-artemis, wavefront-proxy, trino, apache-pulsar, druid, akhq, infinispan, neo4j...
CVE-2026-59903 vulnerabilities
Vulnerabilities for packages: apicurio-registry, zipkin, keycloak, thingsboard, opensearch, tez, wildfly, management-api-for-apache-cassandra-5.0, apache-activemq-artemis, wavefront-proxy, trino, apache-pulsar, druid, akhq, infinispan, neo4j...
Insecure Trusted-Package Validation
Spring for Apache Pulsar is vulnerable to an insecure trusted-package validation. The vulnerability is due to JsonPulsarHeaderMapper using a prefix-based check for trusted packages and treating an empty trusted-packages configuration as trusting all packages, which allows an attacker to potential...
The vulnerability affects Markdown preview extensions in enhanced code editors such as Visual Studio Code, Pulsar, and Atom. This allows attackers to execute arbitrary code.
The vulnerability of Markdown extension Preview Enhanced code editors like Visual Studio Code, Pulsar, and Atom is related to the lack of measures to neutralize special elements. Exploiting this vulnerability allows a malicious actor to execute arbitrary code remotely...
GHSA-WH89-7897-X99H vulnerabilities
Vulnerabilities for packages: celeborn, pinot-fips, hadoop-fips, neo4j, floci, apicurio-registry-fips, hono, apache-hop, apache-pulsar-fips, tez, knative-kafka-broker-fips, keycloak-fips, request-9047-keycloak-fips, zipkin, knative-kafka-broker, apache-hop-fips, pinot, apicurio-registry, keycloak...
CVE-2026-55851 vulnerabilities
Vulnerabilities for packages: celeborn, pinot-fips, hadoop-fips, neo4j, floci, apicurio-registry-fips, hono, apache-hop, apache-pulsar-fips, tez, knative-kafka-broker-fips, keycloak-fips, request-9047-keycloak-fips, zipkin, knative-kafka-broker, apache-hop-fips, pinot, apicurio-registry, keycloak...
GHSA-Q6CQ-MHR2-JMR5 vulnerabilities
Vulnerabilities for packages: celeborn, pinot-fips, hadoop-fips, neo4j, floci, apicurio-registry-fips, hono, apache-hop, apache-pulsar-fips, tez, knative-kafka-broker-fips, keycloak-fips, request-9047-keycloak-fips, zipkin, knative-kafka-broker, apache-hop-fips, pinot, apicurio-registry, keycloak...
CVE-2026-59919 vulnerabilities
Vulnerabilities for packages: celeborn, pinot-fips, hadoop-fips, neo4j, floci, apicurio-registry-fips, hono, apache-hop, apache-pulsar-fips, tez, knative-kafka-broker-fips, keycloak-fips, request-9047-keycloak-fips, zipkin, knative-kafka-broker, apache-hop-fips, pinot, apicurio-registry, keycloak...
CVE-2026-56741 vulnerabilities
Vulnerabilities for packages: pinot-fips, zookeeper-fips, hadoop-fips, apache-nifi, kafka-fips, confluent-kafka-jre-bcfips, apache-hop, apache-pulsar-fips, druid, hadoop-client-modules, spark, kafka, spark-kubernetes-operator-fips, tez, spark-kubernetes-operator, confluent-kafka, apache-hop-fips,...
CVE-2026-56740 vulnerabilities
Vulnerabilities for packages: pinot-fips, zookeeper-fips, hadoop-fips, apache-nifi, kafka-fips, confluent-kafka-jre-bcfips, apache-hop, apache-pulsar-fips, druid, hadoop-client-modules, spark, kafka, spark-kubernetes-operator-fips, tez, spark-kubernetes-operator, confluent-kafka, apache-hop-fips,...
CVE-2026-56740 vulnerabilities
Vulnerabilities for packages: zookeeper, kafka, tez, confluent-kafka, apache-pulsar, druid, apache-nifi...
CVE-2026-56741 vulnerabilities
Vulnerabilities for packages: zookeeper, kafka, tez, confluent-kafka, apache-pulsar, druid, apache-nifi...
PYSEC-2026-901 Apache Pulsar Disabled Certificate Validation for OAuth Client Credential Requests makes C++/Python Clients vulnerable to MITM attack
The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client Credential Flow, even when tlsAllowInsecureConnection is disabled via configuration. This vulnerability allows an attacker to perform a man in the middle attack and intercept and/or...
GHSA-47QP-HQVX-6R3F vulnerabilities
Vulnerabilities for packages: pinot-fips, zookeeper-fips, hadoop-fips, apache-nifi, kafka-fips, confluent-kafka-jre-bcfips, apache-hop, apache-pulsar-fips, druid, hadoop-client-modules, spark, kafka, spark-kubernetes-operator-fips, tez, spark-kubernetes-operator, confluent-kafka, apache-hop-fips,...
GHSA-2R2C-CX56-8933 vulnerabilities
Vulnerabilities for packages: pinot-fips, zookeeper-fips, hadoop-fips, apache-nifi, kafka-fips, confluent-kafka-jre-bcfips, apache-hop, apache-pulsar-fips, druid, hadoop-client-modules, spark, kafka, spark-kubernetes-operator-fips, tez, spark-kubernetes-operator, confluent-kafka, apache-hop-fips,...
CVE-2026-41732
JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...
Spring for Apache Pulsar: JsonPulsarHeaderMapper Trusted-Package Prefix Check Allows Unintended Subpackage Deserialization
JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...
EUVD-2026-35909
JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...
CVE-2026-41732
JsonPulsarHeaderMapper matched type headers against trusted packages using a prefix check, meaning that trusting any package implicitly trusted all of its subpackages. Additionally, an empty trusted-packages configuration fell back to trusting all packages rather than applying a safe default...