CLEANSTART-2026-SM84039 Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apache Kafka from 2

Security vulnerability affects the strimzi-kafka-operator package. Incorrect operator CWE-480 in the FetchSnapshot RPC handler in Apache Kafka from 2...

CVE-2026-126723

Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI whitelist RPC handler /usr/lib/lua/luci/data/whitelistplt.lua, where unsanitized user-supplied MAC addresses are concatenated into os.execute without validation, yielding root command execution via a...

CVE-2026-126723 CVE-2026-126723

Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI whitelist RPC handler /usr/lib/lua/luci/data/whitelistplt.lua, where unsanitized user-supplied MAC addresses are concatenated into os.execute without validation, yielding root command execution via a...

EUVD-2026-123583

Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI whitelist RPC handler /usr/lib/lua/luci/data/whitelistplt.lua, where unsanitized user-supplied MAC addresses are concatenated into os.execute without validation, yielding root command execution via a...

CVE-2026-126723

The Rooxis RXR-12 Wi-Fi router is vulnerable to an authenticated command injection flaw in the LuCI white_list RPC handler located at /usr/lib/lua/luci/data/white_list_plt.lua. The root cause is the lack of validation for user-supplied MAC addresses , which are concatenated into os.execute() with...

CVE-2026-126723: Rooxis Rooxis RXR-12: Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI white_list RPC handler…

Rooxis RXR-12 Wi-Fi router contains an authenticated command injection vulnerability in the LuCI whitelist RPC handler /usr/lib/lua/luci/data/whitelistplt.lua, where unsanitized user-supplied MAC addresses are concatenated into os.execute without validation, yielding root command execution via a...

CVE-2026-83525

A flaw was found in Apache Kafka. An authenticated attacker with cluster administrative privileges can cause a Denial of Service DoS by sending a crafted snapshot request containing an empty topics array or a topic without partitions. Due to improper input handling in the FetchSnapshot Remote...

SUSE CVE-2026-83525

Incorrect operator CWE-480 in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTERACTION privilege to cause a denial of service controller process termination via a crafted...

Linux Distros Unpatched Vulnerability : CVE-2026-83525

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - Incorrect operator CWE-480 in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an...

Use of Incorrect Operator

Overview Affected versions of this package are vulnerable to Use of Incorrect Operator via the FetchSnapshot RPC handler in the Kafka Raft client. An authenticated attacker with CLUSTERACTION privilege can terminate the controller by sending a crafted FetchSnapshotRequest with an empty topics arr...

CVE-2026-83525

Incorrect operator CWE-480 in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTERACTION privilege to cause a denial of service controller process termination via a crafted...

UBUNTU-CVE-2026-83525

Incorrect operator CWE-480 in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTERACTION privilege to cause a denial of service controller process termination via a crafted...

CVE-2026-83525

Incorrect operator CWE-480 in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTERACTION privilege to cause a denial of service controller process termination via a crafted...

CVE-2026-83525 Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.

Incorrect operator CWE-480 in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTERACTION privilege to cause a denial of service controller process termination via a crafted...

CVE-2026-83525

Incorrect operator CWE-480 in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTERACTION privilege to cause a denial of service controller process termination via a crafted...

EUVD-2026-112210

Incorrect operator CWE-480 in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTERACTION privilege to cause a denial of service controller process termination via a crafted...

CVE-2026-83525

Apache Kafka versions 2.8.0 before 4.2.2 and 4.3.0 before 4.3.2 are vulnerable to a Denial of Service (DoS) via an incorrect operator (CWE-480) in the FetchSnapshot RPC handler . An authenticated attacker with CLUSTER_ACTION privileges can cause the controller process to terminate unexpectedly by...

CVE-2026-83525 Apache Kafka: Incorrect boolean operator in FetchSnapshot RPC handler allows authenticated network clients to crash the KRaft controller via a malformed request.

Incorrect operator CWE-480 in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTERACTION privilege to cause a denial of service controller process termination via a crafted...

PT-2026-128336

Incorrect operator CWE-480 in the FetchSnapshot RPC handler in Apache Kafka from 2.8.0 before 4.2.2, and from 4.3.0 before 4.3.2 on all platforms allows an authenticated attacker with CLUSTER ACTION privilege to cause a denial of service controller process termination via a crafted...

Vulnerability related to improper Apache Kafka processing logic

Versions of Apache Kafka from 2.8.0 up to and including 4.2.2, as well as versions from 4.3.0 up to and including 4.3.2, contain a logic error vulnerability. This vulnerability stems from an incorrect operator within the FetchSnapshot RPC handler. Authenticated attackers with CLUSTERACTION...