Improper Certificate Validation

Overview confluent-kafka is a high-level Producer, Consumer and AdminClient compatible with all Apache KafkaTM broker Affected versions of this package are vulnerable to Improper Certificate Validation in HcVaultKmsClient.init in...

CLEANSTART-2026-WA75258 Security fix for ghsa-3677-xxcr-wjqv applied in: apache-nifi 2.7.2-r0, confluent-common-docker 7.6.9-r2, kafka 4.0.1-r0, kafka-fips 4.0.1-r0, kafka-fips 4.0.1-r1, schema-registry 7.7.7-r0

ghsa-3677-xxcr-wjqv affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-QB24702 Security fix for CVE-2025-5115 applied in: schema-registry 7.7.8-r0, schema-registry 7.9.6-r0, solr 9.8.1-r1

CVE-2025-5115 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-VE14203 Security fix for CVE-2026-42778 applied in: apache-nifi 2.7.2-r7, apache-nifi 2.9.0-r1, schema-registry 7.9.6-r0, stargate 1.0.91-r2, stargate 2.0.44-r6, stargate 2.0.48-r0

CVE-2026-42778 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-NP40407 Security fix for CVE-2026-41635 applied in: apache-nifi 2.7.2-r7, apache-nifi 2.9.0-r1, schema-registry 7.9.6-r0, stargate 1.0.91-r2, stargate 2.0.44-r6, stargate 2.0.48-r0

CVE-2026-41635 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

CLEANSTART-2026-TW68180 Security fix for CVE-2026-41409 applied in: apache-nifi 2.7.2-r7, apache-nifi 2.9.0-r1, schema-registry 7.9.6-r0, stargate 1.0.91-r2, stargate 2.0.44-r6, stargate 2.0.48-r0

CVE-2026-41409 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details...

Assignment to Variable without Use

Overview Affected versions of this package are vulnerable to Assignment to Variable without Use due to improper handling of content type caching. An attacker can cause incorrect processing of message content by manipulating the content type during message handling. Remediation Upgrade...

Assignment to Variable without Use

Overview Affected versions of this package are vulnerable to Assignment to Variable without Use due to improper handling of content type caching. An attacker can cause incorrect processing of message content by manipulating the content type during message handling. Remediation Upgrade...

Assignment to Variable without Use

Overview Affected versions of this package are vulnerable to Assignment to Variable without Use due to improper handling of content type caching. An attacker can cause incorrect processing of message content by manipulating the content type during message handling. Remediation Upgrade...

CVE-2026-44416

Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-44416 Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation

Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-44416

Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

EUVD-2026-55250

Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-44416 Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation

Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CVE-2026-44416 Apache Ranger: Remote Code Execution via Arbitrary Class Instantiation

Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

PT-2026-69430

Name of the Vulnerable Software and Affected Versions Apache Ranger versions prior to 2.9.0 Description Remote Code Execution is possible through arbitrary class instantiation within the plugin-schema-registry component. Arbitrary class instantiation occurs when an application creates an instance...

CVE-2026-44416: Improper Control of Generation of Code

Remote Code Execution via Arbitrary Class Instantiation in plugin-schema-registry component in Apache Ranger = 2.8.0. Users are recommended to upgrade to version 2.9.0, which fixes this issue...

CLEANSTART-2026-FE38987 Security fixes in schema-registry 8.1.2-r0

Package schema-registry version 8.1.2-r0 fixes 5 vulnerabilities: CVE-2025-12383, CVE-2026-34477, CVE-2026-34478, CVE-2026-34479, CVE-2026-34480...

CLEANSTART-2026-LO22603 Security fixes for CVE-2024-13009, CVE-2024-6763, CVE-2025-12383, CVE-2025-5115, CVE-2026-1225, CVE-2026-24281, CVE-2026-24308, CVE-2026-34479, CVE-2026-41409, CVE-2026-41635, CVE-2026-42778, CVE-2026-42779, ghsa-355h-qmc2-wpwf, ghsa-3677-xxcr-wjqv, ghsa-72hv-8253-57qq, ghsa-84h7-rjj3-6jx4, ghsa-vc5p-v9hr-52mj applied in versions: 7.7.7-r0, 7.7.8-r0, 7.7.8-r1, 7.9.6-r0, 8.1.2-r0

Multiple security vulnerabilities affect the schema-registry package. These issues are resolved in later releases. See references for individual vulnerability details...

CVE-2025-61673

Karapace is an open-source implementation of Kafka REST and Schema Registry. Versions 5.0.0 and 5.0.1 contain an authentication bypass vulnerability when configured to use OAuth 2.0 Bearer Token authentication. If a request is sent without an Authorization header, the token validation logic is...