| CVE-2026-105945 |
The Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by…
|
7.7
High
|
Oct 21, 2026 |
| CVE-2026-105942 |
When a configured proxy role sends a request to the broker on behalf of another user (the original principal), the…
|
7.7
High
|
Oct 21, 2026 |
| CVE-2026-105938 |
Apache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription…
|
2.3
Low
|
Oct 21, 2026 |
| CVE-2026-105937 |
Apache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's…
|
8.7
High
|
Oct 21, 2026 |
| CVE-2026-105936 |
The Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on…
|
5.3
Medium
|
Oct 21, 2026 |
| CVE-2026-105935 |
The Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied…
|
4.9
Medium
|
Oct 21, 2026 |
| CVE-2026-105934 |
The Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE…
|
7.2
High
|
Oct 21, 2026 |
| CVE-2026-105933 |
Apache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by…
|
2.3
Low
|
Oct 21, 2026 |
| CVE-2026-105932 |
The Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy…
|
2.3
Low
|
Oct 21, 2026 |
| CVE-2026-105931 |
The Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions
|
2.3
Low
|
Oct 21, 2026 |
| CVE-2026-105930 |
When package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package…
|
6.0
Medium
|
Oct 21, 2026 |
| CVE-2026-105927 |
The Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query…
|
2.3
Low
|
Oct 21, 2026 |
| CVE-2026-105926 |
The Pulsar broker serves two schema commands on its binary protocol: GetSchema, which returns the schema registered…
|
5.3
Medium
|
Oct 21, 2026 |
| CVE-2026-105869 |
Apache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON…
|
9.2
Critical
|
Oct 21, 2026 |
| CVE-2024-29834 |
This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations…
|
6.4
Medium
|
Apr 2, 2024 |
| CVE-2024-27894 |
The Pulsar Functions Worker includes a capability that permits authenticated users to create functions where the…
|
8.5
High
|
Mar 12, 2024 |
| CVE-2024-27317 |
In Pulsar Functions Worker, authenticated users can upload functions in jar or nar files
|
8.4
High
|
Mar 12, 2024 |
| CVE-2024-27135 |
Improper input validation in the Pulsar Function Worker allows a malicious authenticated user to execute arbitrary…
|
8.5
High
|
Mar 12, 2024 |
| CVE-2022-34321 |
Improper Authentication vulnerability in Apache Pulsar Proxy allows an attacker to connect to the /proxy-stats…
|
8.2
High
|
Mar 12, 2024 |
| CVE-2024-28098 |
The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies,…
|
6.4
Medium
|
Mar 12, 2024 |
| CVE-2023-51437 |
Observable timing discrepancy vulnerability in Apache Pulsar SASL Authentication Provider can allow an attacker to forge…
|
7.4
High
|
Feb 7, 2024 |
| CVE-2023-30429 |
Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar
|
9.6
Critical
|
Jul 12, 2023 |
| CVE-2023-31007 |
Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay…
|
0.0
Not rated
|
Jul 12, 2023 |
| CVE-2022-33684 |
The Apache Pulsar C++ Client does not verify peer TLS certificates when making HTTPS calls for the OAuth2.0 Client…
|
Not rated
|
Nov 4, 2022 |
| CVE-2022-33683 |
Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates,…
|
Not rated
|
Sep 23, 2022 |