PU
Product
Pulsar
20
CVEs
0
On KEV
9.9
Max CVSS
0
New 30D
Severity mix
Critical 3High 7Medium 10Low 0
Watch
Add Pulsar to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-30677 | 6.5 | Apr 9 | Apache Pulsar IO Kafka Connector, Apache Pulsar IO Kafka Connect Adaptor: Sensitive information logged in Pulsar's Apache Kafka Connectors Affected: 2.3.0 before 3.0.11; 3.3.0 before 3.3.6; 4.0.0 before 4.0.4 |
| CVE-2023-37579 | 6.5 | Jul 12 | Incorrect Authorization vulnerability in Apache Software Foundation Apache Pulsar Function Worker Affected: before 2.10.4; 2.11.0; 2.11.0; 2.11.0 |
| CVE-2023-31007 | 6.5 | Jul 12 | Improper Authentication vulnerability in Apache Software Foundation Apache Pulsar Broker allows a client to stay connected to a broker after authentication data expires if the… Affected: before 2.9.5; 2.10.0 through 2.10.3; 2.11.0; 2.11.0; 2.11.0 |
| CVE-2022-24280 | 6.5 | Sep 23 | Improper Input Validation vulnerability in Proxy component of Apache Pulsar allows an attacker to make TCP/IP connection attempts that originate from the Pulsar Proxy's IP address Affected: through 2.6.4; 2.7.0 before 2.7.5; 2.8.0 before 2.8.3; 2.9.0 before 2.9.2 |
| CVE-2021-41571 | 6.5 | Feb 1 | In Apache Pulsar it is possible to access data from BookKeeper that does not belong to the topics accessible by the authenticated user Affected: 2.6.0 before 2.6.4; 2.7.0 before 2.7.3; 2.8.0 |
| CVE-2024-29834 | 6.4 | Apr 2 | This vulnerability allows authenticated users with produce or consume permissions to perform unauthorized operations on partitioned topics, such as unloading topics and triggering… Affected: 2.7.1 through 2.10.6; 2.11.0 through 2.11.4; 3.0.0 before 3.0.4; 3.1.0 through 3.1.3; 3.2.0 before 3.2.2 |
| CVE-2022-33683 | 5.9 | Sep 23 | Apache Pulsar Brokers and Proxies create an internal Pulsar Admin Client that does not verify peer TLS certificates, even when tlsAllowInsecureConnection is disabled via… Affected: before 2.7.5; 2.8.0 before 2.8.4; 2.9.0 before 2.9.3; 2.10.0 |
| CVE-2022-33682 | 5.9 | Sep 23 | TLS hostname verification cannot be enabled in the Pulsar Broker's Java Client, the Pulsar Broker's Java Admin Client, the Pulsar WebSocket Proxy's Java Client, and the Pulsar… Affected: before 2.7.5; 2.8.0 before 2.8.4; 2.9.0 before 2.9.3; 2.10.0 |
| CVE-2022-33681 | 5.9 | Sep 23 | Delayed TLS hostname verification in the Pulsar Java Client and the Pulsar Proxy make each client vulnerable to a man in the middle attack Affected: before 2.7.5; 2.8.0 before 2.8.4; 2.9.0 before 2.9.3; 2.10.0 |
| CVE-2024-28098 | 5.4 | Mar 12 | The vulnerability allows authenticated users with only produce or consume permissions to modify topic-level policies, such as retention, TTL, and offloading settings Affected: 2.7.1 before 2.10.6; 2.11.0 before 2.11.4; 3.0.0 before 3.0.3; 3.1.0 before 3.1.3; 3.2.0 |
Showing 10