AP
Product
Apache Pulsar
15
CVEs
0
On KEV
9.2
Max CVSS
14
New 30D
Severity mix
Critical 1High 5Medium 4Low 5
Watch
Add Apache Pulsar to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-105937 New | 8.7 | Oct 21 | Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data Affected: 3.0.0 before 4.0.14; 4.1.0 before 4.2.5 |
| CVE-2022-33684 | 8.1 | Nov 4 | Apache Pulsar C++/Python OAuth Clients prior to 3.0.0 were vulnerable to an MITM attack due to Disabled Certificate Validation Affected: 2.7 through 2.7.4; 2.8 through 2.8.3; 2.9 through 2.9.2; 2.10 through 2.10.1; 2.6 and earlier through 2.6.4 |
| CVE-2026-105945 New | 7.7 | Oct 21 | Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage Affected: 2.10.0 before 4.0.14; 4.1.0 before 4.2.5 |
| CVE-2026-105942 New | 7.7 | Oct 21 | Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation Affected: 2.8.1 before 4.0.14; 4.1.0 before 4.2.5 |
| CVE-2026-105934 New | 7.2 | Oct 21 | Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic Affected: 2.8.0 before 4.0.14; 4.1.0 before 4.2.5 |
Showing 5