AP
Product
Apache Pulsar
15
CVEs
0
On KEV
9.2
Max CVSS
14
New 30D
Severity mix
Critical 1High 5Medium 4Low 5
Watch
Add Apache Pulsar to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2026-105938 New | 2.3 | Oct 21 | Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all Affected: 2.8.0 before 4.0.14; 4.1.0 before 4.2.5 |
| CVE-2026-105933 New | 2.3 | Oct 21 | Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization Affected: 1.22.0-incubating before 4.0.14; 4.1.0 before 4.2.5 |
| CVE-2026-105932 New | 2.3 | Oct 21 | Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints Affected: 3.3.0 before 4.0.14; 4.1.0 before 4.2.5 |
| CVE-2026-105931 New | 2.3 | Oct 21 | Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants Affected: 2.8.0 before 4.0.14; 4.1.0 before 4.2.5 |
| CVE-2026-105927 New | 2.3 | Oct 21 | Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission Affected: 2.3.0 before 4.0.14; 4.1.0 before 4.2.5 |
Showing 5