Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation

Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`

Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy

Micrometer HTTP server instrumentations DoS vulnerability

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

GOSTCTR implementation unable to process more than 255 blocks correctly

Apache Kerby: Kerberos Pre-Authentication Bypass

Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers