Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints

Next.js: Server-side request forgery in applications using WebSocket upgrades

Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname

Next.js: Middleware / Proxy bypass through dynamic route parameter injection

Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy

Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

Netty's wrapping plain trust manager silently disables hostname verification

Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Next.js: Denial of Service via connection exhaustion in applications using Cache Components

Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Next.js: Middleware / Proxy bypass in Pages Router applications using i18n

flatted: Unbounded recursion DoS in parse() revive phase

Apache ZooKeeper: Sensitive information disclosure in client configuration handling

In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable

Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager