Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation

mchange-commons-java: Remote Code Execution via JNDI Reference Resolution

Axios: Prototype pollution read-side gadgets in HTTP adapter allow credential injection and request hijacking

HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints

Directory Traversal vulnerability in the extractFile method of org.codehaus.plexus.util.Expand in plexus-utils before 6d780b3378829318ba5c2d29547e0012d5b29642

jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray)

Strimzi: All CAs from a custom CA chain consisting of multiple CAs are trusted for mTLS user autentication

Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator`

c3p0 vulnerable to Remote Code Execution via unsafe deserialization of userOverridesAsString property

Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy

Micrometer HTTP server instrumentations DoS vulnerability

Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

GOSTCTR implementation unable to process more than 255 blocks correctly

flatted: Unbounded recursion DoS in parse() revive phase

Apache Kerby: Kerberos Pre-Authentication Bypass

Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers