Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation

Storybook Dev Server Vulnerable to WebSocket Hijacking

Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication

HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints

Next.js: Server-side request forgery in applications using WebSocket upgrades

Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname

Next.js: Middleware / Proxy bypass through dynamic route parameter injection

Strimzi: All CAs from a custom CA chain consisting of multiple CAs are trusted for mTLS user autentication

Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy

Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities

Netty's wrapping plain trust manager silently disables hostname verification

Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Next.js: Denial of Service via connection exhaustion in applications using Cache Components

Next.js: Middleware / Proxy bypass in App Router applications via segment-prefetch routes

Next.js: Middleware / Proxy bypass in Pages Router applications using i18n

flatted: Unbounded recursion DoS in parse() revive phase

Apache ZooKeeper: Sensitive information disclosure in client configuration handling

Axios affected by Denial of Service via __proto__ Key in mergeConfig

In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable

Apache ZooKeeper: Reverse-DNS fallback enables hostname verification bypass in ZooKeeper ZKTrustManager

Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers

Next.js: Denial of Service in the Image Optimization API

ajv (Another JSON Schema Validator) before 8.18.0 is vulnerable to Regular Expression Denial of Service (ReDoS) when the $data option is enabled