CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 4,591 CVEs published, 307 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
4,591
Show in the list
Critical, last 7 days
307
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,754
Show in the list

Showing CVEs that name the product apache_software_foundation:apache_pulsar. Show all products

14 CVEs, showing 1 to 14
CVESeverityTitlePublished
CVE-2026-105945High 7.7Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage
Assigned by apache
Oct 21, 2026
CVE-2026-105942High 7.7Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation
Assigned by apache
Oct 21, 2026
CVE-2026-105938Low 2.3Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all
Assigned by apache
Oct 21, 2026
CVE-2026-105937High 8.7Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data
Assigned by apache
Oct 21, 2026
CVE-2026-105936Medium 5.3Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint
Assigned by apache
Oct 21, 2026
CVE-2026-105935Medium 4.9Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission
Assigned by apache
Oct 21, 2026
CVE-2026-105934High 7.2Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic
Assigned by apache
Oct 21, 2026
CVE-2026-105933Low 2.3Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization
Assigned by apache
Oct 21, 2026
CVE-2026-105932Low 2.3Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints
Assigned by apache
Oct 21, 2026
CVE-2026-105931Low 2.3Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants
Assigned by apache
Oct 21, 2026
CVE-2026-105930Medium 6.0Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download
Assigned by apache
Oct 21, 2026
CVE-2026-105927Low 2.3Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission
Assigned by apache
Oct 21, 2026
CVE-2026-105926Medium 5.3Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands
Assigned by apache
Oct 21, 2026
CVE-2026-105869Critical 9.2Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role
Assigned by apache
Oct 21, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.