You are viewing a plain text version of this content. The canonical link for it is here.
- [ANNOUNCE] Apache Pulsar 4.2.5 released - posted by Lari Hotari <lh...@apache.org> on 2026/10/05 20:10:45 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar 4.0.14 released - posted by Lari Hotari <lh...@apache.org> on 2026/10/05 20:11:33 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar 5.0.0 LTS released - posted by Lari Hotari <lh...@apache.org> on 2026/10/06 00:53:33 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar C# Client DotPulsar 5.3.4 released - posted by David Jensen <dj...@apache.org> on 2026/10/09 07:31:57 UTC, 0 replies.
- [ANNOUNCE] Apache Pulsar Helm Chart version 4.8.0 Released - posted by Lari Hotari <lh...@apache.org> on 2026/10/13 12:04:13 UTC, 0 replies.
- CVE-2026-105869: Apache Pulsar: MultiRolesTokenAuthorizationProvider uses roles from unverified tokens for HTTP requests that fall back to the anonymous user role - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:46:48 UTC, 0 replies.
- CVE-2026-105926: Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:47:00 UTC, 0 replies.
- CVE-2026-105927: Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:47:13 UTC, 0 replies.
- CVE-2026-105930: Apache Pulsar: Improper Authorization of Function, Source and Sink Package URLs Allows Cross-Tenant Package Download - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:47:23 UTC, 0 replies.
- CVE-2026-105931: Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:47:33 UTC, 0 replies.
- CVE-2026-105932: Apache Pulsar: Missing topic policy authorization on non-persistent topic entry filter endpoints - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:47:44 UTC, 0 replies.
- CVE-2026-105933: Apache Pulsar: Namespace encryption requirement not enforced after a failure during topic initialization - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:47:52 UTC, 0 replies.
- CVE-2026-105934: Apache Pulsar: Missing tenant admin authorization check when truncating a partitioned topic - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:48:00 UTC, 0 replies.
- CVE-2026-105935: Apache Pulsar: Function trigger publishes to the input topic without checking the caller's produce permission - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:48:09 UTC, 0 replies.
- CVE-2026-105936: Apache Pulsar: Functions connectors list endpoint does not apply the super-user check of the worker connectors endpoint - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:48:18 UTC, 0 replies.
- CVE-2026-105937: Apache Pulsar: Missing authorization of the shadow topic source allows cross-tenant message disclosure and deletion of source topic data - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:48:26 UTC, 0 replies.
- CVE-2026-105938: Apache Pulsar: Subscription authorization policies not enforced by namespace-level backlog and unsubscribe operations and by topic expire-all - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:48:35 UTC, 0 replies.
- CVE-2026-105942: Apache Pulsar: Original principal of proxied requests authorized with the proxy's authentication data, allowing privilege escalation - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:48:43 UTC, 0 replies.
- CVE-2026-105944: Apache Pulsar Manager: Missing authentication and authorization and disclosure of the Pulsar admin credential; end of life - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:48:51 UTC, 0 replies.
- CVE-2026-105945: Apache Pulsar: Improper Validation of Package Name Components Allows Cross-Tenant Package Access in Filesystem Package Storage - posted by Lari Hotari <lh...@apache.org> on 2026/10/21 17:48:59 UTC, 0 replies.