Apache product
Kafka
Tracked since 29 Oct · latest article 29 Oct · RSS · API
None open
of 0 in the full CISA catalogue · all time
EPSS top 5%, not in KEV
usual rate
Exploited, by due date
No Kafka CVE is in the CISA KEV catalogue.
Patch cadence and exploit odds
How often CISA adds Kafka CVEs, how many have a fix, and where their exploit odds sit.
Added to CISA KEV per quarter
CISA has not added a Kafka CVE to KEV.
Fix listed
4 of 4 CVEs in coverage
Every CVE in coverage has a fix recorded.
EPSS percentile of each CVE
No EPSS scores are recorded for these CVEs.
Coverage1 article · all time
The latest article naming Kafka, in the shared story grammar.
1 article from 1 outlet since 29 Oct. Still developing; the latest report was 2 hours ago.
- Thu 29 Oct, 05:00 UTC. SecurityOnline, first report. Apache Kafka fixes 12 flaws, including a cluster access bypass.
- CVE not in KEV
- No CVE
- Larger: an outlet’s first report
- Coverage over time
Show all 1 articles as a listHide the list
- Thu 29 OctDay 01
- Apache Kafka fixes 12 flaws, including a cluster access bypass05:00 · SecurityOnline · First report
All CVEs in coverage4
Exploited first, then by EPSS
Apache Kafka: Kafka Connect configuration provider values exposed via validation REST API endpoint
Not scored1 articleApache Kafka: Unauthorized principal can read arbitrary broker files via IncrementalAlterConfigs
Not scored1 articleApache Kafka: Broker does not enforce JWT issuer and audience validation for SASL/OAUTHBEARER by default
Not scored1 articleApache Kafka: Broker silently skips JWT signature verification for SASL/OAUTHBEARER when the JWKS endpoint URL is not configured
Not scored1 article