[Git][security-tracker-team/security-tracker][master] new kafka issues

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
4de0997d by Moritz Muehlenhoff at 2026-10-28T20:38:33+01:00
new kafka issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -87,7 +87,7 @@ CVE-2026-85655 (The Enable Media Replace plugin for WordPress is vulnerable to a
 CVE-2026-84725 (when EAP runs with -secmgr, the openjdk-orb's JDKBridge honours attack ...)
 	TODO: check
 CVE-2026-83525 (Incorrect operator (CWE-480) in the FetchSnapshot RPC handler in Apach ...)
-	TODO: check
+	- kafka <itp> (bug #786460)
 CVE-2026-82962 (ethernet_fill_header() in subsys/net/l2/ethernet/ethernet.c can prepen ...)
 	NOT-FOR-US: Zephyr, different from src:zephyr
 CVE-2026-82961 (The GPIO syscall handlers in drivers/gpio/gpio_handlers.c did not vali ...)
@@ -687,7 +687,7 @@ CVE-2026-116778 (FOG is a free open-source cloning/imaging/rescue suite/inventor
 CVE-2026-116776 (USB Test is a lightweight Windows CLI utility for verifying sector int ...)
 	TODO: check
 CVE-2026-116593 (Apache Kafka Connect has the /connector-plugins/{connector-type}/confi ...)
-	TODO: check
+	- kafka <itp> (bug #786460)
 CVE-2026-116404 (Missing Authorization vulnerability in David Anderson Redux Framework  ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-116393 (Missing Authorization vulnerability in iHomefinder, Inc. Optima Expres ...)
@@ -709,7 +709,7 @@ CVE-2026-115957 (Improper Neutralization of Input During Web Page Generation ('C
 CVE-2026-115904 (Topluyo is a social networking platform. A vulnerability exists in Top ...)
 	TODO: check
 CVE-2026-115644 (Apache Kafka Connect contains an authentication bypass vulnerability a ...)
-	TODO: check
+	- kafka <itp> (bug #786460)
 CVE-2026-115612 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-115609 (Improper Neutralization of Input During Web Page Generation ('Cross-si ...)
@@ -737,7 +737,7 @@ CVE-2026-114349 (When a broker decodes a compressed record batch, the per-record
 CVE-2026-114278 (The che-machine-exec service constructs a shell command by concatenati ...)
 	NOT-FOR-US: Eclipse
 CVE-2026-112375 (An authenticated Kafka principal with no authorization grants (not eve ...)
-	TODO: check
+	- kafka <itp> (bug #786460)
 CVE-2026-112357 (GFI KerioConnect (Kerio Connect) Outlook Connector (Offline Edition),  ...)
 	TODO: check
 CVE-2026-112356 (GFI KerioConnect (Kerio Connect) before 10.0.9 Patch 2 contains a cros ...)
@@ -749,21 +749,21 @@ CVE-2026-112197 (Vulnerability due to a lack of authentication in critical funct
 CVE-2026-111850 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-111551 (Several Kafka deserialization paths read a size or count field from in ...)
-	TODO: check
+	- kafka <itp> (bug #786460)
 CVE-2026-111496 (Kafka Streams derives its stream-time clock from record timestamps. Pu ...)
-	TODO: check
+	- kafka <itp> (bug #786460)
 CVE-2026-111411 (Improper Neutralization of Special Elements used in an SQL Command ('S ...)
 	NOT-FOR-US: WordPress plugin or theme
 CVE-2026-111115 (Apache Kafka's code-generated readers for flexible protocol versions r ...)
-	TODO: check
+	- kafka <itp> (bug #786460)
 CVE-2026-111108 (Apache Kafka's code-generated protocol readers pre-size an array's col ...)
-	TODO: check
+	- kafka <itp> (bug #786460)
 CVE-2026-111073 (The broker-side PushTelemetry API (KIP-714) validates only the compres ...)
-	TODO: check
+	- kafka <itp> (bug #786460)
 CVE-2026-110985 (A Kafka broker using SASL/OAUTHBEARER with the default validator(sasl. ...)
-	TODO: check
+	- kafka <itp> (bug #786460)
 CVE-2026-110952 (A Kafka broker that authenticates clients with SASL/OAUTHBEARER using  ...)
-	TODO: check
+	- kafka <itp> (bug #786460)
 CVE-2026-110541 (Dell PowerProtect Data Domain, Feature Release versions 7.7.1.0 throug ...)
 	NOT-FOR-US: Dell / EMC
 CVE-2026-110540 (Dell PowerProtect Data Domain Management Center, Feature Release versi ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4de0997d7afb7d2adeea0c51ac548d7b628ae91f

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/4de0997d7afb7d2adeea0c51ac548d7b628ae91f
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20261028/38cfd734/attachment.htm>