CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 11:10 PM ET)

What this means for you

This week: 3,082 CVEs published, 232 critical, and 4 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,082; Show in the list
Critical, last 7 days: 232; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product redhat:amq_streams. Show all products

82 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2026-105941	High 8.1	Kroxylicious-kms-provider-azure-key-vault-kms: streams for apache kafka kroxylicious: azure key vault ssrf exfiltrates bearer token via untrusted edek vaultname Assigned by redhat	Oct 20, 2026
CVE-2026-105949	High 8.8	Cruise-control: streams for apache kafka cruise control: authentication bypass via extra path segment allows unauthenticated access to all admin endpoints Assigned by redhat	Oct 20, 2026
CVE-2026-105312	Critical 9.9	Console-operator: streams for apache kafka console: tenant-controlled container image on clusterrole-bound pod enables namespace-to-cluster privilege escalation Assigned by redhat	Oct 20, 2026
CVE-2026-105311	High 7.7	Console-operator: streams for apache kafka console: cross-namespace kafkauser secret exfiltration via confused deputy Assigned by redhat	Oct 20, 2026
CVE-2026-96740	Medium 6.5	Streamshub/console: console-operator: streams for apache kafka console: unfiltered kafka client properties → sa-token exfiltration via config.providers Assigned by redhat	Sep 28, 2026
CVE-2026-55225	High 8.0	Strimzi: Cross-namespace privilege escalation via `Kafka.spec.entityOperator` Assigned by GitHub_M	Sep 15, 2026
CVE-2026-57915	High 7.3	Apache Kerby: Kerberos Pre-Authentication Bypass Assigned by apache	Jun 26, 2026
CVE-2026-54513	High 8.1	jackson-databind: Array subtype allowlist bypass in BasicPolymorphicTypeValidator (allowIfSubTypeIsArray) Assigned by GitHub_M	Jun 23, 2026
CVE-2026-50559	High 7.5	Authentication/Authorization Bypass via Advanced Path Normalization Vulnerabilities Assigned by GitHub_M	Jun 19, 2026
CVE-2026-50010	High 7.5	Netty's wrapping plain trust manager silently disables hostname verification Assigned by GitHub_M	Jun 12, 2026

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.