Vulnerabilities

TI-2026-79608 CVE-2026-54711

PGHoard writes database passwords to debug log

LOW 11

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores.

CVSS 4.0LOW 2.4 Local High privileges User interaction EPSS 0.00156 Published 2026-10-23 Fixed in 2.7.1 CWE-532

TI-2026-79625 CVE-2026-63120

Path traversal in PGHoard restore allows arbitrary file writes

LOW 39

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores.

CVSS 3.1HIGH 8.4 Network High privileges User interaction EPSS 0.00401 Published 2026-10-23 Fixed in 2.7.2 CWE-22

TI-2026-32927 CVE-2026-45080

Klaw: Improper Access Control Allows Disclosure of Password Hash

LOW 36

Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00249 Published 2026-06-02 Fixed in 2.10.4 CWE-200

TI-2026-32325 CVE-2026-44367

Klaw: user lockout due to case sensitivity inconsistency

LOW 13

Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal.

CVSS 3.1LOW 2.7 Network High privileges No interaction EPSS 0.00236 Published 2026-06-02 Fixed in 2.10.4 CWE-178

TI-2026-28817 CVE-2026-39961 · GHSA-99j8-wv67-4c72

Aiven Operator has cross-namespace secret exfiltration via ClickhouseUser connInfoSecretSource

LOW 30

Aiven Operator allows you to provision and manage Aiven Services from your Kubernetes cluster.

CVSS 3.1MEDIUM 6.8 Network High privileges No interaction EPSS 0.00402 Published 2026-04-09 Fixed in 0.37.0 CWE-269

TI-2026-23307 CVE-2026-29190

Karapace: Path Traversal in Backup Reader

LOW 24

Karapace is an open-source implementation of Kafka REST and Schema Registry.

CVSS 3.1MEDIUM 5.3 Network No auth No interaction EPSS 0.00433 Published 2026-03-07 Fixed in 6.0.0 CWE-22

TI-2026-21013 CVE-2026-25999

Klaw has an improper authorisation check on /resetMemoryCache

LOW 31

Klaw is a self-service Apache Kafka Topic Management/Governance tool/portal.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00314 Published 2026-02-11 Fixed in 2.10.2 CWE-285

TI-2026-18953 CVE-2026-23529

Arbitrary File Read in Google BigQuery Sink connector

LOW 34

Kafka Connect BigQuery Connector is an implementation of a sink connector from Apache Kafka to Google BigQuery.

CVSS 3.1HIGH 7.7 Network Low privileges No interaction EPSS 0.00408 Published 2026-01-16 Fixed in 2.11.0 CWE-73

TI-2025-41441 CVE-2025-67745

Myhoard logs backup encryption key in plain text

LOW 32

MyHoard is a daemon for creating, managing and restoring MySQL backups.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00157 Published 2025-12-18 Fixed in 1.3.0 CWE-402

TI-2025-38105 CVE-2025-61673

Karapace is vulnerable to Authentication Bypass

MEDIUM 43

Karapace is an open-source implementation of Kafka REST and Schema Registry.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.00394 Published 2025-10-03 Fixed in 5.0.2 CWE-288

TI-2025-34940 CVE-2025-55283

aiven-db-migrate allows Privilege Escalation through use of psql during migration

MEDIUM 42

aiven-db-migrate is an Aiven database migration tool.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00616 Published 2025-08-18 Fixed in 1.0.7 CWE-77

TI-2025-34939 CVE-2025-55282

aiven-db-migrate allows Privilege Escalation via unrestricted search_path during migration

MEDIUM 40

aiven-db-migrate is an Aiven database migration tool.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00723 Published 2025-08-18 Fixed in 1.0.7 CWE-22

TI-2025-22661 CVE-2025-31480

aiven-extras allows PostgreSQL Privilege Escalation through format function

MEDIUM 42

aiven-extras is a PostgreSQL extension.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00496 Published 2025-04-04 Fixed in 1.1.16 CWE-426

TI-2024-37135 CVE-2024-56142 · GHSA-m9hc-vxjj-4x6q

Path Traversal in pghoard

LOW 22

pghoard is a PostgreSQL backup daemon and restore tooling that stores backup data in cloud object stores.

CVSS 4.0MEDIUM 4.8 Local Low privileges No interaction EPSS 0.00412 Published 2024-12-17 Fixed in 2.6.1-rc CWE-22

TI-2023-28045 CVE-2023-51390

Information Disclosure Vulnerability in Journalpump

LOW 33

journalpump is a daemon that takes log messages from journald and pumps them to a given output.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00276 Published 2023-12-20 Fixed in 2.5.0 CWE-215

TI-2023-15599 CVE-2023-32305

aiven-extras PostgreSQL Privilege Escalation Through Overloaded Search Path

LOW 39

aiven-extras is a PostgreSQL extension.

CVSS 3.1HIGH 8.8 Local Low privileges No interaction EPSS 0.00727 Published 2023-05-12 Fixed in 1.1.9 CWE-1321

Vulnerabilities

Filters