MopMonk-AI

Apache Axis2/Java: unbounded JSON request body buffering

Apache Pulsar: Missing authorization on transaction admin endpoints exposes transaction coordinator and transaction statistics of other tenants

Apache Pulsar: Improper authorization of WebSocket consumer dead letter topic allows writes without PRODUCE permission

Apache Pulsar: Missing Topic Authorization on Binary Protocol GetSchema and GetOrCreateSchema Commands

Apache Kylin: tables/names SparkSQL injection

Apache Kylin: unauthenticated broadcast API and polymorphic deserialization

Apache Kylin: Unauthenticated Metastore Cleanup

Apache Kylin: Missing authorization and path-confinement on system meta dump

Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml

Apache CXF: STSTokenValidator can accept untrusted SAML assertions because it shares validation state between requests