Can I work on this and raise a PR ? Hey, sure. @royca If you don't mind I would like to work on this since there has been no PR or any discussion for 12 days
@Haarolean please assign to me this issue if it possible A fix for
CVE-2022-31690
CVE-2022-31692
New dependency [unavailable yet](https://github.com/spring-projects/spring-security/issues/12131), waiting for a spring boot 2.7.6.

Fixes for:
CVE-2022-3171
CVE-2022-36944
GHSA-h4h5-3hr4-j3g2
are unavailable yet, blame/wait for confluent

Snake yaml CVEs:
CVE-2022-25857  
CVE-2022-38749 
CVE-2022-38750 
CVE-2022-38751 
 CVE-2022-38752   

are [false positives](https://github.com/spring-projects/spring-boot/issues/32221).

Others have been fixed within #2926 @Haarolean I could see snakeyaml CVEs are false positive. Is it? I could see the issues created 

Here is an example 
https://bitbucket.org/snakeyaml/snakeyaml/issues/525 and they have been resolved.

So, is it possible to provide snakeyaml version 1.33 in 2.7.x version? @Subrhamanya yes they are according to [this thread](https://github.com/spring-projects/spring-boot/issues/32221).
Anyway, we've bumped some dependencies once again and now we have a newer transitive snakeyaml version. Does that mean 2.7.6 version of spring-boot will have snakeyaml version 1.33? > Does that mean 2.7.6 version of spring-boot will have snakeyaml version 1.33?

AFAIK, yes.
CVEs fixes, October 22
https://github.com/provectus/kafka-ui/actions/runs/3058781951/jobs/4935377778
Bump snakeyaml deps
pom.xml
pom.xml
diff --git a/pom.xml b/pom.xml
index 73d3bfeb3ad..ecb707e1da0 100644
--- a/pom.xml
+++ b/pom.xml
@@ -14,7 +14,7 @@
         <maven.compiler.release>17</maven.compiler.release>
         <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
 
-        <spring-boot.version>2.6.8</spring-boot.version>
+        <spring-boot.version>2.7.5</spring-boot.version>
         <jackson-databind-nullable.version>0.2.2</jackson-databind-nullable.version>
         <org.mapstruct.version>1.4.2.Final</org.mapstruct.version>
         <org.projectlombok.version>1.18.20</org.projectlombok.version>
@@ -33,7 +33,7 @@
         <swagger-annotations.version>1.6.0</swagger-annotations.version>
         <springdoc-openapi-webflux-ui.version>1.2.32</springdoc-openapi-webflux-ui.version>
         <avro.version>1.11.0</avro.version>
-        <confluent.version>7.0.1</confluent.version>
+        <confluent.version>7.3.0</confluent.version>
         <apache.commons.version>2.11.1</apache.commons.version>
         <test.containers.version>1.17.1</test.containers.version>
         <okhttp3.mockwebserver.version>4.10.0</okhttp3.mockwebserver.version>
