Apache Software Foundation Camel vulnerabilities

• apache software foundation camel Apache Camel: Camel-A2A Push Notification Webhook Guard Accepts IPv6 Unique Local Addresses Reached Through a Host Name CVE-2026-71569 Public exploit 4.8 MediumOctober 29, 2026
• apache software foundation camel Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity… CVE-2026-90885 Public exploit 7.5 HighOctober 26, 2026
• apache software foundation camel Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token Cache CVE-2026-94386 Public exploit 4.8 MediumOctober 26, 2026
• apache camel Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047) CVE-2026-95628 Public exploit 5.4 MediumOctober 26, 2026
• apache camel Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory CVE-2026-95629 Public exploit 5.4 MediumOctober 26, 2026
• apache camel Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry CVE-2026-95663 Public exploit 4.8 MediumOctober 26, 2026
• apache camel Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions CVE-2026-95664 Public exploit 5.4 MediumOctober 26, 2026
• apache camel Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions CVE-2026-101259 Public exploit 5.3 MediumOctober 26, 2026
• apache camel Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution CVE-2026-88900 Public exploit 8.8 HighOctober 19, 2026
• apache software foundation camel Apache Camel: Camel-FOP Resolves External DTDs and Entities From Untrusted XSL-FO Input When a Third-Party JAXP TransformerFactory Is Present CVE-2026-91858 Public exploit 6.5 MediumOctober 19, 2026
• apache software foundation camel Apache Camel: Camel-Smooks XML External Entity Processing, external entities resolved by default CVE-2026-88901 Public exploit 8.2 HighOctober 19, 2026
• apache camel Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache CVE-2026-85317 Public exploit 4.8 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching CVE-2026-85316 Public exploit 4.8 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions CVE-2026-85315 Public exploit 5.3 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584) CVE-2026-85314 Public exploit 6.5 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set CVE-2026-85313 Public exploit 4.3 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header CVE-2026-85312 Public exploit 4.8 MediumOctober 19, 2026
• apache software foundation camel Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions CVE-2026-85300 Public exploit 5.5 MediumOctober 19, 2026
• apache software foundation camel Apache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss Claim CVE-2026-85301 Public exploit 4.8 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State CVE-2026-85296 Public exploit 6.5 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default CVE-2026-85260 Public exploit 5.5 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions CVE-2026-85257 Public exploit 5.3 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name Casing CVE-2026-85254 Public exploit 6.5 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect Targets CVE-2026-85251 Public exploit 7.5 HighOctober 19, 2026
• apache camel Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option CVE-2026-85250 Public exploit 7.5 HighOctober 19, 2026
• apache camel Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata CVE-2026-85249 Public exploit 6.5 MediumOctober 19, 2026
• apache software foundation camel Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance CVE-2026-85248 Public exploit 5.9 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore CVE-2026-85247 Public exploit 5.9 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions CVE-2026-85246 Public exploit 5.3 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target CVE-2026-85245 Public exploit 5.9 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure CVE-2026-85243 Public exploit 5.9 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse CVE-2026-84181 Public exploit 5.9 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions CVE-2026-84180 Public exploit 5.3 MediumOctober 19, 2026
• apache software foundation camel Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow CVE-2026-84178 Public exploit 6.1 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection CVE-2026-84176 Public exploit 6.5 MediumOctober 19, 2026
• apache software foundation camel Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages CVE-2026-83531 Public exploit 8.8 HighOctober 19, 2026
• apache camel Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address CVE-2026-80344 Public exploit 8.2 HighOctober 19, 2026
• apache camel Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching CVE-2026-80343 Public exploit 8.2 HighOctober 19, 2026
• apache software foundation camel Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors CVE-2026-80312 Public exploit 8.2 HighOctober 19, 2026
• apache camel Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing ent… CVE-2026-79986 Public exploit 7.4 HighOctober 19, 2026
• apache software foundation camel Apache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry conta… CVE-2026-79985 Public exploit 7.4 HighOctober 19, 2026
• apache software foundation camel Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry… CVE-2026-79984 Public exploit 7.4 HighOctober 19, 2026
• apache camel Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry conta… CVE-2026-79983 Public exploit 7.4 HighOctober 19, 2026
• apache software foundation camel Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads CVE-2026-78165 Public exploit 8.8 HighOctober 19, 2026
• apache software foundation camel Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers CVE-2026-78164 Public exploit 8.2 HighOctober 19, 2026
• apache software foundation camel Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure CVE-2026-78163 Public exploit 5.9 MediumOctober 19, 2026
• apache camel Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865) CVE-2026-78162 Public exploit 10.0 CriticalOctober 19, 2026
• apache software foundation camel karavan Apache Camel Karavan: unvalidated Kubernetes resources applied from a project's kubernetes.yaml CVE-2026-103413 8.8 HighOctober 9, 2026
• apache software foundation camel karavan Apache Camel Karavan: project file name path traversal when committing a project to Git CVE-2026-103412 8.8 HighOctober 9, 2026
• apache software foundation camel quarkus Apache Camel Quarkus: Camel Quarkus: Forced Xalan TransformerFactory drops upstream external-DTD/stylesheet hardening CVE-2026-88789 Public exploit 8.6 HighOctober 1, 2026
• Show olderLoading…