Skip to contentApache Software Foundation vulnerabilities
Products
Show 140 moreShow less
Newest
- apache camelApache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action HeaderCVE-2026-85312Public exploit4.8 Medium
- apache software foundation camelApache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File PermissionsCVE-2026-85300Public exploit5.5 Medium
- apache software foundation camelApache Camel: Camel-Keycloak Issuer Validation Bypass When the Introspection Response Omits the iss ClaimCVE-2026-85301Public exploit4.8 Medium
- apache camelApache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request StateCVE-2026-85296Public exploit6.5 Medium
- apache camelApache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by DefaultCVE-2026-85260Public exploit5.5 Medium
- apache camelApache Camel: Camel-CXF Information Disclosure via Unmuted Consumer ExceptionsCVE-2026-85257Public exploit5.3 Medium
- apache camelApache Camel: Camel-Platform-HTTP Request-Header Echo Suppression Bypassed by Header-Name CasingCVE-2026-85254Public exploit6.5 Medium
- apache software foundation johnzonApache Johnzon: ClassConverter loads & static-initializes an attacker-named class from untrusted JSONCVE-2026-712539.8 Critical
- apache camelApache Camel: Camel-HTTP Credential Disclosure to Cross-Host Redirect TargetsCVE-2026-85251Public exploit7.5 High
- apache camelApache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource OptionCVE-2026-85250Public exploit7.5 High
- apache camelApache Camel: Camel-Tika Header Injection via Unfiltered Document MetadataCVE-2026-85249Public exploit6.5 Medium
- apache software foundation camelApache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature InstanceCVE-2026-85248Public exploit5.9 Medium
- apache camelApache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a TruststoreCVE-2026-85247Public exploit5.9 Medium
- apache camelApache Camel: Camel-Mina Information Disclosure via Unmuted Consumer ExceptionsCVE-2026-85246Public exploit5.3 Medium
- apache camelApache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization TargetCVE-2026-85245Public exploit5.9 Medium
- apache camelApache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message StructureCVE-2026-85243Public exploit5.9 Medium
- apache camelApache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject ReuseCVE-2026-84181Public exploit5.9 Medium
- apache camelApache Camel: Camel-Knative Information Disclosure via Unmuted Consumer ExceptionsCVE-2026-84180Public exploit5.3 Medium
- apache software foundation camelApache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code FlowCVE-2026-84178Public exploit6.1 Medium
- apache camelApache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin ReflectionCVE-2026-84176Public exploit6.5 Medium
- apache software foundation camelApache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control MessagesCVE-2026-83531Public exploit8.8 High
- apache camelApache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery AddressCVE-2026-80344Public exploit8.2 High
- apache camelApache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path MatchingCVE-2026-80343Public exploit8.2 High
- apache software foundation camelApache Camel: Camel-OAuth Authentication Bypass via Fail-Open ProcessorsCVE-2026-80312Public exploit8.2 High
- apache camelApache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing ent…CVE-2026-79986Public exploit7.4 High
- apache software foundation camelApache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry conta…CVE-2026-79985Public exploit7.4 High
- apache software foundation camelApache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry…CVE-2026-79984Public exploit7.4 High
- apache camelApache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry conta…CVE-2026-79983Public exploit7.4 High
- apache software foundation camelApache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis PayloadsCVE-2026-78165Public exploit8.8 High
- apache software foundation camelApache Camel: HTTP producers resolve property placeholders in message-supplied URI override headersCVE-2026-78164Public exploit8.2 High
- apache software foundation camelApache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File DisclosureCVE-2026-78163Public exploit5.9 Medium
- apache camelApache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)CVE-2026-78162Public exploit10.0 Critical
- apache software foundation answerApache Answer: Reaction API authorization bypass for restricted contentCVE-2026-909109.8 Critical
- apache software foundation answerApache Answer: User Center integration does not revoke first-login sessions after central account suspensionCVE-2026-865895.4 Medium
- apache software foundation answerApache Answer: Missing Authorization Allows Mutations of Non-Public ContentCVE-2026-796338.1 High
- apache software foundation answerApache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session RevocationCVE-2026-796249.8 Critical
- apache software foundation answerApache Answer: Improper Authorization Allows Disclosure of Non-Public Question MetadataCVE-2026-796204.3 Medium
- apache software foundation answerApache Answer: Disclosure of Comments on Non-Public Content Through Public ProfilesCVE-2026-796135.3 Medium
- apache software foundation answerApache Answer: Exposure of Hidden Question Metadata Through Public Answer ProfilesCVE-2026-769947.5 High
- apache software foundation answerApache Answer: MCP Answer Retrieval Exposes Content from Non-Public QuestionsCVE-2026-715634.3 Medium
- apache software foundation answerApache Answer: Improper Authorization in Question Invite User LookupCVE-2026-684825.3 Medium
- apache software foundation answerApache Answer: Email Code Purpose Confusion May Allow Account TakeoverCVE-2026-672495.4 Medium
- apache software foundation answerApache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questionsCVE-2026-649457.5 High
- apache software foundation answerApache Answer: Stored XSS via unsanitized HTML in imported question contentCVE-2026-649445.4 Medium
- apache software foundation answerApache Answer: API keys logged in plaintext during authenticationCVE-2026-649438.1 High
- apache software foundation kylinApache Kylin: Potential computed-column resource exhaustionCVE-2026-1088377.5 High
- apache software foundation kylinApache Kylin: default startup profile miss security settingsCVE-2026-1088337.5 High
- apache software foundation kylinApache Kylin: Potential unauthenticated job metadata replacementCVE-2026-1088237.5 High
- apache software foundation kylinApache Kylin: Potential JDBC source configuration validation issueCVE-2026-1087806.5 Medium
- apache software foundation kylinApache Kylin: tables/names SparkSQL injectionCVE-2026-1087765.3 Medium
- Show moreLoading…