Where
-Infinity
0

Trending

Last week
Last month
Last year

oss-secCVE-2026-49042: Apache Camel: langchain4j-tools: filter tool argument headers against declad parameters

First published (updated )
https://seclists.org/oss-sec/2026/q3/74

oss-secCVE-2026-46587: Apache Camel: Couchbase: Non-Camel-pfixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input

First published (updated )
https://seclists.org/oss-sec/2026/q3/72

Apache CamelApache Camel, Apache Camel: Camel JMS - CVE-2026-40860 fix bypass via DefaultExchangeHolder

Risk 54
Severity
7.3
First published (updated )
CVE-2026-43866

Apache CamelApache Camel: Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation

Risk 43
Severity
7.5
First published (updated )
CVE-2026-46592

Apache CamelApache Camel: Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)

Risk 54
Severity
8.2
First published (updated )
CVE-2026-46591
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Apache CamelApache Camel: Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation

Risk 27
Severity
5.3
First published (updated )
CVE-2026-46453

Apache CamelApache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure

Risk 75
Severity
8.1
First published (updated )
CVE-2026-42527

Apache CamelApache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body, disclosing sensitive internal information to unauthenticated clients

Risk 30
Severity
5.3
First published (updated )
CVE-2026-49365

Apache CamelApache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter, allowing an HTTP client to influence internal behaviour

Risk 30
Severity
5.3
First published (updated )
CVE-2026-49099

Apache CamelApache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configuration

Risk 90
Severity
9.8
First published (updated )
CVE-2026-48204
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

oss-secCVE-2026-48203: Apache Camel: Camel-Solr: The SolrParam. and SolrField. Exchange header pfixes used non-Camel-pfixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side quest forgery) and document fields

First published (updated )
https://seclists.org/oss-sec/2026/q3/44

oss-secCVE-2026-49365: Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error turned the full Java stack trace in the HTTP sponse body, disclosing sensitive internal information to unauthenticated clients

First published (updated )
https://seclists.org/oss-sec/2026/q3/52

Apache CamelApache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering

Risk 91
Severity
9.8
First published (updated )
CVE-2026-47323

Apache Apache CamelImproperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apac…

Risk 33
Severity
7
First published (updated )
REDHAT-BUG-2463184

Apache Apache CamelJmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, des…

Risk 33
Severity
7
First published (updated )
REDHAT-BUG-2463172
Free Weekly Intel

Don't miss critical vulnerabilities

Join thousands of security professionals who receive our weekly digest of trending CVEs, zero-days, and exploited vulnerabilities.

No spam. Unsubscribe anytime.

Apache CamelApache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp

Risk 92
Severity
9.8
First published (updated )
CVE-2026-40860

Apache CamelApache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection

Risk 88
Severity
9.9
First published (updated )
CVE-2026-40453

Apache CamelApache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)

Risk 81
Severity
9.4
First published (updated )
CVE-2026-33454

Apache CamelApache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store

Risk 84
Severity
8.8
First published (updated )
CVE-2026-27172

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2026 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203