High
CVE-2026-46592
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 71,504
High
CVE-2026-46585
Apache Camel-Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP client to inject the full-text search query
Low
CVE-2026-46584
Apache Camel-Mail: The mail producer applied attacker-supplied mail.smtp.* / mail.smtps.* message headers as JavaMail session properties
Critical
CVE-2026-46456
Apache Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers
Critical
CVE-2026-48204
Apache Camel: camel-mongodb-gridfs producer allows GridFS operation override and NoSQL operator injection via unfiltered gridfs.* HTTP headers
High
CVE-2026-40859
Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled
High
CVE-2026-42527
Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure
Critical
CVE-2026-46455
Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted
High
CVE-2026-46457
Apache Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers
High
CVE-2026-43866
Apache Camel JMS deserialization filter bypass
Medium
CVE-2026-46453
Apache Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation
Critical
CVE-2026-46454
Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers
Critical
CVE-2026-43867
Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter
High
CVE-2026-43865
Apache Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution
Critical
CVE-2026-40047
Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer
Medium
CVE-2026-14802
react-dev-utils openBrowser permits command injection on macOS
High
CVE-2026-24012
Uncontrolled Resource Consumption vulnerability in Apache IoTDB.
Critical
CVE-2026-24014
Apache IoTDB DataNode’s internal RPC interface for creating Trigger instances uses the uploaded Trigger JAR name to build a file path without sufficient validation. If the internal DataNode RPC port i
Critical
CVE-2026-24013
Authentication Bypass by Spoofing vulnerability in Apache IoTDB.
High
CVE-2022-37189
MEI2Volpiano is vulnerable to XML External Entity (XXE), leading to a Denial of Service (DoS)
Medium
CVE-2022-2806
sosreport Exposure of Sensitive Information vulnerability
Medium
CVE-2022-1930
Regular expression denial of service in eth-account
High
CVE-2022-23451
Barbican authorization flaw before v14.0.0
Medium
CVE-2022-23452
openstack-barbican Denial of Service vulnerability
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.