CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (2026-10-19 13:10 UTC)

What this means for you

This week: 5,477 CVEs published, 360 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 5,477; Show in the list
Critical, last 7 days: 360; Show in the list
Healthcare-tagged, last 7 days: 5; Show in the list
Known exploited (CISA KEV): 1,747; Show in the list

Showing CVEs that name the product apache:camel. Show all products

58 CVEs, showing 51 to 58PreviousPage 2 of 2

CVE	Severity	Title	Published
CVE-2026-66907	High 7.5	Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result Assigned by apache	Aug 24, 2026
CVE-2026-66908	High 7.5	Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted Assigned by apache	Aug 24, 2026
CVE-2026-63621	Medium 5.3	Apache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy Assigned by apache	Aug 24, 2026
CVE-2026-71300	Critical 9.8	Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection Assigned by apache	Aug 24, 2026
CVE-2026-78329	Critical 9.8	Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes Assigned by apache	Aug 24, 2026
CVE-2026-80352	Critical 9.8	Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects Assigned by apache	Sep 10, 2026
CVE-2026-80351	Critical 9.8	Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod Assigned by apache	Sep 10, 2026
CVE-2026-80354	High 8.1	Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace Assigned by apache	Sep 10, 2026

PreviousPage 2 of 2

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.