CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago ()

What this means for you

This week: 5,501 CVEs published, 358 critical, and 7 newly confirmed exploited. Add your stack to see whether any of them hit you.

Published in the last 7 days
5,501
Show in the list
Critical, last 7 days
358
Show in the list
Healthcare-tagged, last 7 days
5
Show in the list
Known exploited (CISA KEV)
1,747
Show in the list

Showing CVEs that name the product apache:camel. Show all products

58 CVEs, showing 1 to 50Page 1 of 2Next
CVESeverityTitlePublished
CVE-2026-80354High 8.1Apache Camel K: Camel K Builder trait mavenProfiles ValueSources resolve tenant-named secrets in operator namespace
Assigned by apache
Sep 10, 2026
CVE-2026-80351Critical 9.8Apache Camel K: Camel K Tenant repositories reach Maven execution inside operator pod
Assigned by apache
Sep 10, 2026
CVE-2026-80352Critical 9.8Apache Camel K: Camel K Master trait serviceAccountName YAML injection lets CR author apply arbitrary objects
Assigned by apache
Sep 10, 2026
CVE-2026-78329Critical 9.8Apache Camel: Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes
Assigned by apache
Aug 24, 2026
CVE-2026-71300Critical 9.8Apache Camel: Camel-Atmosphere-Websocket: WebSocket dispatch header injection
Assigned by apache
Aug 24, 2026
CVE-2026-63621Medium 5.3Apache Camel: Camel-Knative: CloudEvent extension fields received in structured content mode were mapped onto message headers without applying any header filter strategy
Assigned by apache
Aug 24, 2026
CVE-2026-66908High 7.5Apache Camel: Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted
Assigned by apache
Aug 24, 2026
CVE-2026-66907High 7.5Apache Camel: Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result
Assigned by apache
Aug 24, 2026
CVE-2026-66906Critical 9.1Apache Camel: Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir
Assigned by apache
Aug 24, 2026
CVE-2026-60093Medium 5.5Apache Camel: Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir
Assigned by apache
Aug 24, 2026
CVE-2026-59230Medium 6.5Apache Camel: Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled
Assigned by apache
Aug 24, 2026
CVE-2026-49042High 7.3Improper Input Validation vulnerability in Apache Camel.Jul 6, 2026
CVE-2026-46588High 7.3Improper Input Validation vulnerability in Apache Camel.Jul 6, 2026
CVE-2026-46587High 7.3Improper Input Validation vulnerability in Apache Camel.Jul 6, 2026
CVE-2026-56140Critical 9.8Improper Input Validation vulnerability in Apache Camel AWS SNS component.Jul 6, 2026
CVE-2026-56139Medium 5.3Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Undertow Component.Jul 6, 2026
CVE-2026-55994High 7.5Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Iggy component.Jul 6, 2026
CVE-2026-55993High 7.5Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Atmosphere Websocket Component.Jul 6, 2026
CVE-2026-53913Critical 9.8Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel Keycloak Component.Jul 6, 2026
CVE-2026-49365Medium 5.3Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty HTTP component.Jul 6, 2026
CVE-2026-49099Medium 5.3Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component.Jul 6, 2026
CVE-2026-49098Medium 5.3Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Kafka Component.Jul 6, 2026
CVE-2026-49097Medium 6.5Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel IRC component.Jul 6, 2026
CVE-2026-49086Medium 6.5Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel DAPR component.Jul 6, 2026
CVE-2026-48206Medium 5.3Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel JIRA component.Jul 6, 2026
CVE-2026-48205Critical 9.1Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel DNS component.Jul 6, 2026
CVE-2026-48204Critical 9.8Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component.Jul 6, 2026
CVE-2026-48203Critical 9.1Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Improper Input Validation, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel Solr co…Jul 6, 2026
CVE-2026-46726High 7.5Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Vertx Websocket component.Jul 6, 2026
CVE-2026-46592High 7.5Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel CXF SOAP component.Jul 6, 2026
CVE-2026-46591High 8.2Improper Neutralization of Special Elements in Data Query Logic vulnerability in Apache Camel Neo4J component.Jul 6, 2026
CVE-2026-46590High 8.8Deserialization of Untrusted Data vulnerability in Apache Camel PQC component.Jul 6, 2026
CVE-2026-46585High 7.5Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Lucene Component.Jul 6, 2026
CVE-2026-46584Low 3.7Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor vulnerability in Apache Camel Mail Component.Jul 6, 2026
CVE-2026-46457High 7.5Improper Input Validation vulnerability in Apache Camel NATS component.Jul 6, 2026
CVE-2026-46456Critical 9.8Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component.Jul 6, 2026
CVE-2026-46455Critical 9.8Insufficient Session Expiration vulnerability in Apache Camel Keycloak Component.Jul 6, 2026
CVE-2026-46454Critical 9.8Improper Input Validation vulnerability in Apache Camel Cometd Component.Jul 6, 2026
CVE-2026-46453Medium 5.3Improper Input Validation, Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel ElasticSearch Rest Client.Jul 6, 2026
CVE-2026-43867Critical 9.8Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component.Jul 6, 2026
CVE-2026-43866High 7.3Deserialization of Untrusted Data vulnerability in Apache Camel, Apache Camel JMS component.Jul 6, 2026
CVE-2026-43865High 8.1Deserialization of Untrusted Data vulnerability in Apache Camel Hazelcast component.Jul 6, 2026
CVE-2026-42527High 8.1Deserialization of Untrusted Data vulnerability in Apache Camel.Jul 6, 2026
CVE-2026-40859High 8.1Deserialization of Untrusted Data vulnerability in Apache Camel.Jul 6, 2026
CVE-2026-40047Critical 9.1Improper Neutralization of Argument Delimiters in a Command ('Argument Injection') vulnerability in Apache Camel Docling component.Jul 6, 2026
CVE-2026-47323Critical 9.8Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilterStrategy implementations (CxfRsHeaderFilterStrategy in camel-cxf-rest, CxfHeaderFilt…May 19, 2026
CVE-2026-33453Critical 10.0Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component.Apr 27, 2026
CVE-2026-27172High 8.8The ConsulRegistry in the camel-consul component (class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method) read Java-serialized values from the Con…Apr 27, 2026
CVE-2026-40858High 8.8The camel-infinispan component's ProtoStream-based remote aggregation repository deserializes data read from a remote Infinispan cache using java.io.ObjectInputStream without applying any ObjectInput…Apr 27, 2026
CVE-2026-40022High 8.2When authentication is enabled on the Apache Camel embedded HTTP server or embedded management server (camel-platform-http-main) and a non-root context path such as /api or /admin is configured via c…Apr 27, 2026
Page 1 of 2Next

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.

Your cookie choices
We use essential cookies to run this site, and, only with your consent, an advertising cookie from Google to measure whether our ads lead to sign-ups and subscriptions. See our for details.