Latest CVE Vulnerabilities

8.6 HIGH

CVE-2026-4249 — Denial of Service via Malicious JSON Payloads in Throttling Events in Multiple WSO2 Produ…

The throttling event handling mechanism in multiple WSO2 products accepts user-supplied JSON payloads without sufficient validation of their structure and content. This allows an unauthenticated remo…

api_manager api_control_plane traffic_manager universal_gateway | Remote | Denial of Service

Jul 06, 2026 Jul 06, 2026

Jul 06, 2026

8.1 HIGH

CVE-2026-49297 — Apache Airflow Google provider: Path traversal via GCS object names → local/SFTP filesyst…

Apache Airflow's Google provider operators `GCSToSFTPOperator` and `GCSTimeSpanFileTransformOperator` joined GCS object names returned by the bucket listing API directly to a destination filesystem p…

Remote | Path Traversal

Jul 06, 2026 Jul 06, 2026

Jul 06, 2026

7.3 HIGH

CVE-2026-49042 — Apache Camel: langchain4j-tools: filter tool argument headers against declared parameters

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: from 4.8.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to version 4.18.3, …

camel | Remote | Injection

Jul 06, 2026 Jul 06, 2026

Jul 06, 2026

7.3 HIGH

CVE-2026-46588 — Apache Camel: CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy al…

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to…

camel | Remote | Injection

Jul 06, 2026 Jul 06, 2026

Jul 06, 2026

7.3 HIGH

CVE-2026-46587 — Apache Camel: Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy …

Improper Input Validation vulnerability in Apache Camel. This issue affects Apache Camel: through 4.14.7, from 4.15.0 through 4.18.2, from 4.19.0 through 4.20.0. Users are recommended to upgrade to…

camel | Remote | Injection

Jul 06, 2026 Jul 06, 2026

Jul 06, 2026

8.3 HIGH

CVE-2026-44937 — SUSE Rancher Fleet had an Unauthenticated Webhook: Regex Injection via Unsanitized Reposi…

Potential forgery of webhook requests when using a unauthenticated webhook in SUSE Rancher Fleet 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before 0.12.5 could be used by re…

rancher | Remote | Cross-Site Request Forgery

Jul 06, 2026 Jul 06, 2026

Jul 06, 2026

5.0 MEDIUM

CVE-2026-44936 — Rancher Fleet SSRF in Bundle Reader via Unvalidated Helm Repository URL in fleet.yaml

Missing filtering when the helmRepoURLRegex field isn't set on a GitRepo resource in SUSE Rancher Fleet's bundle reader in 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11 and 0.12 before …

rancher | Remote | Information Disclosure

Jul 06, 2026 Jul 06, 2026

Jul 06, 2026

9.3 CRITICAL

CVE-2026-12686 — Incorrect authorisation in Adiss’s Biloop

An authenticated user could manipulate a company ID parameter in a POST request to the backend to gain unauthorised access to other companies hosted within the same subdomain environment. The applica…

Remote | Authorization

Jul 06, 2026 Jul 06, 2026

Jul 06, 2026

6.1 MEDIUM

CVE-2025-8591 — Reflected Cross-Site Scripting via URL Parameter in Multiple WSO2 Products Enables UI Mod…

The software accepts user-supplied input via a URL parameter without adequate output encoding before reflecting it back to the user's browser. This condition allows an attacker to inject malicious sc…

api_manager identity_server identity_server_as_key_manager open_banking_am open_banking_iam api_control_plane +2 more | Remote | Cross-Site Scripting

Jul 06, 2026 Jul 06, 2026

Jul 06, 2026

7.7 HIGH

CVE-2026-9165 — Stackrox: stackrox: unbounded graphql query depth allows authenticated denial of service

A flaw was found in Red Hat Advanced Cluster Security for Kubernetes (RHACS). Central does not limit the depth of GraphQL queries served on the authenticated GraphQL API. An authenticated user with a…

advanced_cluster_security | Remote | Denial of Service

Jul 06, 2026 Jul 06, 2026

Jul 06, 2026

9.8 CRITICAL

CVE-2026-56140 — Apache Camel AWS2 SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStr…

Improper Input Validation vulnerability in Apache Camel AWS SNS component. The camel-aws2-sns component filters Camel headers through a component-specific HeaderFilterStrategy, Sns2HeaderFilterStra…

Remote | Misconfiguration

Jul 06, 2026 Jul 06, 2026

Jul 06, 2026

0.0 NA

CVE-2026-56139 — Apache Camel Undertow: The muteException consumer option defaulted to false, so a process…

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Undertow Component. The camel-undertow HTTP server consumer exposes a muteException option that controls wh…

| Information Disclosure

Jul 06, 2026 Jul 06, 2026

Jul 06, 2026

0.0 NA

CVE-2026-55994 — Apache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-header…

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Iggy component. The camel-iggy consumer map…

| Server-Side Request Forgery

Jul 06, 2026 Jul 06, 2026

Jul 06, 2026

0.0 NA

CVE-2026-55993 — Apache Camel Atmosphere Websocket: The inbound consumer maps externally-supplied WebSocke…

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery (SSRF) vulnerability in Apache Camel in Atmosphere Websocket Component. The camel-a…

| Server-Side Request Forgery

Jul 06, 2026 Jul 06, 2026

Jul 06, 2026

0.0 NA

CVE-2026-53913 — Apache Camel Keycloak: KeycloakSecurityPolicy verifies the bearer access token only insid…

Improper Authentication, Missing Authentication for Critical Function, Not Failing Securely ('Failing Open') vulnerability in Apache Camel Keycloak Component. The KeycloakSecurityPolicy of camel-key…

| Authentication

Jul 06, 2026 Jul 06, 2026

Jul 06, 2026

0.0 NA

CVE-2026-49365 — Apache Camel: Camel-Netty-HTTP: The muteException consumer option defaulted to false, so …

Generation of Error Message Containing Sensitive Information vulnerability in Apache Camel Netty HTTP component. The camel-netty-http HTTP server consumer exposes a muteException option that control…

camel | Information Disclosure

Jul 06, 2026 Jul 06, 2026

Jul 06, 2026

0.0 NA

CVE-2026-49099 — Apache Camel Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP hea…

Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection'), Authorization Bypass Through User-Controlled Key vulnerability in Apache Camel Salesforce Component…

| Injection

Jul 06, 2026 Jul 06, 2026

Jul 06, 2026

0.0 NA

CVE-2026-49098 — Apache Camel: Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header c…

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel Kafka Component. The camel-kafka producer …

camel | Injection

Jul 06, 2026 Jul 06, 2026

Jul 06, 2026

6.5 MEDIUM

CVE-2026-49097 — Apache Camel: Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used …

Improper Input Validation, Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection') vulnerability in Apache Camel IRC component. The camel-irc producer choo…

camel | Remote | Injection

Jul 06, 2026 Jul 06, 2026

Jul 06, 2026

6.5 MEDIUM

CVE-2026-49086 — Apache Camel Dapr: Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topi…

Improper Input Validation, Unintended Proxy or Intermediary ('Confused Deputy') vulnerability in Apache Camel DAPR component. The camel-dapr Dapr Pub/Sub consumer (DaprPubSubConsumer) copied two fie…

Remote | Misconfiguration

Jul 06, 2026 Jul 06, 2026

Jul 06, 2026

Browse by Apps

Latest CVE Feed

Cookie Preferences