Know what to patch next.

1. Critical, CVSS 9.26 Jul 2026

   Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access

   Go github.com/cilium/cilium · Upgrade to 1.19.2, 1.18.8 or 1.17.14 by release line · >= 1.19.0, < 1.19.2; >= 1.18.0, < 1.18.8; < 1.17.14 · CVE-2026-49445 · GHSA-3fcv-jvfp-m4q9

   6 Jul 2026Evidence →
2. Critical, CVSS 9.86 Jul 2026

   Formie Hidden field defaults vulnerable to Server-Side Template Injection

   Packagist verbb/formie · Upgrade to 3.1.27 or later · < 3.1.27 · CVE-2026-52889 · GHSA-565m-g33j-jq96

   6 Jul 2026Evidence →
3. High, CVSS 7.86 Jul 2026

   Open Babel has out-of-bounds write in MOPAC translationVectors[] (UNIT CELL TRANSLATION)

   PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-46292 · GHSA-55f6-pf8r-c2f4 · amended

   6 Jul 2026Evidence →
4. High, CVSS 7.36 Jul 2026

   Apache Camel-Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input

   Maven org.apache.camel:camel-couchbase · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46587 · GHSA-46jf-c9vx-hh79

   6 Jul 2026Evidence →
5. High, CVSS 8.16 Jul 2026

   Apache Airflow Google provider allows path traversal through GCS object names

   PyPI apache-airflow-providers-google · Upgrade to 22.2.1 or later · < 22.2.1 · CVE-2026-49297 · GHSA-v3mh-27qj-w836 · amended

   6 Jul 2026Evidence →
6. High, CVSS 7.36 Jul 2026

   Apache Camel-CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input

   Maven org.apache.camel:camel-couchdb · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46588 · GHSA-5g68-f6xg-vf2r

   6 Jul 2026Evidence →
7. High, CVSS 7.36 Jul 2026

   Apache Camel-Langchain4j-Tools: Tool argument headers are not filtered against declared parameters

   Maven org.apache.camel:camel-langchain4j-tools +2 · Upgrade all 3 to 4.21.0 or 4.18.3 by release line · >= 4.8.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-49042 · GHSA-hh8r-75r6-qrg9

   6 Jul 2026Evidence →
8. Critical, CVSS 9.16 Jul 2026

   Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF)

   Maven org.apache.camel:camel-dns · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-48205 · GHSA-hcm8-x79p-wx2w

   6 Jul 2026Evidence →
9. Critical, CVSS 9.86 Jul 2026

   Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities

   Maven org.apache.camel:camel-keycloak · Upgrade to 4.21.0 or 4.18.3 by release line · >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-53913 · GHSA-qvc3-6q9x-95pj

   6 Jul 2026Evidence →
10. High, CVSS 7.56 Jul 2026

    Apache Camel-Atmosphere-Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy

    Maven org.apache.camel:camel-atmosphere-websocket · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-55993 · GHSA-rcvm-6r79-cf4r

    6 Jul 2026Evidence →
11. Critical, CVSS 9.86 Jul 2026

    Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy

    Maven org.apache.camel:camel-aws2-sns · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-56140 · GHSA-w2v8-8q6c-3rhr

    6 Jul 2026Evidence →
12. High, CVSS 7.56 Jul 2026

    Apache Camel-Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy

    Maven org.apache.camel:camel-iggy · Upgrade to 4.21.0 or 4.18.3 by release line · >= 4.17.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-55994 · GHSA-pw9q-pq7c-rfqw

    6 Jul 2026Evidence →
13. Critical, CVSS 9.16 Jul 2026

    Apache Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters…

    Maven org.apache.camel:camel-solr · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-48203 · GHSA-4h4f-v54q-7pq8

    6 Jul 2026Evidence →
14. High, CVSS 8.26 Jul 2026

    Apache Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation…

    Maven org.apache.camel:camel-neo4j · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.10.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46591 · GHSA-q86m-qjpm-vqcw

    6 Jul 2026Evidence →
15. Critical, CVSS 9.86 Jul 2026

    Apache Camel: camel-mongodb-gridfs producer allows GridFS operation override and NoSQL operator injection via unfiltered gridfs.* HTTP headers

    Maven org.apache.camel:camel-mongodb-gridfs · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-48204 · GHSA-f7g3-2cg6-f5hj

    6 Jul 2026Evidence →
16. High, CVSS 7.56 Jul 2026

    Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the…

    Maven org.apache.camel:camel-cxf-rest +1 · Upgrade all 2 to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46592 · GHSA-mrrp-9gjm-749v

    6 Jul 2026Evidence →
17. Critical, CVSS 9.86 Jul 2026

    Apache Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers

    Maven org.apache.camel:camel-aws2-sqs · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46456 · GHSA-cmc3-hr79-8mmv

    6 Jul 2026Evidence →
18. High, CVSS 7.56 Jul 2026

    Apache Camel-Vertx-Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy

    Maven org.apache.camel:camel-vertx-websocket · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46726 · GHSA-hgg5-gp4c-gpcg

    6 Jul 2026Evidence →
19. High, CVSS 7.56 Jul 2026

    Apache Camel-Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP client to inject the full-text search…

    Maven org.apache.camel:camel-lucene · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46585 · GHSA-566h-v38h-3xp3

    6 Jul 2026Evidence →
20. High, CVSS 8.86 Jul 2026

    Apache Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete…

    Maven org.apache.camel:camel-pqc · Upgrade to 4.21.0 or 4.18.3 by release line · >= 4.18.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46590 · GHSA-857v-xvh8-7hjc

    6 Jul 2026Evidence →
21. Critical, CVSS 9.86 Jul 2026

    Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter

    Maven org.apache.camel:camel-pqc · Upgrade to 4.21.0 or 4.18.3 by release line · >= 4.18.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-43867 · GHSA-7cmx-qjh8-7v3v

    6 Jul 2026Evidence →
22. High, CVSS 7.36 Jul 2026

    Apache Camel JMS deserialization filter bypass

    Maven org.apache.camel:camel-activemq +5 · Upgrade all 6 to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 3.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-43866 · GHSA-f755-xp6r-8q84

    6 Jul 2026Evidence →
23. Critical, CVSS 9.86 Jul 2026

    Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers

    Maven org.apache.camel:camel-cometd · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46454 · GHSA-r9cc-j7wr-p329

    6 Jul 2026Evidence →
24. High, CVSS 7.56 Jul 2026

    Apache Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control…

    Maven org.apache.camel:camel-nats · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46457 · GHSA-7v55-q9x3-83cj

    6 Jul 2026Evidence →
25. High, CVSS 8.16 Jul 2026

    Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure

    Maven org.apache.camel:camel-leveldb +11 · Upgrade all 12 to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.14.0, < 4.14.8; >= 4.18.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-42527 · GHSA-8h6p-jvhf-9hcr

    6 Jul 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.