Critical, CVSS 9.8
Formie Hidden field defaults vulnerable to Server-Side Template Injection
Packagist verbb/formie · Upgrade to 3.1.27 or later · < 3.1.27 · CVE-2026-52889 · GHSA-565m-g33j-jq96
Know what to patch next.
Published open-source security advisories, matched to the exact versions you run.
Run in a terminal
claude mcp add --scope user --transport http patchnext https://mcp.patchnext.com && claude mcp login patchnext
Your browser opens: sign in and choose what the agent may read.
Then ask: What do I need to patch on this machine?
At a glance
- New
- 951 Actionable advisories published in the last 30 days (UTC), within the selected severities, against 1,060 in the 30 days before.
- Critical
- 66 Actionable advisories published in the last 30 days (UTC) and rated CVSS 9.0 or higher, within the selected severities.
Activity · last 26 weeks
Actionable
4101–4125 of 30,927 matching · newest first
- High, CVSS 7.8
Open Babel has out-of-bounds write in MOPAC translationVectors[] (UNIT CELL TRANSLATION)
PyPI openbabel · Upgrade to 3.2.0 or later · < 3.2.0 · CVE-2022-46292 · GHSA-55f6-pf8r-c2f4 · amended
- High, CVSS 7.3
Apache Camel-Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input
Maven org.apache.camel:camel-couchbase · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46587 · GHSA-46jf-c9vx-hh79
- High, CVSS 8.1
Apache Airflow Google provider allows path traversal through GCS object names
PyPI apache-airflow-providers-google · Upgrade to 22.2.1 or later · < 22.2.1 · CVE-2026-49297 · GHSA-v3mh-27qj-w836 · amended
- High, CVSS 7.3
Apache Camel-CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input
Maven org.apache.camel:camel-couchdb · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46588 · GHSA-5g68-f6xg-vf2r
- High, CVSS 7.3
Apache Camel-Langchain4j-Tools: Tool argument headers are not filtered against declared parameters
Maven org.apache.camel:camel-langchain4j-tools +2 · Upgrade all 3 to 4.21.0 or 4.18.3 by release line · >= 4.8.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-49042 · GHSA-hh8r-75r6-qrg9
- Medium, CVSS 5.3
Apache Camel-Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body
Maven org.apache.camel:camel-undertow · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-56139 · GHSA-hjg2-f45w-c566
- Medium, CVSS 5.3
Apache Camel-Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter
Maven org.apache.camel:camel-salesforce · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-49099 · GHSA-gcc7-c8mp-34qx
- Critical, CVSS 9.1
Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF)
Maven org.apache.camel:camel-dns · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-48205 · GHSA-hcm8-x79p-wx2w
- Medium, CVSS 6.5
Apache Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter
Maven org.apache.camel:camel-irc · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-49097 · GHSA-463m-2hr2-q2j7
- Critical, CVSS 9.8
Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities
Maven org.apache.camel:camel-keycloak · Upgrade to 4.21.0 or 4.18.3 by release line · >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-53913 · GHSA-qvc3-6q9x-95pj
- Medium, CVSS 6.5
Apache Camel-Dapr: The Dapr Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers
Maven org.apache.camel:camel-dapr · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.12.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-49086 · GHSA-583r-f84w-33g7
- Medium, CVSS 5.3
Apache Camel-JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter
Maven org.apache.camel:camel-jira · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-48206 · GHSA-64gv-6cq2-45jr
- High, CVSS 7.5
Apache Camel-Atmosphere-Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy
Maven org.apache.camel:camel-atmosphere-websocket · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-55993 · GHSA-rcvm-6r79-cf4r
- Medium, CVSS 5.3
Apache Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter
Maven org.apache.camel:camel-kafka · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-49098 · GHSA-mm84-qvjh-hcj7
- Critical, CVSS 9.8
Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy
Maven org.apache.camel:camel-aws2-sns · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-56140 · GHSA-w2v8-8q6c-3rhr
- High, CVSS 7.5
Apache Camel-Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy
Maven org.apache.camel:camel-iggy · Upgrade to 4.21.0 or 4.18.3 by release line · >= 4.17.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-55994 · GHSA-pw9q-pq7c-rfqw
- Medium, CVSS 5.3
Apache Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body
Maven org.apache.camel:camel-netty-http · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-49365 · GHSA-42q5-xw42-xf9g
- Critical, CVSS 9.1
Apache Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters…
Maven org.apache.camel:camel-solr · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-48203 · GHSA-4h4f-v54q-7pq8
- High, CVSS 8.2
Apache Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation…
Maven org.apache.camel:camel-neo4j · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.10.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46591 · GHSA-q86m-qjpm-vqcw
- Critical, CVSS 9.8
Apache Camel: camel-mongodb-gridfs producer allows GridFS operation override and NoSQL operator injection via unfiltered gridfs.* HTTP headers
Maven org.apache.camel:camel-mongodb-gridfs · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-48204 · GHSA-f7g3-2cg6-f5hj
- High, CVSS 7.5
Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the…
Maven org.apache.camel:camel-cxf-rest +1 · Upgrade all 2 to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46592 · GHSA-mrrp-9gjm-749v
- Low, CVSS 3.7
Apache Camel-Mail: The mail producer applied attacker-supplied mail.smtp.* / mail.smtps.* message headers as JavaMail session properties
Maven org.apache.camel:camel-mail · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46584 · GHSA-29vj-9mgp-mwp2
- Critical, CVSS 9.8
Apache Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers
Maven org.apache.camel:camel-aws2-sqs · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46456 · GHSA-cmc3-hr79-8mmv
- High, CVSS 7.5
Apache Camel-Vertx-Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy
Maven org.apache.camel:camel-vertx-websocket · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46726 · GHSA-hgg5-gp4c-gpcg
A vendor fix does not resolve your finding until you verify it in your own systems.
News
Security reports that are not matched to your stack.
CISA security events · all vendors
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
- NewsExploited · CISA KEV
Advisory watch · no fix evidence
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.
- NewsUnratednpm
Listed as news: the source report lacks affected versions, a fix, or verified evidence.