Know what to patch next.

1. High, CVSS 7.56 Jul 2026

   Apache Camel-Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP client to inject the full-text search…

   Maven org.apache.camel:camel-lucene · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46585 · GHSA-566h-v38h-3xp3

   6 Jul 2026Evidence →
2. High, CVSS 8.86 Jul 2026

   Apache Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete…

   Maven org.apache.camel:camel-pqc · Upgrade to 4.21.0 or 4.18.3 by release line · >= 4.18.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46590 · GHSA-857v-xvh8-7hjc

   6 Jul 2026Evidence →
3. Critical, CVSS 9.86 Jul 2026

   Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter

   Maven org.apache.camel:camel-pqc · Upgrade to 4.21.0 or 4.18.3 by release line · >= 4.18.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-43867 · GHSA-7cmx-qjh8-7v3v

   6 Jul 2026Evidence →
4. High, CVSS 7.36 Jul 2026

   Apache Camel JMS deserialization filter bypass

   Maven org.apache.camel:camel-activemq +5 · Upgrade all 6 to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 3.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-43866 · GHSA-f755-xp6r-8q84

   6 Jul 2026Evidence →
5. Critical, CVSS 9.86 Jul 2026

   Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers

   Maven org.apache.camel:camel-cometd · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46454 · GHSA-r9cc-j7wr-p329

   6 Jul 2026Evidence →
6. High, CVSS 7.56 Jul 2026

   Apache Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control…

   Maven org.apache.camel:camel-nats · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46457 · GHSA-7v55-q9x3-83cj

   6 Jul 2026Evidence →
7. High, CVSS 8.16 Jul 2026

   Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure

   Maven org.apache.camel:camel-leveldb +11 · Upgrade all 12 to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.14.0, < 4.14.8; >= 4.18.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-42527 · GHSA-8h6p-jvhf-9hcr

   6 Jul 2026Evidence →
8. Critical, CVSS 9.86 Jul 2026

   Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted

   Maven org.apache.camel:camel-keycloak · Upgrade to 4.21.0 or 4.18.3 by release line · >= 4.18.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46455 · GHSA-mqwc-6qwc-v9gq

   6 Jul 2026Evidence →
9. Medium, CVSS 5.36 Jul 2026

   Apache Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and…

   Maven org.apache.camel:camel-elasticsearch-rest-client · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.3.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46453 · GHSA-rp9m-hfv5-pfvr

   6 Jul 2026Evidence →
10. High, CVSS 8.16 Jul 2026

    Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

    Maven org.apache.camel:camel-vertx-http +1 · Upgrade all 2 to 4.20.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.20.0 · CVE-2026-40859 · GHSA-6qw3-4796-5984

    6 Jul 2026Evidence →
11. Critical, CVSS 9.16 Jul 2026

    Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer

    Maven org.apache.camel:camel-docling · Upgrade to 4.18.3 or later · >= 4.15.0, < 4.18.3 · CVE-2026-40047 · GHSA-rpv3-6645-2vqc

    6 Jul 2026Evidence →
12. High, CVSS 8.16 Jul 2026

    Apache Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution

    Maven org.apache.camel:camel-hazelcast · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-43865 · GHSA-xww8-mxqw-m84w

    6 Jul 2026Evidence →
13. Critical, CVSS 9.86 Jul 2026

    PYSEC-2026-2081

    PyPI apache-iotdb · Upgrade to 2.0.8 or later · >= 1.3.3, < 2.0.8 · CVE-2026-24014

    6 Jul 2026Evidence →
14. Critical, CVSS 9.16 Jul 2026

    PYSEC-2026-2080

    PyPI apache-iotdb · Upgrade to 2.0.8 or later · >= 1.3.3, < 2.0.8 · CVE-2026-24013

    6 Jul 2026Evidence →
15. High, CVSS 7.56 Jul 2026

    PYSEC-2026-2079

    PyPI apache-iotdb · Upgrade to 2.0.8 or later · >= 1.3.3, < 2.0.8 · CVE-2026-24012

    6 Jul 2026Evidence →
16. Critical, CVSS 9.84 Jul 2026

    PYSEC-2026-2150

    PyPI fickling · Upgrade to 0.1.12 or later · < 0.1.12 · CVE-2026-14535 · GHSA-cffv-grgg-g429

    4 Jul 2026Evidence →
17. High, CVSS 8.84 Jul 2026

    PYSEC-2026-2149

    PyPI fickling · Upgrade to 0.1.11 or later · < 0.1.11 · CVE-2026-14534 · GHSA-m6fh-58r7-x697

    4 Jul 2026Evidence →
18. High, CVSS 7.84 Jul 2026

    NLTK Stanford wrapper classes execute untrusted JAR files without verification

    PyPI nltk · Upgrade to 3.9.4 or later · < 3.9.4 · CVE-2026-12252 · GHSA-9r6g-266r-89x4 · amended

    4 Jul 2026Evidence →
19. High, CVSS 8.83 Jul 2026

    Keras: Lambda deserialization can bypass safe mode and execute code

    PyPI keras · Upgrade to 3.15.0 or 3.12.3 by release line · < 3.12.3; >= 3.13.0, < 3.15.0 · CVE-2026-12481 · GHSA-5gwj-m78q-7pq3 · amended

    3 Jul 2026Evidence →
20. High, CVSS 7.82 Jul 2026

    Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

    PyPI recce · Upgrade to 1.50.0 or later · <= 1.49.0 · CVE-2026-49360 · GHSA-rh62-j648-g5qc · amended

    2 Jul 2026Evidence →
21. High, CVSS 7.52 Jul 2026

    golang.org/x/image/tiff has excessive resource consumption in PackBits decompression

    Go golang.org/x/image · Upgrade to 0.41.0 or later · < 0.41.0 · CVE-2026-46599 · GHSA-q675-qj96-32m9

    2 Jul 2026Evidence →
22. Critical, CVSS 9.82 Jul 2026

    9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass

    npm 9router · Upgrade to 0.4.45 or later · >= 0.2.21, <= 0.4.41 · CVE-2026-49352 · GHSA-jphh-m39h-6gwx · amended

    2 Jul 2026Evidence →
23. High, CVSS 7.12 Jul 2026

    SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned Response/InResponseTo is combined with a signed assertion lacking SubjectConfirmationData/InResponseTo

    Packagist simplesamlphp/simplesamlphp · Upgrade to 2.5.2 or 2.4.7 by release line · >= 2.5.0, <= 2.5.1; <= 2.4.6 · CVE-2026-49284 · GHSA-q8r6-xj3f-wrrm

    2 Jul 2026Evidence →
24. High, CVSS 8.72 Jul 2026

    Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename

    Go github.com/xyproto/algernon · Upgrade to 1.17.9 or later · <= 1.17.8 · CVE-2026-52792 · GHSA-mm6c-5j6x-hq8m

    2 Jul 2026Evidence →
25. High, CVSS 7.32 Jul 2026

    jxl-grid on 32-bit platforms has an out-of-bounds writes due to integer overflow

    crates.io jxl-grid · Upgrade to 0.6.2 or later · <= 0.6.1 · CVE-2026-52834 · GHSA-5pmv-rx8r-wmv5

    2 Jul 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.