Know what to patch next.

1. Critical, CVSS 9.86 Jul 2026

   Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers

   Maven org.apache.camel:camel-cometd · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46454 · GHSA-r9cc-j7wr-p329

   6 Jul 2026Evidence →
2. High, CVSS 7.56 Jul 2026

   Apache Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control…

   Maven org.apache.camel:camel-nats · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46457 · GHSA-7v55-q9x3-83cj

   6 Jul 2026Evidence →
3. High, CVSS 8.16 Jul 2026

   Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure

   Maven org.apache.camel:camel-leveldb +11 · Upgrade all 12 to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.14.0, < 4.14.8; >= 4.18.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-42527 · GHSA-8h6p-jvhf-9hcr

   6 Jul 2026Evidence →
4. Critical, CVSS 9.86 Jul 2026

   Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted

   Maven org.apache.camel:camel-keycloak · Upgrade to 4.21.0 or 4.18.3 by release line · >= 4.18.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-46455 · GHSA-mqwc-6qwc-v9gq

   6 Jul 2026Evidence →
5. High, CVSS 8.16 Jul 2026

   Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

   Maven org.apache.camel:camel-vertx-http +1 · Upgrade all 2 to 4.20.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.20.0 · CVE-2026-40859 · GHSA-6qw3-4796-5984

   6 Jul 2026Evidence →
6. Critical, CVSS 9.16 Jul 2026

   Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer

   Maven org.apache.camel:camel-docling · Upgrade to 4.18.3 or later · >= 4.15.0, < 4.18.3 · CVE-2026-40047 · GHSA-rpv3-6645-2vqc

   6 Jul 2026Evidence →
7. High, CVSS 8.16 Jul 2026

   Apache Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution

   Maven org.apache.camel:camel-hazelcast · Upgrade to 4.21.0, 4.18.3 or 4.14.8 by release line · >= 4.0.0, < 4.14.8; >= 4.15.0, < 4.18.3; >= 4.19.0, < 4.21.0 · CVE-2026-43865 · GHSA-xww8-mxqw-m84w

   6 Jul 2026Evidence →
8. Critical, CVSS 9.86 Jul 2026

   PYSEC-2026-2081

   PyPI apache-iotdb · Upgrade to 2.0.8 or later · >= 1.3.3, < 2.0.8 · CVE-2026-24014

   6 Jul 2026Evidence →
9. Critical, CVSS 9.16 Jul 2026

   PYSEC-2026-2080

   PyPI apache-iotdb · Upgrade to 2.0.8 or later · >= 1.3.3, < 2.0.8 · CVE-2026-24013

   6 Jul 2026Evidence →
10. High, CVSS 7.56 Jul 2026

    PYSEC-2026-2079

    PyPI apache-iotdb · Upgrade to 2.0.8 or later · >= 1.3.3, < 2.0.8 · CVE-2026-24012

    6 Jul 2026Evidence →
11. Critical, CVSS 9.84 Jul 2026

    PYSEC-2026-2150

    PyPI fickling · Upgrade to 0.1.12 or later · < 0.1.12 · CVE-2026-14535 · GHSA-cffv-grgg-g429

    4 Jul 2026Evidence →
12. High, CVSS 8.84 Jul 2026

    PYSEC-2026-2149

    PyPI fickling · Upgrade to 0.1.11 or later · < 0.1.11 · CVE-2026-14534 · GHSA-m6fh-58r7-x697

    4 Jul 2026Evidence →
13. High, CVSS 7.84 Jul 2026

    NLTK Stanford wrapper classes execute untrusted JAR files without verification

    PyPI nltk · Upgrade to 3.9.4 or later · < 3.9.4 · CVE-2026-12252 · GHSA-9r6g-266r-89x4 · amended

    4 Jul 2026Evidence →
14. High, CVSS 8.83 Jul 2026

    Keras: Lambda deserialization can bypass safe mode and execute code

    PyPI keras · Upgrade to 3.15.0 or 3.12.3 by release line · < 3.12.3; >= 3.13.0, < 3.15.0 · CVE-2026-12481 · GHSA-5gwj-m78q-7pq3 · amended

    3 Jul 2026Evidence →
15. High, CVSS 7.82 Jul 2026

    Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

    PyPI recce · Upgrade to 1.50.0 or later · <= 1.49.0 · CVE-2026-49360 · GHSA-rh62-j648-g5qc · amended

    2 Jul 2026Evidence →
16. High, CVSS 7.52 Jul 2026

    golang.org/x/image/tiff has excessive resource consumption in PackBits decompression

    Go golang.org/x/image · Upgrade to 0.41.0 or later · < 0.41.0 · CVE-2026-46599 · GHSA-q675-qj96-32m9

    2 Jul 2026Evidence →
17. Critical, CVSS 9.82 Jul 2026

    9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass

    npm 9router · Upgrade to 0.4.45 or later · >= 0.2.21, <= 0.4.41 · CVE-2026-49352 · GHSA-jphh-m39h-6gwx · amended

    2 Jul 2026Evidence →
18. High, CVSS 7.12 Jul 2026

    SimpleSAMLphp SP accepts a response from an unexpected IdP when unsigned Response/InResponseTo is combined with a signed assertion lacking SubjectConfirmationData/InResponseTo

    Packagist simplesamlphp/simplesamlphp · Upgrade to 2.5.2 or 2.4.7 by release line · >= 2.5.0, <= 2.5.1; <= 2.4.6 · CVE-2026-49284 · GHSA-q8r6-xj3f-wrrm

    2 Jul 2026Evidence →
19. High, CVSS 8.72 Jul 2026

    Algernon vulnerable to server-side script source disclosure on Windows via NTFS filename

    Go github.com/xyproto/algernon · Upgrade to 1.17.9 or later · <= 1.17.8 · CVE-2026-52792 · GHSA-mm6c-5j6x-hq8m

    2 Jul 2026Evidence →
20. High, CVSS 7.32 Jul 2026

    jxl-grid on 32-bit platforms has an out-of-bounds writes due to integer overflow

    crates.io jxl-grid · Upgrade to 0.6.2 or later · <= 0.6.1 · CVE-2026-52834 · GHSA-5pmv-rx8r-wmv5

    2 Jul 2026Evidence →
21. High, CVSS 7.72 Jul 2026

    Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

    Maven org.keycloak:keycloak-services · Upgrade to 26.5.5; some affected versions have no fix yet · <= 26.2.5; >= 26.3.0, <= 26.4.7; >= 26.5.0, < 26.5.5 · CVE-2026-2092 · GHSA-794g-x443-36f7 · amended

    2 Jul 2026Evidence →
22. Critical, CVSS 9.42 Jul 2026

    fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection

    PyPI fast-mcp-telegram · Upgrade to 0.19.1 or later · <= 0.19.0 · CVE-2026-52830 · GHSA-rxw2-pc8j-vxwm · amended

    2 Jul 2026Evidence →
23. High, CVSS 7.52 Jul 2026

    Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords

    NuGet steeltoe.management.endpoint · Upgrade to 4.2.0 or later · <= 4.1.0 · +1 more package · CVE-2026-50200 · GHSA-q62h-354g-5r85

    2 Jul 2026Evidence →
24. High, CVSS 7.52 Jul 2026

    Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch

    NuGet steeltoe.discovery.eureka · Upgrade to 4.2.0 or 3.4.0 by release line · >= 4.0.0, <= 4.1.0; <= 3.3.0 · CVE-2026-50196 · GHSA-j8ph-6fxj-g533

    2 Jul 2026Evidence →
25. High, CVSS 8.22 Jul 2026

    Steeltoe vulnerable to management-port isolation bypass via spoofed Host header

    NuGet steeltoe.management.endpoint · Upgrade to 4.2.0 or later · <= 4.1.0 · +1 more package · CVE-2026-50194 · GHSA-58f6-6rj2-3v8r

    2 Jul 2026Evidence →

A vendor fix does not resolve your finding until you verify it in your own systems.

News

Security reports that are not matched to your stack.