GitHub Advisory Database
Security vulnerability database inclusive of CVEs and GitHub originated security advisories from the world of open source software.
Filter advisories
GitHub reviewed advisories
Unreviewed advisories
Malware advisories
23 advisories
Apache InLong: Logged-in user could exploit an arbitrary file read vulnerability
Critical
CVE-2024-26580
was published
for
org.apache.inlong:manager-common
(Maven)
Mar 6, 2024
Apache Pulsar: Pulsar Functions Worker's Archive Extraction Vulnerability Allows Unauthorized File Modification
Critical
CVE-2024-27317
was published
for
org.apache.pulsar:pulsar-functions-worker
(Maven)
Mar 12, 2024
Apache StreamPipes: Use of Cryptographically Weak Pseudo-Random Number Generator (PRNG) in Recovery Token Generation
Critical
CVE-2024-29868
was published
for
org.apache.streampipes:streampipes-resource-management
(Maven)
Jun 24, 2024
Apache Zeppelin remote code execution by adding malicious JDBC connection string
Critical
CVE-2024-31864
was published
for
org.apache.zeppelin:zeppelin-jdbc
(Maven)
Apr 9, 2024
Apache James server: Privilege escalation via JMX pre-authentication deserialization
Critical
CVE-2023-51518
was published
for
org.apache.james:james-server
(Maven)
Feb 27, 2024
Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities
Critical
CVE-2026-53913
was published
for
org.apache.camel:camel-keycloak
(Maven)
Jul 6, 2026
Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF)
Critical
CVE-2026-48205
was published
for
org.apache.camel:camel-dns
(Maven)
Jul 6, 2026
Apache Camel: camel-mongodb-gridfs producer allows GridFS operation override and NoSQL operator injection via unfiltered gridfs.* HTTP headers
Critical
CVE-2026-48204
was published
for
org.apache.camel:camel-mongodb-gridfs
(Maven)
Jul 6, 2026
Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer
Critical
CVE-2026-40047
was published
for
org.apache.camel:camel-docling
(Maven)
Jul 6, 2026
Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy
Critical
CVE-2026-56140
was published
for
org.apache.camel:camel-aws2-sns
(Maven)
Jul 6, 2026
Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage
Critical
CVE-2026-40860
was published
for
org.apache.camel:camel-activemq
(Maven)
Apr 27, 2026
Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter
Critical
CVE-2026-43867
was published
for
org.apache.camel:camel-pqc
(Maven)
Jul 6, 2026
Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers
Critical
CVE-2026-46454
was published
for
org.apache.camel:camel-cometd
(Maven)
Jul 6, 2026
Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted
Critical
CVE-2026-46455
was published
for
org.apache.camel:camel-keycloak
(Maven)
Jul 6, 2026
Apache Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers
Critical
CVE-2026-46456
was published
for
org.apache.camel:camel-aws2-sqs
(Maven)
Jul 6, 2026
Apache Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields
Critical
CVE-2026-48203
was published
for
org.apache.camel:camel-solr
(Maven)
Jul 6, 2026
Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir
Critical
CVE-2026-66906
was published
for
org.apache.camel:camel-azure-storage-blob
(Maven)
Aug 24, 2026
Apache Camel-Atmosphere-Websocket: WebSocket dispatch header injection - the producer selected its target peers through Exchange headers whose names sat outside the filtered Camel namespace
Critical
CVE-2026-71300
was published
for
org.apache.camel:camel-atmosphere-websocket
(Maven)
Aug 24, 2026
Apache Camel-Undertow: the endpoint discarded the undertow-specific header filter strategy in favour of the base HTTP one, so the undertow filtering never ran on endpoint-configured routes
Critical
CVE-2026-78329
was published
for
org.apache.camel:camel-undertow
(Maven)
Aug 24, 2026
Apache Ranger has a Command Injection vulnerability
Critical
CVE-2026-28672
was published
for
org.apache.ranger:ranger
(Maven)
Aug 10, 2026
Apache Tomcat has an Improper Access Control, Incorrect Authorization vulnerability
Critical
CVE-2026-65182
was published
for
org.apache.tomcat.embed:tomcat-embed-core
(Maven)
Aug 26, 2026
Apache Tomcat's DIGEST authenticator has an Authentication Bypass by Capture-replay vulnerability
Critical
CVE-2026-65905
was published
for
org.apache.tomcat.embed:tomcat-embed-core
(Maven)
Aug 26, 2026
Apache Tomcat's FORM authentication process has an Incorrect Authorization vulnerability
Critical
CVE-2026-68525
was published
for
org.apache.tomcat.embed:tomcat-embed-core
(Maven)
Aug 26, 2026
ProTip!
Advisories are also available from the
GraphQL API