# Maven Advisories. Every Maven Advisory we hold (Java · Kotlin), newest first. ## Records, newest first (an older page) - [PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms](https://agentprime.io/advisories/GHSA-j92g-9f8w-j867.md) `GHSA-j92g-9f8w-j867`, `BIT-postgresql-jdbc-driver-2026-54291`, `CVE-2026-54291` · Maven `org.postgresql:postgresql`: affected `>=42.7.4, <42.7.12`, fixed in `42.7.12` · CVSS 8.2 High · Not analysed yet · Published 21 Jul 2026 · Tags: CWE-636, CWE-757 - [AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance](https://agentprime.io/advisories/GHSA-mhww-p97m-3368.md) `GHSA-mhww-p97m-3368`, `CVE-2026-11400` · Maven `software.amazon.jdbc:aws-advanced-jdbc-wrapper`: affected `>=3.0.0, <4.0.1`, fixed in `4.0.1` · CVSS 8.6 High · Not analysed yet · Published 17 Jul 2026 · Tags: CWE-426 - [ArcadeDB has cross-database IDOR: /ts/\*, /batch/\*, Prometheus and Grafana handlers bypass authorization](https://agentprime.io/advisories/GHSA-x8mg-6r4p-87pf.md) `GHSA-x8mg-6r4p-87pf`, `CVE-2026-67342` · Maven `com.arcadedb:arcadedb-server`: affected `<26.7.2`, fixed in `26.7.2` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jul 2026 · Tags: Information disclosure, Broken access control - [ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js](https://agentprime.io/advisories/GHSA-vwjc-v7x7-cm6g.md) `GHSA-vwjc-v7x7-cm6g`, `CVE-2026-67341` · Maven `com.arcadedb:arcadedb-engine`: affected `<26.7.2`, fixed in `26.7.2` · CVSS 9.3 Critical · Critical (CVSS 9+) · Not analysed yet · Published 16 Jul 2026 · Tags: Other injection, Broken access control - [ArcadeDB: Trigger scripts run with java.lang.\* allowed, enabling OS command execution (RCE)](https://agentprime.io/advisories/GHSA-x9f9-r4m8-9xc2.md) `GHSA-x9f9-r4m8-9xc2`, `CVE-2026-67340` · Maven `com.arcadedb:arcadedb-engine`: affected `<26.7.2`, fixed in `26.7.2` · CVSS 8.6 High · Not analysed yet · Published 16 Jul 2026 · Tags: Command injection, Code injection - [ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read](https://agentprime.io/advisories/GHSA-48qw-824m-86pr.md) `GHSA-48qw-824m-86pr`, `CVE-2026-65831` · Maven `com.arcadedb:arcadedb-server`: affected `<26.7.1`, fixed in `26.7.1` · CVSS 7.7 High · Not analysed yet · Published 16 Jul 2026 · Tags: Privilege escalation, Broken access control - [ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)](https://agentprime.io/advisories/GHSA-vg6x-6pg9-6qwg.md) `GHSA-vg6x-6pg9-6qwg`, `CVE-2026-54076` · Maven `com.arcadedb:arcadedb-engine`: affected `<26.6.1`, fixed in `26.6.1` · CVSS 8.1 High · Not analysed yet · Published 16 Jul 2026 · Tags: Broken access control - [ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users](https://agentprime.io/advisories/GHSA-8w86-m9h8-hvqg.md) `GHSA-8w86-m9h8-hvqg`, `CVE-2026-54077` · Maven `com.arcadedb:arcadedb-engine`: affected `<26.6.1`, fixed in `26.6.1` · CVSS 7.1 High · Not analysed yet · Published 16 Jul 2026 · Tags: Path traversal, Denial of service, Server-side request forgery (SSRF) - [dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS](https://agentprime.io/advisories/GHSA-74xj-wh4w-vqxc.md) `GHSA-74xj-wh4w-vqxc`, `CVE-2026-50270` · Maven `com.datadoghq:dd-java-agent`: affected `<1.62.0`, fixed in `1.62.0` · CVSS 7.5 High · Not analysed yet · Published 15 Jul 2026 · Tags: Denial of service - [Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder](https://agentprime.io/advisories/GHSA-vhch-2wf3-m8rp.md) `GHSA-vhch-2wf3-m8rp`, `CVE-2026-44891` · Maven `io.netty:netty-codec-stomp`: affected `>=4.2.0.Alpha1, <4.2.16.Final || <4.1.136.Final`, fixed in `4.2.16.Final`, `4.1.136.Final` · CVSS 7.5 High · Not analysed yet · Published 14 Jul 2026 · Tags: Denial of service - [Apollo ConfigService access key authentication bypass via raw config file appId parsing](https://agentprime.io/advisories/GHSA-h4pc-58cc-hc95.md) `GHSA-h4pc-58cc-hc95`, `CVE-2026-59955` · Maven `com.ctrip.framework.apollo:apollo`: affected `*`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: Authentication bypass, CWE-20 - [Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching](https://agentprime.io/advisories/GHSA-4w3q-qpfq-v992.md) `GHSA-4w3q-qpfq-v992`, `CVE-2026-59954` · Maven `com.ctrip.framework.apollo:apollo`: affected `<=2.0.1`, no fixed version yet · CVSS 7.5 High · Not analysed yet · Published 13 Jul 2026 · Tags: Authentication bypass, CWE-20 - [Apollo Portal: There is a risk of unauthorized access to the Apollo configuration center](https://agentprime.io/advisories/GHSA-jxpj-9j24-w337.md) `GHSA-jxpj-9j24-w337`, `CVE-2025-32781` · Maven `com.ctrip.framework.apollo:apollo`: affected `*`, no fixed version yet · CVSS 6.5 Medium · Not analysed yet · Published 13 Jul 2026 · Tags: Broken access control - [Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization](https://agentprime.io/advisories/GHSA-qv9r-c865-cp47.md) `GHSA-qv9r-c865-cp47`, `CVE-2026-49844` · Maven `org.apache.logging.log4j:log4j-api`: affected `>=2.13.1, <2.25.5 || >=2.26.0, <2.26.1`, fixed in `2.25.5`, `2.26.1` · CVSS 6.3 Medium · Not analysed yet · Published 11 Jul 2026 · Tags: CWE-116 - [org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint](https://agentprime.io/advisories/GHSA-7cmj-v6x8-frvv.md) `GHSA-7cmj-v6x8-frvv`, `CVE-2026-49485` · Maven `ca.uhn.hapi.fhir:org.hl7.fhir.dstu2` and 7 more: affected `>=6.9.5, <6.9.9 || <6.9.4.2`, fixed in `6.9.9`, `6.9.4.2` · CVSS 7.5 High · Not analysed yet · Published 9 Jul 2026 · Tags: Denial of service - [Micronaut: DefaultHttpClient follows redirects, forwarding Authorization, Cookie, and Proxy-Authorization headers](https://agentprime.io/advisories/GHSA-q6gh-6v2r-hjv3.md) `GHSA-q6gh-6v2r-hjv3` · Maven `io.micronaut:micronaut-http-client`: affected `>=1.2.8, <3.10.6 || >=4.0.0-M1, <4.10.24 || >=5.0.0-M1, <5.0.1`, fixed in `3.10.6`, `4.10.24`, `5.0.1` · CVSS 6.8 Medium · Not analysed yet · Published 9 Jul 2026 - [Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoS](https://agentprime.io/advisories/GHSA-387m-935m-c4vw.md) `GHSA-387m-935m-c4vw` · Maven `io.micronaut:micronaut-http-client`: affected `<3.10.7 || >=4.0.0-M1, <4.10.24 || >=5.0.0-M1, <5.0.1`, fixed in `3.10.7`, `4.10.24`, `5.0.1` · CVSS 7.5 High · Not analysed yet · Published 9 Jul 2026 - [NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak](https://agentprime.io/advisories/GHSA-6h3c-r723-7fx3.md) `GHSA-6h3c-r723-7fx3`, `CVE-2026-49464` · Maven `nl.nl-portal:taak`: affected `>=1.5.0, <3.0.1`, fixed in `3.0.1` · CVSS 8.1 High · Not analysed yet · Published 8 Jul 2026 · Tags: Broken access control - [NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries](https://agentprime.io/advisories/GHSA-qpm9-h556-mwxm.md) `GHSA-qpm9-h556-mwxm`, `CVE-2026-49463` · Maven `nl.nl-portal:besluiten` and 1 more: affected `>=1.5.0, <3.0.1`, fixed in `3.0.1` · CVSS 6.5 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Information disclosure, Broken access control - [DSpace: Path Traversal is possible through LDN message generation](https://agentprime.io/advisories/GHSA-9qm4-rh6w-pq5x.md) `GHSA-9qm4-rh6w-pq5x`, `CVE-2026-49833` · Maven `org.dspace:dspace-api`: affected `>=8.0-rc1, <8.4 || >=9.0-rc1, <9.3 || >=10.0-rc1, <10.0`, fixed in `8.4`, `9.3`, `10.0` · CVSS 5.5 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Path traversal - [DSpace: ORE resource URI does not validate scheme for non-web resources](https://agentprime.io/advisories/GHSA-c827-pw3m-67w7.md) `GHSA-c827-pw3m-67w7`, `CVE-2026-49830` · Maven `org.dspace:dspace-api`: affected `<7.6.7 || >=8.0-rc1, <8.4 || >=9.0-rc1, <9.3 || >=10-rc1, <10.0`, fixed in `7.6.7`, `8.4`, `9.3`, `10.0` · CVSS 4.4 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: CWE-20 - [DSpace has a possible Path Traversal Vulnerability in its Curation Task Reporter output path](https://agentprime.io/advisories/GHSA-v66x-68f2-pxf5.md) `GHSA-v66x-68f2-pxf5`, `CVE-2026-49831` · Maven `org.dspace:dspace-api`: affected `<7.6.7 || >=8.0-rc1, <8.4 || >=9.0-rc1, <9.3 || >=10-rc1, <10.0`, fixed in `7.6.7`, `8.4`, `9.3`, `10.0` · CVSS 5.5 Medium · Not analysed yet · Published 8 Jul 2026 · Tags: Path traversal - [DSpace has possible Remote Code Execution (RCE) through Velocity Templates used by LDN](https://agentprime.io/advisories/GHSA-9x82-rm84-c6x7.md) `GHSA-9x82-rm84-c6x7`, `CVE-2026-49832` · Maven `org.dspace:dspace-api`: affected `>=8.0-rc1, <8.4 || >=9.0-rc1, <9.3 || >=10.0-rc1, <10.0`, fixed in `8.4`, `9.3`, `10.0` · CVSS 8.0 High · Not analysed yet · Published 8 Jul 2026 · Tags: Code injection - [XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+](https://agentprime.io/advisories/GHSA-qj4x-9g63-25g6.md) `GHSA-qj4x-9g63-25g6`, `CVE-2026-34151` · Maven `org.xwiki.platform:xwiki-platform-oldcore`: affected `<17.10.5 || >=18.0.0-rc-1, <18.2.0`, fixed in `17.10.5`, `18.2.0` · CVSS 8.2 High · Not analysed yet · Published 7 Jul 2026 · Tags: Path traversal - [OpenRemote has Authenticated SQL Injection via Datapoint Crosstab Export](https://agentprime.io/advisories/GHSA-cgfv-jrfp-2r7v.md) `GHSA-cgfv-jrfp-2r7v`, `CVE-2026-62238`, `CVE-2026-63224` · Maven `io.openremote:openremote-manager`: affected `<1.26.0`, fixed in `1.26.0` · CVSS 7.2 High · Not analysed yet · Published 6 Jul 2026 · Tags: SQL injection - [OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory](https://agentprime.io/advisories/GHSA-7v6w-c3f4-9wpq.md) `GHSA-7v6w-c3f4-9wpq`, `CVE-2026-54640` · Maven `io.openremote:openremote-agent`: affected `<1.24.2`, fixed in `1.24.2` · CVSS 7.6 High · Not analysed yet · Published 6 Jul 2026 · Tags: XML external entities (XXE) - [OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl](https://agentprime.io/advisories/GHSA-xqr9-4wvv-gvch.md) `GHSA-xqr9-4wvv-gvch`, `CVE-2026-54641` · Maven `io.openremote:openremote-manager`: affected `<1.24.2`, fixed in `1.24.2` · CVSS 7.7 High · Not analysed yet · Published 6 Jul 2026 · Tags: Broken access control - [OpenRemote read-only asset users can write predicted datapoints](https://agentprime.io/advisories/GHSA-xj53-j257-hxvg.md) `GHSA-xj53-j257-hxvg`, `CVE-2026-49439` · Maven `io.openremote:openremote-manager`: affected `<1.24.1`, fixed in `1.24.1` · CVSS 4.3 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Broken access control - [Apache Camel-Langchain4j-Tools: Tool argument headers are not filtered against declared parameters](https://agentprime.io/advisories/GHSA-hh8r-75r6-qrg9.md) `GHSA-hh8r-75r6-qrg9`, `CVE-2026-49042` · Maven `org.apache.camel:camel-langchain4j-agent` and 2 more: affected `>=4.8.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.18.3`, `4.21.0` · CVSS 7.3 High · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-20 - [Apache Camel-CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input](https://agentprime.io/advisories/GHSA-5g68-f6xg-vf2r.md) `GHSA-5g68-f6xg-vf2r`, `CVE-2026-46588` · Maven `org.apache.camel:camel-couchdb`: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 7.3 High · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-20 - [Apache Camel-Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input](https://agentprime.io/advisories/GHSA-46jf-c9vx-hh79.md) `GHSA-46jf-c9vx-hh79`, `CVE-2026-46587` · Maven `org.apache.camel:camel-couchbase`: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 7.3 High · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-20 - [Apache Camel-Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body](https://agentprime.io/advisories/GHSA-hjg2-f45w-c566.md) `GHSA-hjg2-f45w-c566`, `CVE-2026-56139` · Maven `org.apache.camel:camel-undertow`: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 5.3 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Information disclosure - [Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy](https://agentprime.io/advisories/GHSA-w2v8-8q6c-3rhr.md) `GHSA-w2v8-8q6c-3rhr`, `CVE-2026-56140` · Maven `org.apache.camel:camel-aws2-sns`: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-20 - [Apache Camel-Atmosphere-Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy](https://agentprime.io/advisories/GHSA-rcvm-6r79-cf4r.md) `GHSA-rcvm-6r79-cf4r`, `CVE-2026-55993` · Maven `org.apache.camel:camel-atmosphere-websocket`: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 7.5 High · Not analysed yet · Published 6 Jul 2026 · Tags: Information disclosure, Server-side request forgery (SSRF), CWE-20 - [Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities](https://agentprime.io/advisories/GHSA-qvc3-6q9x-95pj.md) `GHSA-qvc3-6q9x-95pj`, `CVE-2026-53913` · Maven `org.apache.camel:camel-keycloak`: affected `>=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.18.3`, `4.21.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: Authentication bypass, CWE-636 - [Apache Camel-Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy](https://agentprime.io/advisories/GHSA-pw9q-pq7c-rfqw.md) `GHSA-pw9q-pq7c-rfqw`, `CVE-2026-55994` · Maven `org.apache.camel:camel-iggy`: affected `>=4.17.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.18.3`, `4.21.0` · CVSS 7.5 High · Not analysed yet · Published 6 Jul 2026 · Tags: Information disclosure, Server-side request forgery (SSRF), CWE-20 - [Apache Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.\*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter](https://agentprime.io/advisories/GHSA-mm84-qvjh-hcj7.md) `GHSA-mm84-qvjh-hcj7`, `CVE-2026-49098` · Maven `org.apache.camel:camel-kafka`: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 5.3 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Other injection, CWE-20 - [Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF)](https://agentprime.io/advisories/GHSA-hcm8-x79p-wx2w.md) `GHSA-hcm8-x79p-wx2w`, `CVE-2026-48205` · Maven `org.apache.camel:camel-dns`: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: Server-side request forgery (SSRF), CWE-20 - [Apache Camel-Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter](https://agentprime.io/advisories/GHSA-gcc7-c8mp-34qx.md) `GHSA-gcc7-c8mp-34qx`, `CVE-2026-49099` · Maven `org.apache.camel:camel-salesforce`: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 5.3 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Other injection, Broken access control - [Apache Camel-JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter](https://agentprime.io/advisories/GHSA-64gv-6cq2-45jr.md) `GHSA-64gv-6cq2-45jr`, `CVE-2026-48206` · Maven `org.apache.camel:camel-jira`: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 5.3 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Broken access control, CWE-20 - [Apache Camel-Dapr: The Dapr Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers](https://agentprime.io/advisories/GHSA-583r-f84w-33g7.md) `GHSA-583r-f84w-33g7`, `CVE-2026-49086` · Maven `org.apache.camel:camel-dapr`: affected `>=4.12.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 6.5 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-20, CWE-441 - [Apache Camel-IRC: The irc.sendTo (and other irc.\*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter](https://agentprime.io/advisories/GHSA-463m-2hr2-q2j7.md) `GHSA-463m-2hr2-q2j7`, `CVE-2026-49097` · Maven `org.apache.camel:camel-irc`: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 6.5 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Other injection, CWE-20 - [Apache Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body](https://agentprime.io/advisories/GHSA-42q5-xw42-xf9g.md) `GHSA-42q5-xw42-xf9g`, `CVE-2026-49365` · Maven `org.apache.camel:camel-netty-http`: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 5.3 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Information disclosure - [Apache Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)](https://agentprime.io/advisories/GHSA-q86m-qjpm-vqcw.md) `GHSA-q86m-qjpm-vqcw`, `CVE-2026-46591` · Maven `org.apache.camel:camel-neo4j`: affected `>=4.10.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 8.2 High · Not analysed yet · Published 6 Jul 2026 · Tags: Other injection - [Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation](https://agentprime.io/advisories/GHSA-mrrp-9gjm-749v.md) `GHSA-mrrp-9gjm-749v`, `CVE-2026-46592` · Maven `org.apache.camel:camel-cxf-rest` and 1 more: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 7.5 High · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-20, CWE-441 - [Apache Camel-Vertx-Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy](https://agentprime.io/advisories/GHSA-hgg5-gp4c-gpcg.md) `GHSA-hgg5-gp4c-gpcg`, `CVE-2026-46726` · Maven `org.apache.camel:camel-vertx-websocket`: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 7.5 High · Not analysed yet · Published 6 Jul 2026 · Tags: Information disclosure, Server-side request forgery (SSRF), CWE-20 - [Apache Camel: camel-mongodb-gridfs producer allows GridFS operation override and NoSQL operator injection via unfiltered gridfs.\* HTTP headers](https://agentprime.io/advisories/GHSA-f7g3-2cg6-f5hj.md) `GHSA-f7g3-2cg6-f5hj`, `CVE-2026-48204` · Maven `org.apache.camel:camel-mongodb-gridfs`: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: Broken access control, CWE-20 - [Apache Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers](https://agentprime.io/advisories/GHSA-cmc3-hr79-8mmv.md) `GHSA-cmc3-hr79-8mmv`, `CVE-2026-46456` · Maven `org.apache.camel:camel-aws2-sqs`: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-20 - [Apache Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)](https://agentprime.io/advisories/GHSA-857v-xvh8-7hjc.md) `GHSA-857v-xvh8-7hjc`, `CVE-2026-46590` · Maven `org.apache.camel:camel-pqc`: affected `>=4.18.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.18.3`, `4.21.0` · CVSS 8.8 High · Not analysed yet · Published 6 Jul 2026 · Tags: Insecure deserialization - [Apache Camel-Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP client to inject the full-text search query](https://agentprime.io/advisories/GHSA-566h-v38h-3xp3.md) `GHSA-566h-v38h-3xp3`, `CVE-2026-46585` · Maven `org.apache.camel:camel-lucene`: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 7.5 High · Not analysed yet · Published 6 Jul 2026 · Tags: Broken access control, CWE-20 - [Apache Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields](https://agentprime.io/advisories/GHSA-4h4f-v54q-7pq8.md) `GHSA-4h4f-v54q-7pq8`, `CVE-2026-48203` · Maven `org.apache.camel:camel-solr`: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: Other injection, Server-side request forgery (SSRF), CWE-20 - [Apache Camel-Mail: The mail producer applied attacker-supplied mail.smtp.\* / mail.smtps.\* message headers as JavaMail session properties](https://agentprime.io/advisories/GHSA-29vj-9mgp-mwp2.md) `GHSA-29vj-9mgp-mwp2`, `CVE-2026-46584` · Maven `org.apache.camel:camel-mail`: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 3.7 Low · Not analysed yet · Published 6 Jul 2026 · Tags: Information disclosure, CWE-20 - [Apache Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution](https://agentprime.io/advisories/GHSA-xww8-mxqw-m84w.md) `GHSA-xww8-mxqw-m84w`, `CVE-2026-43865` · Maven `org.apache.camel:camel-hazelcast`: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 8.1 High · Not analysed yet · Published 6 Jul 2026 · Tags: Insecure deserialization - [Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer](https://agentprime.io/advisories/GHSA-rpv3-6645-2vqc.md) `GHSA-rpv3-6645-2vqc`, `CVE-2026-40047` · Maven `org.apache.camel:camel-docling`: affected `>=4.15.0, <4.18.3`, fixed in `4.18.3` · CVSS 9.1 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: Command injection - [Apache Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation](https://agentprime.io/advisories/GHSA-rp9m-hfv5-pfvr.md) `GHSA-rp9m-hfv5-pfvr`, `CVE-2026-46453` · Maven `org.apache.camel:camel-elasticsearch-rest-client`: affected `>=4.3.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 5.3 Medium · Not analysed yet · Published 6 Jul 2026 · Tags: Broken access control, CWE-20 - [Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers](https://agentprime.io/advisories/GHSA-r9cc-j7wr-p329.md) `GHSA-r9cc-j7wr-p329`, `CVE-2026-46454` · Maven `org.apache.camel:camel-cometd`: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-20 - [Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted](https://agentprime.io/advisories/GHSA-mqwc-6qwc-v9gq.md) `GHSA-mqwc-6qwc-v9gq`, `CVE-2026-46455` · Maven `org.apache.camel:camel-keycloak`: affected `>=4.18.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.18.3`, `4.21.0` · CVSS 9.8 Critical · Critical (CVSS 9+) · Not analysed yet · Published 6 Jul 2026 · Tags: Authentication bypass - [Apache Camel JMS deserialization filter bypass](https://agentprime.io/advisories/GHSA-f755-xp6r-8q84.md) `GHSA-f755-xp6r-8q84`, `CVE-2026-43866` · Maven `org.apache.camel:camel-activemq` and 5 more: affected `>=3.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 7.3 High · Not analysed yet · Published 6 Jul 2026 · Tags: Insecure deserialization - [Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.\*\* and enables DNS-based information disclosure](https://agentprime.io/advisories/GHSA-8h6p-jvhf-9hcr.md) `GHSA-8h6p-jvhf-9hcr`, `CVE-2026-42527` · Maven `org.apache.camel:camel-amqp` and 11 more: affected `>=4.14.0, <4.14.8 || >=4.18.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 8.1 High · Not analysed yet · Published 6 Jul 2026 · Tags: Insecure deserialization - [Apache Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers](https://agentprime.io/advisories/GHSA-7v55-q9x3-83cj.md) `GHSA-7v55-q9x3-83cj`, `CVE-2026-46457` · Maven `org.apache.camel:camel-nats`: affected `>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0`, fixed in `4.14.8`, `4.18.3`, `4.21.0` · CVSS 7.5 High · Not analysed yet · Published 6 Jul 2026 · Tags: CWE-20 Newest: Older: ## Filters and formats Filters are query parameters on this URL: `q` (words, as in a web search engine: `"a phrase"`, `OR`, `-word`; an id; a package or product name), `severity` (low, medium, high or critical), `critical=1`, `kev=1`, `ecosystem` (npm, pypi, packagist, go, maven, rubygems, crates, nuget, hex), `kind=package`, `assigner` (a CNA’s short name), `min_score` and `state`. Each record’s title links to its Markdown page. - The same list as JSON: - Every list: , critical: ; by weakness: and the other tags in ; by technology: `/advisories/technology/.md` (`fortinet-fortimail`) --- The web page: . Everything for agents: .