Maven Advisories.

PostgreSQL JDBC Driver: Silent channel-binding authentication downgrade via unsupported certificate algorithms

• CWE-636
• CWE-757

>=42.7.4, <42.7.12 · fixed in 42.7.12

AWS-JDBC Wrapper: Privilege Escalation in Aurora PostgreSQL instance

• CWE-426

>=3.0.0, <4.0.1 · fixed in 4.0.1

ArcadeDB has cross-database IDOR: /ts/*, /batch/*, Prometheus and Grafana handlers bypass authorization

• Information disclosure
• Broken access control

<26.7.2 · fixed in 26.7.2

ArcadeDB: Scripting authorization gate (GHSA-48qw-824m-86pr) bypassed via SQL DEFINE FUNCTION ... LANGUAGE js

• Other injection
• Broken access control

<26.7.2 · fixed in 26.7.2

ArcadeDB: Trigger scripts run with java.lang.* allowed, enabling OS command execution (RCE)

• Command injection
• Code injection

<26.7.2 · fixed in 26.7.2

ArcadeDB: Privilege escalation via reader role in /api/v1/command JS scripting language — arbitrary host file read

• Privilege escalation
• Broken access control

<26.7.1 · fixed in 26.7.1

ArcadeDB: Read-only users can mutate database schema (incomplete fix of CVE-2026-44221)

• Broken access control

<26.6.1 · fixed in 26.6.1

ArcadeDB: IMPORT DATABASE allows SSRF and arbitrary local file read by authenticated users

• Path traversal
• Denial of service

<26.6.1 · fixed in 26.6.1

dd-trace-java: Improper parsing of W3C baggage headers may lead to DoS

• Denial of service

<1.62.0 · fixed in 1.62.0

Netty: Denial of Service via Unbounded Headers in StompSubframeDecoder

• Denial of service

>=4.2.0.Alpha1, <4.2.16.Final || <4.1.136.Final · fixed in 4.2.16.Final, 4.1.136.Final

Apollo ConfigService access key authentication bypass via raw config file appId parsing

• Authentication bypass
• CWE-20

* · no fixed version yet

Apollo ConfigService access key authentication bypass via appId parsing and non-canonical matching

• Authentication bypass
• CWE-20

<=2.0.1 · no fixed version yet

Apollo Portal: There is a risk of unauthorized access to the Apollo configuration center

• Broken access control

* · no fixed version yet

Apache Log4j API: Improper encoding of non-finite floating-point values during MapMessage JSON serialization

• CWE-116

>=2.13.1, <2.25.5 || >=2.26.0, <2.26.1 · fixed in 2.25.5, 2.26.1

org.hl7.fhir.core: ReDoS via FHIRPath matches()/replaceMatches() in FHIR Validator HTTP Endpoint

• Denial of service

>=6.9.5, <6.9.9 || <6.9.4.2 · fixed in 6.9.9, 6.9.4.2

Micronaut: DefaultHttpClient follows redirects, forwarding Authorization, Cookie, and Proxy-Authorization headers

>=1.2.8, <3.10.6 || >=4.0.0-M1, <4.10.24 || >=5.0.0-M1, <5.0.1 · fixed in 3.10.6, 4.10.24, 5.0.1

Micronaut doesn't set a maximum redirect count for its HTTP Client, enabling infinite loop DoS

<3.10.7 || >=4.0.0-M1, <4.10.24 || >=5.0.0-M1, <5.0.1 · fixed in 3.10.7, 4.10.24, 5.0.1

NL Portal: IDOR allows any authenticated user to complete and tamper with another user's taak

• Broken access control

>=1.5.0, <3.0.1 · fixed in 3.0.1

NL Portal: Missing per-user authorization on document and decision GraphQL queries in nl-portal-backend-libraries

• Information disclosure
• Broken access control

>=1.5.0, <3.0.1 · fixed in 3.0.1

DSpace: Path Traversal is possible through LDN message generation

• Path traversal

>=8.0-rc1, <8.4 || >=9.0-rc1, <9.3 || >=10.0-rc1, <10.0 · fixed in 8.4, 9.3, 10.0

DSpace: ORE resource URI does not validate scheme for non-web resources

• CWE-20

<7.6.7 || >=8.0-rc1, <8.4 || >=9.0-rc1, <9.3 || >=10-rc1, <10.0 · fixed in 7.6.7, 8.4, 9.3, 10.0

DSpace has a possible Path Traversal Vulnerability in its Curation Task Reporter output path

• Path traversal

<7.6.7 || >=8.0-rc1, <8.4 || >=9.0-rc1, <9.3 || >=10-rc1, <10.0 · fixed in 7.6.7, 8.4, 9.3, 10.0

DSpace has possible Remote Code Execution (RCE) through Velocity Templates used by LDN

• Code injection

>=8.0-rc1, <8.4 || >=9.0-rc1, <9.3 || >=10.0-rc1, <10.0 · fixed in 8.4, 9.3, 10.0

XWiki Platform Old Core: Resource path traversal via /skin/ action endpoint in Jetty 12+

• Path traversal

<17.10.5 || >=18.0.0-rc-1, <18.2.0 · fixed in 17.10.5, 18.2.0

OpenRemote has Authenticated SQL Injection via Datapoint Crosstab Export

• SQL injection

<1.26.0 · fixed in 1.26.0

OpenRemote has an incomplete fix for CVE-2026-40882: XXE in KNXProtocol.startAssetImport() allows arbitrary file read via unprotected XMLInputFactory

• XML external entities (XXE)

<1.24.2 · fixed in 1.24.2

OpenRemote has Cross-Realm User Information Disclosure in UserResourceImpl

• Broken access control

<1.24.2 · fixed in 1.24.2

OpenRemote read-only asset users can write predicted datapoints

• Broken access control

<1.24.1 · fixed in 1.24.1

Apache Camel-Langchain4j-Tools: Tool argument headers are not filtered against declared parameters

• CWE-20

>=4.8.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.18.3, 4.21.0

Apache Camel-CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input

• CWE-20

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel-Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input

• CWE-20

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel-Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body

• Information disclosure

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy

• CWE-20

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel-Atmosphere-Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy

• Information disclosure
• Server-side request forgery (SSRF)

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities

• Authentication bypass
• CWE-636

>=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.18.3, 4.21.0

Apache Camel-Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy

• Information disclosure
• Server-side request forgery (SSRF)

>=4.17.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.18.3, 4.21.0

Apache Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter

• Other injection
• CWE-20

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF)

• Server-side request forgery (SSRF)
• CWE-20

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel-Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter

• Other injection
• Broken access control

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel-JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter

• Broken access control
• CWE-20

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel-Dapr: The Dapr Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers

• CWE-20
• CWE-441

>=4.12.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter

• Other injection
• CWE-20

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body

• Information disclosure

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)

• Other injection

>=4.10.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation

• CWE-20
• CWE-441

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel-Vertx-Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a HeaderFilterStrategy

• Information disclosure
• Server-side request forgery (SSRF)

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel: camel-mongodb-gridfs producer allows GridFS operation override and NoSQL operator injection via unfiltered  gridfs.*  HTTP headers

• Broken access control
• CWE-20

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers

• CWE-20

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)

• Insecure deserialization

>=4.18.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.18.3, 4.21.0

Apache Camel-Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header filter, allowing an HTTP client to inject the full-text search query

• Broken access control
• CWE-20

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields

• Other injection
• Server-side request forgery (SSRF)

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel-Mail: The mail producer applied attacker-supplied mail.smtp.* / mail.smtps.* message headers as JavaMail session properties

• Information disclosure
• CWE-20

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution

• Insecure deserialization

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer

• Command injection

>=4.15.0, <4.18.3 · fixed in 4.18.3

Apache Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing untrusted clients to override the Elasticsearch query and operation

• Broken access control
• CWE-20

>=4.3.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers

• CWE-20

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted

• Authentication bypass

>=4.18.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.18.3, 4.21.0

Apache Camel JMS deserialization filter bypass

• Insecure deserialization

>=3.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure

• Insecure deserialization

>=4.14.0, <4.14.8 || >=4.18.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0

Apache Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers

• CWE-20

>=4.0.0, <4.14.8 || >=4.15.0, <4.18.3 || >=4.19.0, <4.21.0 · fixed in 4.14.8, 4.18.3, 4.21.0