[ Vendor · 458 CVEs ]
Apache Software Foundation
CVEs affecting Apache Software Foundation published in the last 30 days, plus any Apache Software Foundation CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-113582 | 22 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache AbderaUNSUPPORTED WHEN ASSIGNED Improper restriction of XML external entity references in Apache Abdera allows an attacker to access sensitive data or make… | |
| CVE-2026-103634 | 22 Oct 2026 | Not scored yet | Apache Software Foundation Apache DataSketchesOut-of-bounds read and write in the Count-Min sketch deserialization of Apache DataSketches C++ (repo: datasketches-cpp)… | |
| CVE-2026-111812 | 21 Oct 2026 | CVSS 10.0 | Apache Software Foundation Apache Traffic ServerApache Traffic Server's origin_server_auth plugin lets a client force signing of attacker-chosen AWS request headers under the proxy's own… | |
| CVE-2026-111814 | 21 Oct 2026 | CVSS 10.0 | Apache Software Foundation Apache Traffic ServerApache Traffic Server's default outbound session-sharing policy can reuse a pooled TLS session authenticated with one client certificate for a… | |
| CVE-2026-111815 | 21 Oct 2026 | CVSS 10.0 | Apache Software Foundation Apache Traffic ServerApache Traffic Server can resume a TLS session across SNI virtual hosts without re-verifying a client certificate required by the resumed host's… | |
| CVE-2026-111817 | 21 Oct 2026 | CVSS 5.3 | Apache Software Foundation Apache Traffic ServerApache Traffic Server can stall a chunked transfer that it passes through with its trailers removed (proxy.config.http.drop_chunked_trailers) until… | |
| CVE-2026-112381 | 21 Oct 2026 | CVSS 5.9 | Apache Software Foundation Apache Traffic ServerApache Traffic Server can crash with a null pointer dereference when a client POST request is torn down via half-close while a chunked origin… | |
| CVE-2026-111805 | 21 Oct 2026 | CVSS 8.6 | Apache Software Foundation Apache Traffic ServerApache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a truncated HTTP/2 Content-Length value. This issue affects Apache… | |
| CVE-2026-111808 | 21 Oct 2026 | CVSS 8.6 | Apache Software Foundation Apache Traffic ServerApache Traffic Server can be used to exhaust an HTTP/1.1 origin's worker pool via a malformed padded HTTP/2 DATA frame. This issue affects Apache… | |
| CVE-2026-111809 | 21 Oct 2026 | CVSS 9.3 | Apache Software Foundation Apache Traffic ServerApache Traffic Server allows request smuggling via HEAD requests that carry Content-Length or Transfer-Encoding. This issue affects Apache Traffic… | |
| CVE-2026-111810 | 21 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache Traffic ServerApache Traffic Server 9.2.15, 10.1.4 and 10.2.0 write one unthrottled diagnostic log line for every internal @ header they strip, so a request… | |
| CVE-2026-111811 | 21 Oct 2026 | CVSS 9.0 | Apache Software Foundation Apache Traffic ServerApache Traffic Server's experimental tsmemcache plugin allows unauthenticated network read, write, and deletion of the shared proxy cache. This issue… | |
| CVE-2026-111804 | 21 Oct 2026 | CVSS 8.2 | Apache Software Foundation Apache Traffic ServerApache Traffic Server's experimental wasm plugin has a use-after-free in its transaction-close handler and forwards unvalidated guest-supplied metric… | |
| CVE-2026-111813 | 21 Oct 2026 | CVSS 10.0 | Apache Software Foundation Apache Traffic ServerApache Traffic Server's experimental magick plugin lets an unauthenticated client control ImageMagick convert arguments in its default (unsigned)… | |
| CVE-2026-111816 | 21 Oct 2026 | CVSS 9.3 | Apache Software Foundation Apache Traffic ServerApache Traffic Server forwarded a malformed 302 response that should have been rejected as a parse error, because the Transfer-Encoding: chunked… | |
| CVE-2026-105942 | 21 Oct 2026 | CVSS 7.7 | Apache Software Foundation Apache PulsarWhen a configured proxy role sends a request to the broker on behalf of another user (the original principal), the broker is designed to authorize… | |
| CVE-2026-105944 | 21 Oct 2026 | CVSS 10.0 | Apache Software Foundation Apache Pulsar ManagerApache Pulsar Manager is a web console for administering Apache Pulsar clusters. It has its own user accounts and login, and it can be configured… | |
| CVE-2026-105945 | 21 Oct 2026 | CVSS 7.7 | Apache Software Foundation Apache PulsarThe Pulsar Packages Management Service can be configured to store packages on the local filesystem of the broker by using the filesystem storage… | |
| CVE-2026-105934 | 21 Oct 2026 | CVSS 7.2 | Apache Software Foundation Apache PulsarThe Apache Pulsar broker admin REST API provides a truncate operation for persistent topics (DELETE… | |
| CVE-2026-105935 | 21 Oct 2026 | CVSS 4.9 | Apache Software Foundation Apache PulsarThe Pulsar Functions Worker provides a REST API endpoint for triggering a function, which publishes a caller-supplied value to one of the function's… | |
| CVE-2026-105936 | 21 Oct 2026 | CVSS 5.3 | Apache Software Foundation Apache PulsarThe Pulsar Functions worker REST API provides two endpoints that return the catalog of Pulsar IO connectors installed on the functions worker: the… | |
| CVE-2026-105937 | 21 Oct 2026 | CVSS 8.7 | Apache Software Foundation Apache PulsarApache Pulsar shadow topics (PIP-180) are topics that read the stored messages of a source topic from that topic's managed ledger. The source topic… | |
| CVE-2026-105938 | 21 Oct 2026 | CVSS 2.3 | Apache Software Foundation Apache PulsarApache Pulsar namespaces can restrict which roles may use a subscription, either with the Prefix subscription authentication mode, which requires a… | |
| CVE-2026-105931 | 21 Oct 2026 | CVSS 2.3 | Apache Software Foundation Apache PulsarThe Apache Pulsar broker exposes a transaction administration REST API under /admin/v3/transactions. When authentication and authorization are… | |
| CVE-2026-105932 | 21 Oct 2026 | CVSS 2.3 | Apache Software Foundation Apache PulsarThe Apache Pulsar broker admin REST API provides endpoints to read, set and remove the topic-level entry filter policy of a topic. For persistent… | |
| CVE-2026-105933 | 21 Oct 2026 | CVSS 2.3 | Apache Software Foundation Apache PulsarApache Pulsar allows an administrator to require end-to-end message encryption for all topics in a namespace by setting the encryption_required… | |
| CVE-2025-55702 | 21 Oct 2026 | CVSS 8.7 | Apache Software Foundation Apache Traffic ServerWhen a client sends a POST with Expect: 100-continue and the origin answers before reading the body, Apache Traffic Server parses the unread body… | |
| CVE-2025-31699 | 21 Oct 2026 | CVSS 8.9 | Apache Software Foundation Apache Traffic ServerApache Traffic Server can return an origin connection to the shared pool while the origin is still waiting on a request body the client declared but… | |
| CVE-2026-105930 | 21 Oct 2026 | CVSS 6.0 | Apache Software Foundation Apache PulsarWhen package management is enabled, Pulsar Functions, Sources and Sinks can be registered or updated from a package stored in the Pulsar Packages… | |
| CVE-2026-105869 | 21 Oct 2026 | CVSS 9.2 | Apache Software Foundation Apache PulsarApache Pulsar's MultiRolesTokenAuthorizationProvider authorizes a client with all roles listed in a claim of its JSON Web Token (JWT). The provider… | |
| CVE-2026-105926 | 21 Oct 2026 | CVSS 5.3 | Apache Software Foundation Apache PulsarThe Pulsar broker serves two schema commands on its binary protocol: GetSchema, which returns the schema registered for a topic, and… | |
| CVE-2026-105927 | 21 Oct 2026 | CVSS 2.3 | Apache Software Foundation Apache PulsarThe Apache Pulsar WebSocket service allows a WebSocket consumer to configure a dead letter policy through query parameters of the consumer endpoint… | |
| CVE-2026-90484 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCThe MySQL client response parser in Apache bRPC dereferences a null pointer when the server peer sends a zero-payload-length response packet. A… | |
| CVE-2026-86146 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCInconsistent interpretation of HTTP requests (HTTP request/response smuggling) in the bundled HTTP/1.1 parser of Apache bRPC (version < 1.18.0) on… | |
| CVE-2026-86147 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCExternal control of file name or path and uncontrolled resource consumption in Apache bRPC (version < 1.18.0) on all platforms allows remote… | |
| CVE-2026-86249 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCOn a brpc::Server that sets both ServerOptions.auth and ServerOptions.internal_port, the HTTP built-in service exemption on internal_port can be… | |
| CVE-2026-87849 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCThe Discovery naming-service reply parser in Apache bRPC (versions < 1.18.0) calls RapidJSON object-only accessors (FindMember) on JSON values… | |
| CVE-2026-82231 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCA Thrift client in Apache bRPC (version < 1.18.0, built with WITH_THRIFT which is off by default) can be crashed by the server peer it talks to. When… | |
| CVE-2026-82425 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCA reachable assertion in Apache bRPC (version < 1.18.0) on all platforms allows a malicious remote peer to crash the process, resulting in denial of… | |
| CVE-2026-82942 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCA data race in the RDMA transport of Apache bRPC (versions < 1.18.0) allows a remote client to crash the server process (denial of service) when RDMA… | |
| CVE-2026-82953 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCNULL pointer dereference in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash the… | |
| CVE-2026-84727 | 21 Oct 2026 | CVSS 5.4 | Apache Software Foundation Apache bRPCUse-after-free in the RTMP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows a malicious RTMP peer to crash the… | |
| CVE-2026-84747 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCInterpretation conflict in the HTTP protocol implementation in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to bypass… | |
| CVE-2026-84748 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCImproper authorization in Apache bRPC (versions < 1.18.0) on all platforms allows remote attackers to access builtin services through the public… | |
| CVE-2026-82210 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCEnforceable assertion in the streaming feature of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to crash the server… | |
| CVE-2026-82230 | 21 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache bRPCUncontrolled recursion in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the server crash… | |
| CVE-2026-80463 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCUnbounded memory accumulation in the stream message reassembly path of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to… | |
| CVE-2026-81755 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCUncontrolled resource consumption in the streaming RPC component of Apache bRPC (version < 1.18.0) allows a remote attacker to exhaust server memory… | |
| CVE-2026-78048 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCA reachable-assertion flaw in the HPACK header-compression decoder of the HTTP/2 (h2/gRPC) stack in Apache bRPC (version < 1.18.0) on all platforms… | |
| CVE-2026-78058 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCUncontrolled resource consumption in the HTTP/2 (h2) receive path of Apache bRPC (version < 1.18.0) on all platforms allows a remote unauthenticated… | |
| CVE-2026-78066 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCResource exhaustion in Apache bRPC (version < 1.18.0) on all platforms: multiple parsers that accept wire-controlled input bound no limit on the… | |
| CVE-2026-78334 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCMissing authentication in the streaming RPC path of Apache bRPC (version < 1.18.0) on all platforms allows a remote attacker to bypass server… | |
| CVE-2026-79704 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCAn out-of-bounds read vulnerability exists in the streaming RPC client of Apache bRPC (versions 1.11.0 through 1.17.0) on all platforms. A client… | |
| CVE-2026-59562 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache IoTDBMissing authentication for critical function vulnerability in Apache IoTDB. This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users are… | |
| CVE-2026-61902 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCApache bRPC versions before 1.18.0 do not consistently enforce the configured max_body_size limit in non-progressive HTTP/1 and HTTP/2 parsing and in… | |
| CVE-2026-61916 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCOut-of-bounds reads in URL parsing and case-insensitive header lookup in Apache bRPC before version 1.18.0 on platforms where plain char is unsigned… | |
| CVE-2026-66392 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCApache bRPC versions before 1.18.0 validate the server certificate chain when client TLS peer verification is enabled, but do not bind the… | |
| CVE-2026-74755 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCAn integer underflow in the mcpack2pb component of Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to crash a bRPC server by… | |
| CVE-2026-74757 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCUncontrolled resource allocation in the mcpack2pb component in Apache bRPC (version < 1.18.0) on all platforms allows remote attackers to make the… | |
| CVE-2026-74758 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCA heap use-after-free in the RTMP protocol component of Apache bRPC (versions < 1.18.0) allows a remote attacker to crash a bRPC RTMP server by… | |
| CVE-2026-54425 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCUncontrolled recursion in the HTTP/2 HPACK decoder in Apache bRPC before 1.18.0 allows remote attackers to cause denial of service by sending a… | |
| CVE-2026-54426 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCUncontrolled recursion in the Redis reply parser in Apache bRPC < 1.18.0 allows a remote Redis server peer to crash a bRPC Redis client process by… | |
| CVE-2026-54427 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCUncontrolled recursion in the AMF parser in Apache bRPC < 1.18.0 allows a remote RTMP peer to crash a bRPC process by sending deeply nested AMF… | |
| CVE-2026-56386 | 21 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache bRPCInteger underflow and out-of-bounds read in the HTTP/2 server DATA frame parser in Apache bRPC allows an unauthenticated remote attacker to cause… | |
| CVE-2026-56387 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCThe RTMP AMF parser in Apache bRPC accepts AMF string lengths and array counts directly from untrusted input. A remote unauthenticated attacker who… | |
| CVE-2026-56388 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCThe Redis server command parser in Apache bRPC accepts an empty RESP array as a command header. A remote unauthenticated attacker who can reach a… | |
| CVE-2026-58064 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCThe Redis protocol implementation in Apache bRPC allowed inline command parsing to allocate and copy the full connection buffer before a complete… | |
| CVE-2026-59229 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache IoTDBThe Legacy Pipe receiver protocol (handshake / sendPipeData) uses a hardcoded SUPER_USER (root) identity when executing data loading and deletion… | |
| CVE-2026-48830 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache bRPCImproper authentication in Apache bRPC through 1.17.0 allows a remote unauthenticated attacker to bypass authentication for protected non-builtin… | |
| CVE-2026-41114 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache IoTDB JDBC driverUncontrolled Resource Consumption vulnerability in Apache IoTDB JDBC driver. This issue affects Apache IoTDB JDBC driver: from 1.3.3 before 2.0.11… | |
| CVE-2026-58663 | 21 Oct 2026 | Not scored yet | Apache Software Foundation Apache IoTDBAn authentication bypass vulnerability exists in Apache IoTDB's Thrift RPC service This issue affects Apache IoTDB: from 2.0.0 before 2.0.11. Users… | |
| CVE-2026-90800 | 20 Oct 2026 | CVSS 8.1 | Apache Software Foundation Apache CouchDBMissing authorisation checks in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any request to read the full contents of a prefixed… | |
| CVE-2026-86471 | 20 Oct 2026 | CVSS 9.3 | Apache Software Foundation Apache CouchDBAn unvalidated runtime configuration value in Apache CouchDB 3.5.2 and below on all platforms allows a CouchDB server admin to run arbitrary shell… | |
| CVE-2026-90797 | 20 Oct 2026 | CVSS 7.7 | Apache Software Foundation Apache CouchDBAn unlimited gzip decompression routine in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows any remote client to cause a denial of… | |
| CVE-2026-90798 | 20 Oct 2026 | CVSS 0.6 | Apache Software Foundation Apache CouchDBA missing circuit-breaker in the replicator in Apache CouchDB 3.5.2 and below on all platforms allows the owner of a replication source or target to… | |
| CVE-2026-90799 | 20 Oct 2026 | CVSS 1.3 | Apache Software Foundation Apache CouchDBUnsafe binary deserialisation in chttpd in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to cause a denial of service… | |
| CVE-2026-107755 | 20 Oct 2026 | CVSS 6.0 | Apache Software Foundation Apache CouchDBInsufficient filtering of credentials in the _replicator database in Apache CouchDB 3.5.2 and below on all platforms allows an authenticated user to… | |
| CVE-2026-88041 | 20 Oct 2026 | Not scored yet | Apache Software Foundation Apache TomcatIncomplete cleanup vulnerability in Apache Tomcat allowed an trailer information from a previous request to leak into a subsequent request. This… | Fix |
| CVE-2026-93446 | 20 Oct 2026 | Not scored yet | Apache Software Foundation Apache TomcatIncomplete cleanup vulnerability in Apache Tomcat could cause TLS 1.3 connections to fail intermittently. This issue affects Apache Tomcat: from… | Fix |
| CVE-2026-80353 | 20 Oct 2026 | Not scored yet | Apache Software Foundation Apache TomcatTime-of-check time-of-use (TOCTOU) race condition vulnerability in Apache Tomcat when creating unix domain sockets for the APR/Native connector… | Fix |
| CVE-2026-74048 | 20 Oct 2026 | Not scored yet | Apache Software Foundation Apache TomcatNot Failing Securely ('Failing Open') vulnerability in Apache Tomcat. If the OpenSSLLifecycleListener is configured to use FIPS mode but FIPS… | Fix |
| CVE-2026-74049 | 20 Oct 2026 | Not scored yet | Apache Software Foundation Apache TomcatExecution After Redirect (EAR) vulnerability in Apache Tomcat. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.26, from 10.1.0-M1… | Fix |
| CVE-2026-103119 | 20 Oct 2026 | CVSS 9.1 | Apache Software Foundation Apache TomcatBuffer under-read vulnerability in Apache Tomcat meant that a large non-blocking write could result in the response body being split between the… | Fix |
| CVE-2026-101356 | 20 Oct 2026 | CVSS 9.1 | Apache Software Foundation Apache TomcatIncorrect object recycling and re-use vulnerability in Apache Tomcat affecting HTTP/2 processing of asynchronous servlets can trigger request and/or… | Fix |
| CVE-2026-101296 | 20 Oct 2026 | CVSS 9.1 | Apache Software Foundation Apache TomcatA missing critical step in authentication vulnerability in Apache Tomcat when the JNDI realm was configured with with a non GSSAPI SASL… | Fix |
| CVE-2026-108089 | 20 Oct 2026 | CVSS 7.5 | Apache Software Foundation Apache Cocoon** UNSUPPORTED WHEN ASSIGNED ** Exposure of sensitive system information to an unauthorized control sphere vulnerability in Apache Cocoon. An… | |
| CVE-2026-108086 | 20 Oct 2026 | Not scored yet | Apache Software Foundation Apache Cocoon** UNSUPPORTED WHEN ASSIGNED ** Improper restriction of recursive entity references in DTDs ('XML entity expansion') vulnerability in Apache Cocoon… | |
| CVE-2026-108087 | 20 Oct 2026 | Not scored yet | Apache Software Foundation Apache Cocoon** UNSUPPORTED WHEN ASSIGNED ** Improper neutralization of special elements used in an SQL command ('SQL injection') vulnerability in Apache Cocoon… | |
| CVE-2026-108088 | 20 Oct 2026 | Not scored yet | Apache Software Foundation Apache Cocoon** UNSUPPORTED WHEN ASSIGNED ** Use of cache containing sensitive information vulnerability in Apache Cocoon. When using the cache on a multi-user… | |
| CVE-2026-92287 | 20 Oct 2026 | Not scored yet | Apache Software Foundation Apache Arrow C++Pass-through of unvalidated KMS URLs to KMS clients in Apache C++ Parquet and PyArrow versions 4.0.0 to 25.0.1. This affects users who read Parquet… | |
| CVE-2026-86467 | 20 Oct 2026 | Not scored yet | Apache Software Foundation Apache Airflow Amazon providerApache Airflow Amazon provider: the AWS auth manager's SAML login flow does not bind the authentication response to the browser that began it. The… | |
| CVE-2026-88900 | 19 Oct 2026 | CVSS 8.8 | Apache Software Foundation Apache CamelDeserialization of Untrusted Data vulnerability in Apache Camel Camel-Jgroups component. This issue affects Apache Camel: from 4.0.0 before 4.18.5… | |
| CVE-2026-85317 | 19 Oct 2026 | CVSS 4.8 | Apache Software Foundation Apache CamelUse of Cache Containing Sensitive Information vulnerability in Apache Camel HTTP component. This issue affects Apache Camel: from 4.0.0 before… | |
| CVE-2026-88901 | 19 Oct 2026 | CVSS 8.2 | Apache Software Foundation Apache CamelImproper Restriction of XML External Entity Reference vulnerability in Apache Camel. This issue affects Apache Camel: from 4.7.0 before 4.18.5, from… | |
| CVE-2026-91858 | 19 Oct 2026 | CVSS 6.5 | Apache Software Foundation Apache CamelFopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance()… | |
| CVE-2026-85296 | 19 Oct 2026 | CVSS 6.5 | Apache Software Foundation Apache CamelExposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5… | |
| CVE-2026-85300 | 19 Oct 2026 | CVSS 5.5 | Apache Software Foundation Apache CamelIncorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0… | |
| CVE-2026-85301 | 19 Oct 2026 | CVSS 4.8 | Apache Software Foundation Apache CamelImproper Authentication vulnerability in Apache Camel Keycloak component. This issue affects Apache Camel: from 4.15.0 before 4.18.5, from 4.19.0… | |
| CVE-2026-85312 | 19 Oct 2026 | CVSS 4.8 | Apache Software Foundation Apache CamelImproper Input Validation vulnerability in Apache Camel Core component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before… | |
| CVE-2026-85313 | 19 Oct 2026 | CVSS 4.3 | Apache Software Foundation Apache CamelPermissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0… |
Page 1 of 5