Vulnerabilities
Every vulnerability the CVE Program has published, newest first. Search by CVE ID, product, or words from the description.
402,055 vulnerabilities match.
| CVE | Severity | Summary | Published |
|---|---|---|---|
| CVE-2026-85250 | 7.5 High | Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option | Oct 19, 2026 |
| CVE-2026-85249 | 6.5 Medium | Apache Camel: Camel-Tika Header Injection via Unfiltered Document Metadata | Oct 19, 2026 |
| CVE-2026-85248 | 5.9 Medium | Apache Camel: Camel-PQC Signature Verification Bypass via a Shared Unsynchronized Signature Instance | Oct 19, 2026 |
| CVE-2026-85247 | 5.9 Medium | Apache Camel: Camel-Knative Improper Certificate Validation When SSL Is Enabled Without a Truststore | Oct 19, 2026 |
| CVE-2026-85246 | 5.3 Medium | Apache Camel: Camel-Mina Information Disclosure via Unmuted Consumer Exceptions | Oct 19, 2026 |
| CVE-2026-85245 | 5.9 Medium | Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target | Oct 19, 2026 |
| CVE-2026-85243 | 5.9 Medium | Apache Camel: Camel-Crypto-PGP Integrity Verification Downgrade via Attacker-Controlled Message Structure | Oct 19, 2026 |
| CVE-2026-84181 | 5.9 Medium | Apache Camel: Camel-Shiro Authentication Bypass via Skipped Credential Verification on Subject Reuse | Oct 19, 2026 |
| CVE-2026-84180 | 5.3 Medium | Apache Camel: Camel-Knative Information Disclosure via Unmuted Consumer Exceptions | Oct 19, 2026 |
| CVE-2026-84178 | 6.1 Medium | Apache Camel: Camel-OAuth Login Cross-Site Request Forgery via Missing State Binding in the Authorization Code Flow | Oct 19, 2026 |
| CVE-2026-112105 | 6.3 Medium | GlitterWare Passy TLS main.dart MyHttpOverrides certificate validation | Oct 19, 2026 |
| CVE-2026-84176 | 6.5 Medium | Apache Camel: Camel-Platform-HTTP-Vertx Cross-Origin Credential Exposure via Wildcard Origin Reflection | Oct 19, 2026 |
| CVE-2026-83531 | 8.8 High | Apache Camel: Camel-Dynamic-Router Control Endpoint Compiles Predicate Expressions Supplied by Control Messages | Oct 19, 2026 |
| CVE-2026-80344 | 8.2 High | Apache Camel: Camel-AS2 Server-Side Request Forgery and Credential Disclosure via Asynchronous MDN Delivery Address | Oct 19, 2026 |
| CVE-2026-80343 | 8.2 High | Apache Camel: Camel-Netty-HTTP Security Constraint Bypass via Case-Sensitive Context-Path Matching | Oct 19, 2026 |
| CVE-2026-80312 | 8.2 High | Apache Camel: Camel-OAuth Authentication Bypass via Fail-Open Processors | Oct 19, 2026 |
| CVE-2026-79986 | 7.4 High | Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside | Oct 19, 2026 |
| CVE-2026-79985 | 7.4 High | Apache Camel: camel-smb resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside | Oct 19, 2026 |
| CVE-2026-79984 | 7.4 High | Apache Camel: camel-mina-sftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside | Oct 19, 2026 |
| CVE-2026-112104 | 6.9 Medium | eremef bandcamp-player Remote Control Server database.ts missing authentication | Oct 19, 2026 |
| CVE-2026-79983 | 7.4 High | Apache Camel: camel-ftp resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being polled, so a listing entry containing traversal segments could be moved outside | Oct 19, 2026 |
| CVE-2026-78165 | 8.8 High | Apache Camel: Camel-Spring-Redis Unfiltered Java Deserialization of Redis Payloads | Oct 19, 2026 |
| CVE-2026-78164 | 8.2 High | Apache Camel: HTTP producers resolve property placeholders in message-supplied URI override headers | Oct 19, 2026 |
| CVE-2026-78163 | 5.9 Medium | Apache Camel: Camel-Docling Unvalidated Message Body Input Source Enables Server-Side Request Forgery and Local File Disclosure | Oct 19, 2026 |
| CVE-2026-78162 | 10.0 Critical | Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865) | Oct 19, 2026 |
| CVE-2026-112103 | 6.3 Medium | f3-factory fatfree-core HTTP Client web.php _curl certificate validation | Oct 19, 2026 |
| CVE-2026-112102 | 5.3 Medium | AXA Group NLP.js Condition Expression Pipeline evaluator.js Evaluator.walkFunction code injection | Oct 19, 2026 |
| CVE-2026-90910 | 9.8 Critical | Apache Answer: Reaction API authorization bypass for restricted content | Oct 19, 2026 |
| CVE-2026-86589 | 5.4 Medium | Apache Answer: User Center integration does not revoke first-login sessions after central account suspension | Oct 19, 2026 |
| CVE-2026-79633 | 8.1 High | Apache Answer: Missing Authorization Allows Mutations of Non-Public Content | Oct 19, 2026 |
| CVE-2026-79624 | 9.8 Critical | Apache Answer: Stale Visit Tokens Retain Access to Private Uploads After Session Revocation | Oct 19, 2026 |
| CVE-2026-79620 | 4.3 Medium | Apache Answer: Improper Authorization Allows Disclosure of Non-Public Question Metadata | Oct 19, 2026 |
| CVE-2026-79613 | 5.3 Medium | Apache Answer: Disclosure of Comments on Non-Public Content Through Public Profiles | Oct 19, 2026 |
| CVE-2026-76994 | 7.5 High | Apache Answer: Exposure of Hidden Question Metadata Through Public Answer Profiles | Oct 19, 2026 |
| CVE-2026-71563 | 4.3 Medium | Apache Answer: MCP Answer Retrieval Exposes Content from Non-Public Questions | Oct 19, 2026 |
| CVE-2026-68482 | 5.3 Medium | Apache Answer: Improper Authorization in Question Invite User Lookup | Oct 19, 2026 |
| CVE-2026-67249 | 5.4 Medium | Apache Answer: Email Code Purpose Confusion May Allow Account Takeover | Oct 19, 2026 |
| CVE-2026-64945 | 7.5 High | Apache Answer: Incorrect permission mapping allows users with only the unpin permission to hide/show questions | Oct 19, 2026 |
| CVE-2026-112101 | 5.3 Medium | BlackBeltTechnology pi-agent-dashboard WebSocket Gateway origin validation | Oct 19, 2026 |
| CVE-2026-112192 | 5.3 Medium | MISP Module Settings Expose Redacted Values and Allow API Modification of CLI-Only Settings | Oct 19, 2026 |
| CVE-2026-64944 | 5.4 Medium | Apache Answer: Stored XSS via unsanitized HTML in imported question content | Oct 19, 2026 |
| CVE-2026-64943 | 8.1 High | Apache Answer: API keys logged in plaintext during authentication | Oct 19, 2026 |
| CVE-2026-112188 | 7.1 High | MISP Server Settings Lookup Exposes Sensitive Configuration Data via Branch Name Resolution | Oct 19, 2026 |
| CVE-2026-108837 | 7.5 High | Apache Kylin: Potential computed-column resource exhaustion | Oct 19, 2026 |
| CVE-2026-108833 | 7.5 High | Apache Kylin: default startup profile miss security settings | Oct 19, 2026 |
| CVE-2026-108823 | 7.5 High | Apache Kylin: Potential unauthenticated job metadata replacement | Oct 19, 2026 |
| CVE-2026-108780 | 6.5 Medium | Apache Kylin: Potential JDBC source configuration validation issue | Oct 19, 2026 |
| CVE-2026-108776 | 5.3 Medium | Apache Kylin: tables/names SparkSQL injection | Oct 19, 2026 |
| CVE-2026-108771 | 9.8 Critical | Apache Kylin: unauthenticated broadcast API and polymorphic deserialization | Oct 19, 2026 |
| CVE-2026-108766 | 6.5 Medium | Apache Kylin: missing JDBC-config authorization | Oct 19, 2026 |
Every record here comes from the CVE Program's CVE List. © 1999-2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.