Read the docs

Apache

Records4054All Threatist records
Exploited (KEV)47In CISA KEV
CVSS critical776CVSS 9.0–10.0
CVSS high1543CVSS 7.0–8.9

Exploited now

Apache records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2016-02580 Apache Struts Command Injection Vulnerability Priority CRITICAL 94KEV 2026-10-08TI-2026-26741 Apache Tomcat Missing Encryption of Sensitive Data Vulnerability Priority CRITICAL 90KEV 2026-08-04TI-2026-26494 Apache ActiveMQ Improper Input Validation Vulnerability Priority CRITICAL 97KEV 2026-04-16TI-2024-25716 Apache HTTP Server Improper Escaping of Output Vulnerability Priority CRITICAL 98KEV 2025-05-01TI-2025-18529 Apache Tomcat Path Equivalence Vulnerability Priority CRITICAL 100KEV 2025-04-01

Components

Products in the NVD configurations · select one to filter the records
Http Server 350 records CRITICAL Tomcat 274 records CRITICAL Airflow 158 records CRITICAL Traffic Server 121 records CRITICAL Camel 117 records HIGH Struts 99 records CRITICAL Cxf 80 records MEDIUM Ofbiz 76 records CRITICAL

Records

117 records in Camel · all components

TI-2026-76339 CVE-2026-79986 · GHSA-pw2m-67gx-9wx2

Path traversal in Apache Camel azure-files component

Priority HIGH 74

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in Apache Camel Azure Files component.

CVSS 3.1CRITICAL 9.1 Network No auth No interaction EPSS 0.0102 Published 2026-10-19 Fixed in 4.18.5, 4.22.1 +1 CWE-22
TI-2026-34899 CVE-2026-47323 · GHSA-8364-hfqj-pwm6

Apache Camel: Camel-CXF Message Header Injection via Missing Inbound Filtering

Priority HIGH 67

Camel-CXF and Camel-Knative Message Header Injection via Missing Inbound Filtering The CXF and Knative HeaderFilterStrategy implementations (CxfRsHeaderFilterStrategy in camel-cxf-rest, CxfHeaderFilterStrategy in camel-c…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.19563 Published 2026-05-19 Partial fix · 4.14.6, 4.18.2 CWE-178
TI-2026-25849 CVE-2026-33453 · GHSA-695c-x5gc-94gj

Mass assignment in Apache Camel

Priority MEDIUM 61

Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.09178 Published 2026-04-27 Fixed in 4.18.1, 4.14.6 CWE-915
TI-2014-00002 CVE-2014-0002 · GHSA-2fw5-rvf2-jq56

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote…

Priority MEDIUM 55

The XSLT component in Apache Camel before 2.11.4 and 2.12.x before 2.12.3 allows remote attackers to read arbitrary files and possibly have other unspecified impact via an XML document containing an external entity decla…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.27389 Published 2014-03-20 Partial fix · 2.11.4, 2.12.3 CWE-264
TI-2026-29517 CVE-2026-40860 · GHSA-m5vh-3fw5-5wgh

Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqp

Priority MEDIUM 52

JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any…

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.01739 Published 2026-04-27 Partial fix · 4.14.7, 4.18.2 +1 CWE-502
TI-2017-09359 CVE-2017-12634 · GHSA-vf4q-8mr7-5c5c

Deserialization of untrusted data in Apache Camel

Priority MEDIUM 52

The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.07194 Published 2017-11-15 Partial fix · 2.19.4, 2.20.1 CWE-502
TI-2017-09358 CVE-2017-12633 · GHSA-5whj-523x-6j68

Deserialization of untrusted data in Apache Camel

Priority MEDIUM 52

The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.07194 Published 2017-11-15 Partial fix · 2.19.4, 2.20.1 CWE-502
TI-2026-31931 CVE-2026-43867 · GHSA-7cmx-qjh8-7v3v

Deserialization of untrusted data in Apache Camel

Priority MEDIUM 51

Deserialization of Untrusted Data vulnerability in Apache Camel PQC Component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00926 Published 2026-07-06 Fixed in 4.18.3, 4.21.0 CWE-502
TI-2020-09632 CVE-2020-11972 · GHSA-2x6r-7427-95cm

Deserialization of untrusted data in Apache Camel

Priority MEDIUM 51

Apache Camel RabbitMQ enables Java deserialization by default.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.05652 Published 2020-05-14 Partial fix · 2.25.1, 3.2.0 CWE-502
TI-2017-02375 CVE-2017-3159 · GHSA-hvpr-9cr6-q5v7

Deserialization of untrusted data in Apache Camel

Priority MEDIUM 51

Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability.

CVSS 3.0CRITICAL 9.8 Network No auth No interaction EPSS 0.06286 Published 2017-03-07 Partial fix · 2.17.5, 2.18.2 CWE-502
TI-2026-54491 CVE-2026-78329 · GHSA-v7h8-xhh6-gfj4

Improper input validation in Apache Camel

Priority MEDIUM 50

Improper input validation vulnerability in Apache Camel Undertow component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00618 Published 2026-08-24 Partial fix · 4.14.9, 4.18.4 +1 CWE-20
TI-2026-40516 CVE-2026-56140 · GHSA-w2v8-8q6c-3rhr

Improper input validation in Apache Camel AWS2 SNS

Priority MEDIUM 50

Improper Input Validation vulnerability in Apache Camel AWS SNS component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00738 Published 2026-07-06 Fixed in 4.14.8, 4.18.3 +1 CWE-20
TI-2026-35614 CVE-2026-48204 · GHSA-f7g3-2cg6-f5hj

Improper input validation in Apache Camel

Priority MEDIUM 50

Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00732 Published 2026-07-06 Fixed in 4.14.8, 4.18.3 +1 CWE-20
Load more
Open these records in search →