Security Advisories

high2026-08-24

CVE-2026-66908-Apache Camel-platform-http-main: when JWT authentication was configured with a keystore but no issuer or audience, the iss and aud claims were never validated, so any unexpired token signed by a trusted key was accepted

View chart

apache/camel · GHSA-fpm2-m4qq-wghr

high2026-08-24

CVE-2026-66907-Apache Camel-Google-Storage: the consumer appended the remote object name to the configured downloadFileName directory without constraining the result

View chart

apache/camel · GHSA-f78g-9385-qxqj

medium2026-08-24

CVE-2026-59230-Apache Camel-Mail: the MimeMultipart data format copied MIME headers onto the Camel message without a header filter strategy when unmarshalling with headersInline enabled

View chart

apache/camel · GHSA-cx47-qxp5-mmh2

medium2026-08-24

CVE-2026-60093-Apache Camel-Azure-Storage-DataLake: the downloadToFile operation built the local download target from the remote path name without constraining it to the configured fileDir

View chart

apache/camel · GHSA-7jwc-q3fj-c9pq

critical2026-08-24

CVE-2026-66906-Apache Camel-Azure-Storage-Blob: the downloadBlobToFile operation built the local download target from the remote blob name without constraining it to the configured fileDir

View chart

apache/camel · GHSA-2x37-89hj-2j95

medium2026-08-24

CVE-2026-76845-adm-zip extraction follows destination symlinks, allowing arbitrary file overwrite

View chart

cthackers/adm-zip · GHSA-vwc7-r8mq-g2x9

low2026-08-22

CVE-2026-71514-NLTK CrubadanCorpusReader path traversal allows arbitrary file disclosure

View chart

nltk/nltk · GHSA-cv22-g7mw-8v73

high2026-08-22

CVE-2026-71513-NLTK AllowlistUnpickler dotted-name validation bypass allows remote code execution

View chart

nltk/nltk · GHSA-5gh2-94qg-qppq

critical2026-08-21

CVE-2026-77415-JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

View chart

jsonata-js/jsonata · GHSA-66mm-25pp-rfff

critical2026-08-21

CVE-2026-77414-JSONata vulnerable to Arbitrary Code Execution via crafted JSONata expressions

View chart

jsonata-js/jsonata · GHSA-2943-5xfg-gq5f

high2026-08-21

CVE-2026-68508-Hydra: hydra.utils.instantiate with untrusted config can lead to code execution

View chart

hydra-ecosystem/hydra · GHSA-2cp2-2r3c-7p7r

high2026-08-21

CVE-2026-63135-YOURLS has stored XSS in referrer statistics chart via crafted Referer header

View chart

yourls/yourls · GHSA-5h77-88j3-r659

critical2026-08-21

CVE-2026-77413-JSONata: Arbitrary Code Execution via crafted JSONata expressions

View chart

jsonata-js/jsonata · GHSA-8gq3-vp5j-2grp

high2026-08-21

CVE-2026-77354-kin-openapi has uncontrolled resource consumption in openapi3filter deepObject query parameter decoding

View chart

getkin/kin-openapi · GHSA-xhj3-7xw9-vr34

critical2026-08-21

CVE-2026-61539-Xinference vulnerable to remote code execution via unsafe `eval()` in Llama3 tool-call parsing

View chart

xorbitsai/inference · GHSA-x2rj-828p-hx9m

critical2026-08-21

CVE-2026-59989-Phalcon Volt compiler `join` filter compile-time PHP code injection (SSTI leads to RCE)

View chart

phalcon/cphalcon · GHSA-hrwp-4hh9-c8r8

high2026-08-21

CVE-2026-76905-kin-openapi openai3filter: nil-pointer panic in ConvertErrors on malformed multipart/form-data body enables unauthenticated DoS

View chart

getkin/kin-openapi · GHSA-mmfr-pmjx-hw9w

high2026-08-21

CVE-2026-64679-Atlantis Workspace Handling has Path Traversal that Allows Out-of-Bounds Directory Deletion/Creation

View chart

runatlantis/atlantis · GHSA-26w5-6g95-gj28

high2026-08-21

CVE-2026-63421-Keystone vulnerable to `graphql.maxTake` bypass with negative `take`

View chart

keystonejs/keystone · GHSA-cqmq-8755-7xvh

high2026-08-21

CVE-2026-61824-Defuddle vulnerable to XSS via unescaped attribute interpolation in site extractors

View chart

kepano/defuddle · GHSA-jg4p-g6xj-4qmf