Security advisories

medium2026-07-06

CVE-2026-49439-OpenRemote read-only asset users can write predicted datapoints

openremote/openremote · GHSA-xj53-j257-hxvg

critical2026-07-06

CVE-2026-52889-Formie Hidden field defaults vulnerable to Server-Side Template Injection

verbb/formie · GHSA-565m-g33j-jq96

high2026-07-06

CVE-2022-46292-Open Babel has out-of-bounds write in MOPAC translationVectors[] (UNIT CELL TRANSLATION)

openbabel/openbabel · GHSA-55f6-pf8r-c2f4

high2026-07-06

CVE-2026-49297-Apache Airflow Google provider allows path traversal through GCS object names

apache/airflow · GHSA-v3mh-27qj-w836

high2026-07-06

CVE-2026-49042-Apache Camel-Langchain4j-Tools: Tool argument headers are not filtered against declared parameters

apache/camel · GHSA-hh8r-75r6-qrg9

high2026-07-06

CVE-2026-46588-Apache Camel-CouchDB: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input

apache/camel · GHSA-5g68-f6xg-vf2r

high2026-07-06

CVE-2026-46587-Apache Camel-Couchbase: Non-Camel-prefixed Exchange headers bypass HeaderFilterStrategy allowing operation override from untrusted input

apache/camel · GHSA-46jf-c9vx-hh79

medium2026-07-06

CVE-2026-56139-Apache Camel-Undertow: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body

apache/camel · GHSA-hjg2-f45w-c566

critical2026-07-06

CVE-2026-56140-Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy

apache/camel · GHSA-w2v8-8q6c-3rhr

high2026-07-06

CVE-2026-55993-Apache Camel-Atmosphere-Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a HeaderFilterStrategy

apache/camel · GHSA-rcvm-6r79-cf4r

critical2026-07-06

CVE-2026-53913-Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities

apache/camel · GHSA-qvc3-6q9x-95pj

high2026-07-06

CVE-2026-55994-Apache Camel-Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy

apache/camel · GHSA-pw9q-pq7c-rfqw

medium2026-07-06

CVE-2026-49098-Apache Camel-Kafka: The kafka.OVERRIDE_TOPIC (and other kafka.*) Exchange header constants used non-Camel-prefixed names that bypass the upstream HTTP header filter

apache/camel · GHSA-mm84-qvjh-hcj7

critical2026-07-06

CVE-2026-48205-Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF)

apache/camel · GHSA-hcm8-x79p-wx2w

medium2026-07-06

CVE-2026-49099-Apache Camel-Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filter

apache/camel · GHSA-gcc7-c8mp-34qx

medium2026-07-06

CVE-2026-48206-Apache Camel-JIRA: A set of non-Camel-prefixed Exchange header constants bypass the HTTP header filter

apache/camel · GHSA-64gv-6cq2-45jr

medium2026-07-06

CVE-2026-49086-Apache Camel-Dapr: The Dapr Pub/Sub consumer copied the inbound CloudEvent's pub/sub-name and topic into producer-direction routing headers

apache/camel · GHSA-583r-f84w-33g7

medium2026-07-06

CVE-2026-49097-Apache Camel-IRC: The irc.sendTo (and other irc.*) Exchange header constants used non-Camel-prefixed names that bypass the HTTP header filter

apache/camel · GHSA-463m-2hr2-q2j7

medium2026-07-06

CVE-2026-49365-Apache Camel-Netty-HTTP: The muteException consumer option defaulted to false, so a processing error returned the full Java stack trace in the HTTP response body

apache/camel · GHSA-42q5-xw42-xf9g

high2026-07-06

CVE-2026-46591-Apache Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)

apache/camel · GHSA-q86m-qjpm-vqcw