Security advisories

high2026-04-28

CVE-2026-40972-Spring Boot DevTools remote secret comparison is vulnerable to timing attacks

spring-projects/spring-boot · GHSA-56v8-86gj-66jp

medium2026-04-27

CVE-2026-7158-mcp-url-downloader has a Server-Side Request Forgery issue

dmitryglhf/url-download-mcp · GHSA-h7xc-4mv8-59fj

medium2026-04-27

CVE-2026-5362-Pimcore has an authenticated Cross-site Scripting issue

pimcore/pimcore · GHSA-7gxw-q9j5-mrj4

low2026-04-27

CVE-2026-7150-auto-favicon has a Server-Side Request Forgery issue

dh1011/auto-favicon-mcp · GHSA-vmh7-9c7h-2pgg

medium2026-04-27

CVE-2026-7149-kaggle-mcp has a Path Traversal issue

dexhunter/kaggle-mcp · GHSA-q882-jc55-6343

medium2026-04-27

CVE-2026-40970-Spring Boot's Elasticsearch auto-configuration doesn't perform hostname verification when connecting to the Elasticsearch server.

spring-projects/spring-boot · GHSA-c96x-rpm4-349p

low2026-04-27

CVE-2026-7142-Wooey has an Incorrect Privilege Assignment issue

wooey/wooey · GHSA-w65c-cmxj-qrhm

medium2026-04-27

CVE-2026-6357-pip Vulnerable to Inclusion of Functionality from Untrusted Control Sphere

pypa/pip · GHSA-jp4c-xjxw-mgf9

medium2026-04-27

CVE-2026-41081-Apache Storm's Improper Handling of TLS Client Authentication Failure Leads to Anonymous Principal Assignment

apache/storm · GHSA-j2q8-xx3q-8fqh

medium2026-04-27

CVE-2026-40557-Apache Storm Prometheus Reporter vulnerable to Improper Certificate Validation via Global SSL Context Downgrade

apache/storm · GHSA-82fm-wpc2-5pmp

critical2026-04-27

CVE-2026-41409-Apache MINA Vulnerable to Deserialization of Untrusted Data (CVE-2024-52046 Incomplete Fix)

apache/mina · GHSA-f2wh-grmh-r6jm

critical2026-04-27

CVE-2026-33453-Apache camel-coap allows header injection that can lead to remote code execution

apache/camel · GHSA-695c-x5gc-94gj

medium2026-04-27

CVE-2026-27172-Apache Camel-Consul component vulnerable to Deserialization of Untrusted Data

apache/camel · GHSA-5rc6-9qfp-8vwg

high2026-04-27

CVE-2026-40858-Apache Camel-Infinispan Component Vulnerable to Deserialization of Untrusted Data

apache/camel · GHSA-4xwx-hvv7-7prj

critical2026-04-27

CVE-2026-33454-Apache Camel's Camel-Mail component is vulnerable to Camel message header injection

apache/camel · GHSA-2vqf-x7g4-7c2g

high2026-04-27

CVE-2026-40022-Apache Camel Vulnerable to Authentication Bypass Using an Alternate Path or Channel

apache/camel · GHSA-27vm-5vpj-rp5g

high2026-04-27

CVE-2026-40473-Camel-MINA Vulnerable to Deserialization of Untrusted Data

apache/camel · GHSA-vpr3-2659-rw55

critical2026-04-27

CVE-2026-40860-Apache camel-jms, camel-sjms, camel-sjms2 and camel-amqp: Unsafe Deserialization of JMS ObjectMessage

apache/camel · GHSA-m5vh-3fw5-5wgh

critical2026-04-27

CVE-2026-40453-Apache Camel has an incomplete fix for CVE-2025-27636

apache/camel · GHSA-jg2m-9x48-3gvj

critical2026-04-27

CVE-2026-41635-Apache MINA vulnerable to Deserialization of Untrusted Data

apache/mina · GHSA-8297-v2rf-2p32