CVE-2026-27172

CVE-2026-27172 affects Apache Camel, Camel-Catalog: the ConsulRegistry reads Java-serialized values from the Consul KV store and deserializes them via ObjectInputStream.readObject() without an ObjectInputFilter. An attacker with write access to the backing KV store can inject a malicious serializ...

CVE-2026-27172 Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV store

The ConsulRegistry in the camel-consul component class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject without configuring an ObjectInputFilte...

PT-2026-35393

The ConsulRegistry in the camel-consul component class org.apache.camel.component.consul.ConsulRegistry and its inner ConsulRegistryUtils.deserialize method read Java-serialized values from the Consul KV store and passed them to ObjectInputStream.readObject without configuring an ObjectInputFilte...

Apache Camel 代码问题漏洞

Apache Camel is an open-source integration framework based on the Enterprise Integration Pattern EIP, developed by the Apache Foundation in the United States. This framework provides implementations of Java objects following the EIP pattern and allows routing and mediation rules to be configured...

GHSA-MH2Q-Q3FH-2475 vulnerabilities

Vulnerabilities for packages: crossplane-provider-aws-ec2, crossplane-provider-aws-s3, rclone-fips, crossplane-provider-aws-osis, crossplane-provider-aws-lambda-fips, crossplane-provider-aws-memorydb, crossplane-provider-gitlab-fips, prometheus-podman-exporter-fips,...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: falcoctl, envoy-gateway, kubernetes-dashboard-api, argocd-image-updater, kubescape, argo-rollouts, eksctl, gitlab-kas, datadog-agent, kargo, kubernetes, argo-cd, kwok, istio, k9s, argo-workflows, cluster-api, k8sgpt, gitlab-runner, cloudnative-pg, kube-arangodb,...

CVE-2026-35469 vulnerabilities

Vulnerabilities for packages: falcoctl, envoy-gateway, kubernetes-dashboard-api, argocd-image-updater, kubescape, argo-rollouts, eksctl, gitlab-kas, datadog-agent, kargo, kubernetes, argo-cd, kwok, istio, k9s, argo-workflows, cluster-api, k8sgpt, gitlab-runner, cloudnative-pg, kube-arangodb,...

CVE-2026-35469 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, kube-arangodb, postgres-operator-fips, istio-fips, headlamp-fips, percona-xtradb-cluster-operator-fips, neuvector-fips, velero-fips, dynamic-localpv-provisioner-fips, grafana, kpt, k8s-driver-manager, infinispan-operator, kots, kcp, gitlab-kas,...

GHSA-PC3F-X583-G7J2 vulnerabilities

Vulnerabilities for packages: kubeflow-pipelines, kube-arangodb, postgres-operator-fips, istio-fips, headlamp-fips, percona-xtradb-cluster-operator-fips, neuvector-fips, velero-fips, dynamic-localpv-provisioner-fips, grafana, kpt, k8s-driver-manager, infinispan-operator, kots, kcp, gitlab-kas,...

CVE-2026-35206 vulnerabilities

Vulnerabilities for packages: helm-set-status, cert-manager-cmctl, envoy-gateway, chart-testing, kubescape, eksctl, helm-operator, kuma, flux-source-controller, flux, harbor, helm-docs, istio, k9s, zot, cerbos, cluster-api-helm-controller, kube-arangodb, tigera-operator, zarf, k8ssandra-client,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: helm-set-status, cert-manager-cmctl, envoy-gateway, chart-testing, kubescape, eksctl, helm-operator, kuma, flux-source-controller, flux, harbor, helm-docs, istio, k9s, zot, cerbos, cluster-api-helm-controller, kube-arangodb, tigera-operator, zarf, k8ssandra-client,...

GHSA-HR2V-4R36-88HR vulnerabilities

Vulnerabilities for packages: zarf, nova-fips, kube-arangodb, chartmuseum-fips, zot, chart-testing-fips, flux, helm-push, cerbos-fips, chaos-mesh, headlamp-fips, linkerd2-fips, nova, gitlab-operator, kubescape-server-fips, cluster-api-helm-controller-fips, cloudbeat, trivy-operator,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: grafana-mimir, dask-gateway, terraform-docs, crossplane, direnv, configmap-reload, argo-rollouts, controller-gen, mariadb-operator, nri-prometheus, minio-object-browser, croc, tigera-operator, kafka-proxy, otel-cli, kserve-modelmesh-serving, nri-nginx,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: grafana-mimir, dask-gateway, terraform-docs, crossplane, direnv, configmap-reload, argo-rollouts, controller-gen, mariadb-operator, nri-prometheus, minio-object-browser, croc, tigera-operator, kafka-proxy, otel-cli, kserve-modelmesh-serving, nri-nginx,...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: helm-set-status, keda, grafana-mimir, dask-gateway, terraform-docs, crossplane, dgraph, kubernetes-dashboard-api, rancher-agent, cert-manager-csi-driver, envconsul, atlantis, tailscale, argo-rollouts, terraform-provider-azapi, aws-flb-firehose, etcd, falco-no-driver,...

CVE-2026-32288 vulnerabilities

Vulnerabilities for packages: oras-fips, newrelic-infrastructure-agent-fips, amazon-ssm-agent, rclone-fips, sriov-network-device-plugin-fips, cosign, kind, docker-compose-fips, vault, azurefile-csi-fips, prometheus-podman-exporter-fips, knative-eventing, kots, flux-source-watcher-fips, spegel-fip...

GHSA-X4JJ-H2V8-HQQV vulnerabilities

Vulnerabilities for packages: oras-fips, newrelic-infrastructure-agent-fips, amazon-ssm-agent, rclone-fips, sriov-network-device-plugin-fips, cosign, kind, docker-compose-fips, vault, azurefile-csi-fips, prometheus-podman-exporter-fips, knative-eventing, kots, flux-source-watcher-fips, spegel-fip...

GHSA-7MR4-XJXG-34G6 vulnerabilities

Vulnerabilities for packages: virt-api, cue, newrelic-infrastructure-agent-fips, rclone-fips, sriov-network-device-plugin-fips, cosign, crossplane-provider-keycloak, step-kms-plugin-fips, secrets-store-csi-driver-provider-aws, docker-compose-fips, crossplane-provider-aws-lambda-fips,...

CVE-2026-32283 vulnerabilities

Vulnerabilities for packages: chisel, aws-signer-notation-plugin, oras-fips, virt-api, git-credential-oauth, cue, newrelic-infrastructure-agent-fips, amazon-ssm-agent, rclone-fips, sriov-network-device-plugin-fips, cosign, sbomqs, crossplane-provider-keycloak, dynamic-localpv-provisioner-fips,...

CVE-2026-32281 vulnerabilities

Vulnerabilities for packages: chisel, aws-signer-notation-plugin, oras-fips, virt-api, git-credential-oauth, cue, newrelic-infrastructure-agent-fips, amazon-ssm-agent, rclone-fips, sriov-network-device-plugin-fips, cosign, sbomqs, crossplane-provider-keycloak, dynamic-localpv-provisioner-fips,...