Lucene search
+L

226408 matches found

RedhatCVE
RedhatCVE
added 2026/07/06 1:22 p.m.19 views

CVE-2026-50021

A flaw was found in pnpm, a package manager. An attacker who can modify the pnpm-lock.yaml file and control the package registry can exploit this vulnerability. By removing the integrity field from the lockfile and serving altered package content, the pnpm install --frozen-lockfile command can...

8.1CVSS6.3AI score0.00174EPSS
SaveExploits1References4
Patchstack
Patchstack
added 2026/07/06 1:19 p.m.14 views

WordPress Flatsome theme <= 3.20.5 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Bonds in WordPress Theme Flatsome versions = 3.20.5...

7.5CVSS5.9AI score0.00278EPSS
SaveExploits0Affected Software1
The Hacker News
The Hacker News
added 2026/07/06 1:01 p.m.20 views

⚡ Weekly Recap: Proxy Botnets, Browser Ransomware, AI Agent Tricks, Fake PoC Malware and More

A streaming box should not need a threat model. Neither should a username field, a demo repo, a reset flow, or a browser permission prompt. That is the irritating part this week: the risky pieces were ordinary. Home devices became a routing cover. Clean code pulled dirt from a dependency. Identit...

6.4AI score
SaveExploits0
Patchstack
Patchstack
added 2026/07/06 12:46 p.m.12 views

WordPress Kirki plugin <= 6.1.1 - Broken Access Control vulnerability

Broken Access Control vulnerability discovered by Psalms Christopher Matovu ByteOverride in WordPress Plugin Kirki versions = 6.1.1...

7.5CVSS5.2AI score0.00287EPSS
SaveExploits0Affected Software1
OSV
OSV
added 2026/07/06 9:30 a.m.10 views

GHSA-F7G3-2CG6-F5HJ Apache Camel: camel-mongodb-gridfs producer allows GridFS operation override and NoSQL operator injection via unfiltered  gridfs.*  HTTP headers

Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's operation parameter is not set - which is the...

9.8CVSS5.9AI score0.00452EPSS
SaveExploits0References6
NVD
NVD
added 2026/07/06 9:16 a.m.18 views

CVE-2026-48204

Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's operation parameter is not set - which is the...

9.8CVSS0.00452EPSS
SaveExploits0References2
NVD
NVD
added 2026/07/06 9:16 a.m.20 views

CVE-2026-46457

Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component maps inbound NATS message headers into the Camel Exchange but defaulted its headerFilterStrategy to a bare new DefaultHeaderFilterStrategy with no inbound rules configured NatsConfiguration. With no...

7.5CVSS0.00423EPSS
SaveExploits1References2
OSV
OSV
added 2026/07/06 8:13 a.m.11 views

CVE-2026-55994 Apache Camel Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategy, allowing injection of Camel control headers - enabling control over internal behaviour

Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery SSRF vulnerability in Apache Camel in Iggy component. The camel-iggy consumer mapped the user-headers of inbound Iggy messages into the Camel Exchange header map without applying any...

7.5CVSS6.1AI score
SaveExploits0References5
ATTACKERKB
ATTACKERKB
added 2026/07/06 8:10 a.m.12 views

CVE-2026-49086

Improper Input Validation, Unintended Proxy or Intermediary 'Confused Deputy' vulnerability in Apache Camel DAPR component. The camel-dapr Dapr Pub/Sub consumer DaprPubSubConsumer copied two fields from each inbound CloudEvent - its Pub/Sub component name and its topic - into the...

6AI score0.00426EPSS
SaveExploits1References2Affected Software1
EUVD
EUVD
added 2026/07/06 8:06 a.m.14 views

EUVD-2026-41839

Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's operation parameter is not set - which is the...

9.8CVSS6AI score0.00452EPSS
SaveExploits0References1
Cvelist
Cvelist
added 2026/07/06 8:06 a.m.49 views

CVE-2026-48204 Apache Camel: Camel-MongoDB-GridFS: The gridfs.* control headers used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to switch the GridFS operation - including destructive file deletion - in the default configuration

Improper Input Validation, Improper Access Control vulnerability in Apache Camel in Camel Mongodb Gridfs component. The camel-mongodb-gridfs producer selects the GridFS operation to perform from the gridfs.operation Exchange header when the endpoint's operation parameter is not set - which is the...

0.00452EPSS
SaveExploits0References1
OSV
OSV
added 2026/07/06 8:03 a.m.12 views

PYSEC-2026-767 Access control issue in AlekSIS-Core

An access control issue in aleksis/core/util/authhelpers.py: ClientProtectedResourceMixin of AlekSIS-Core v2.8.1 and below allows attackers to access arbitrary scopes if no allowed scopes are specifically set...

6.5CVSS6.1AI score0.00696EPSS
SaveExploits0References8
OSV
OSV
added 2026/07/06 8:03 a.m.8 views

PYSEC-2026-811 OpenStack Image Service (Glance) vulnerable to Improper Access Control

OpenStack Image Service Glance before 2015.1.3 kilo and 11.0.x before 11.0.2 liberty, when showmultiplelocations is enabled, allow remote authenticated users to change image status and upload new image data by removing the last location of an image...

4.3CVSS6AI score0.01466EPSS
SaveExploits0References13
OSV
OSV
added 2026/07/06 7:57 a.m.10 views

CVE-2026-46457 Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers

Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component maps inbound NATS message headers into the Camel Exchange but defaulted its headerFilterStrategy to a bare new DefaultHeaderFilterStrategy with no inbound rules configured NatsConfiguration. With no...

7.5CVSS6.2AI score
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/06 7:57 a.m.43 views

CVE-2026-46457 Apache Camel: Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client that can publish to the subject to inject Camel control headers

Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component maps inbound NATS message headers into the Camel Exchange but defaulted its headerFilterStrategy to a bare new DefaultHeaderFilterStrategy with no inbound rules configured NatsConfiguration. With no...

0.00423EPSS
SaveExploits1References1
EUVD
EUVD
added 2026/07/06 7:57 a.m.13 views

EUVD-2026-41831

Improper Input Validation vulnerability in Apache Camel NATS component. The camel-nats component maps inbound NATS message headers into the Camel Exchange but defaulted its headerFilterStrategy to a bare new DefaultHeaderFilterStrategy with no inbound rules configured NatsConfiguration. With no...

7.5CVSS6.1AI score0.00423EPSS
SaveExploits1References1
EUVD
EUVD
added 2026/07/06 7:56 a.m.17 views

EUVD-2026-41830

Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel Exchange through a component-specific HeaderFilterStrategy. Sqs2HeaderFilterStrategy configured only an outbound filter setOutFilterPattern, which...

9.8CVSS6AI score0.00641EPSS
SaveExploits0References1
CVE
CVE
added 2026/07/06 7:56 a.m.29 views

CVE-2026-46456

The CVE describes an improper input validation in Apache Camel AWS2-SQS (Sqs2HeaderFilterStrategy) where inbound SQS MessageAttributes are copied into the Camel Exchange without an inbound header filter. Specifically, Sqs2HeaderFilterStrategy only configured an outbound filter, so inbound headers...

9.8CVSS6AI score0.00641EPSS
SaveExploits0References2Affected Software1
OSV
OSV
added 2026/07/06 7:56 a.m.10 views

CVE-2026-46456 Apache Camel: Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers

Improper Input Validation vulnerability in Apache Camel AWS2-SQS Component. The camel-aws2-sqs component map inbound message attributes into the Camel Exchange through a component-specific HeaderFilterStrategy. Sqs2HeaderFilterStrategy configured only an outbound filter setOutFilterPattern, which...

9.8CVSS6.1AI score
SaveExploits0References5
Cvelist
Cvelist
added 2026/07/06 7:56 a.m.41 views

CVE-2026-46454 Apache Camel: Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers

Improper Input Validation vulnerability in Apache Camel Cometd Component. The camel-cometd component maps inbound Bayeux CometD message headers into the Camel Exchange without applying a HeaderFilterStrategy. CometdBinding.populateExchangeFromMessage copies the entire ext.CamelHeaders map supplie...

0.00706EPSS
SaveExploits1References1
Rows per page
Query Builder