CVE-2026-81505

Convoy is a cloud native webhooks gateway. Prior to 26.6.8, Convoy's GET /api/v1/projects/projectID/sources/sourceID endpoint authorizes access to the project in the URL, but Handler.GetSource calls sources.Service.FindSourceByID and fetches the Source only by sourceID without confirming that its...

org.apache.camel.kafkaconnector:camel-google-pubsub-kafka-connector (>=0.1.0, <=0.11.5), org.apache.camel.kafkaconnector:camel-google-pubsub-sink-kafka-connector (>=1.0.0, <=4.14.5) +14 more potentially affected by CVE-2026-40453 via org.apache.camel:camel-google-pubsub (>=3.0.0-m1, <=4.14.5)

org.apache.camel:camel-google-pubsub MAVEN version =3.0.0-m1, =0.1.0, =1.0.0, =1.0.0, =3.19.0, =4.8.0, =0.9.0, =4.7.0, =4.7.0, =1.0.0-m6, =1.0.0-m6, =1.0.0-m6, =1.5.0, =3.0.0, =3.0.0-m1, =3.0.0-rc3 - org.qubership.integration.platform...

org.apache.camel.kafkaconnector:camel-google-pubsub-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-google-pubsub-source-kafka-connector (4.18.0) +8 more potentially affected by CVE-2026-40453 via org.apache.camel:camel-google-pubsub (>=4.15.0, <=4.18.1)

org.apache.camel:camel-google-pubsub MAVEN version =4.15.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.1 Source cves: CVE-2026-40453 Source advisory: SNYK:JAVA-ORGAPACHECAMEL-16321639...

org.apache.camel.springboot:camel-google-pubsub-starter (4.19.0) potentially affected by CVE-2026-40453 via org.apache.camel:camel-google-pubsub (4.19.0)

org.apache.camel:camel-google-pubsub MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-google-pubsub and may be impacted: - org.apache.camel.springboot:camel-google-pubsub-starter 4.19.0 Source cves:...

Improper Handling of Case Sensitivity

Overview Affected versions of this package are vulnerable to Improper Handling of Case Sensitivity due to a flaw in the default filtering mechanism HeaderFilterStrategy that only blocks headers starting with specific prefixes. An attacker can execute arbitrary code and write files by injecting...

org.apache.camel.kafkaconnector:camel-google-pubsub-kafka-connector (>=0.1.0, <=0.11.5), org.apache.camel.kafkaconnector:camel-google-pubsub-sink-kafka-connector (>=1.0.0, <=4.14.5) +13 more potentially affected by CVE-2026-40453 via org.apache.camel:camel-google-pubsub (>=3.0.0, <=4.14.5)

org.apache.camel:camel-google-pubsub MAVEN version =3.0.0, =0.1.0, =1.0.0, =1.0.0, =3.19.0, =4.8.0, =0.9.0, =4.7.0, =4.7.0, =1.0.0-m6, =1.0.0-m6, =1.0.0-m6, =1.5.0, =3.0.0, =0.1.9, =0.1.6, =2025.1...

org.apache.camel.kafkaconnector:camel-google-pubsub-kafka-connector (>=0.1.0, <=0.11.5), org.apache.camel.kafkaconnector:camel-google-pubsub-sink-kafka-connector (>=1.0.0, <=4.14.5) +13 more potentially affected by CVE-2025-27636 +1 more via org.apache.camel:camel-google-pubsub (>=3.0.0, <=4.14.5)

org.apache.camel:camel-google-pubsub MAVEN version =3.0.0, =0.1.0, =1.0.0, =1.0.0, =3.19.0, =4.8.0, =0.9.0, =4.7.0, =4.7.0, =1.0.0-m6, =1.0.0-m6, =1.0.0-m6, =1.5.0, =3.0.0, =0.1.9, =0.1.6, =2025.1...

org.apache.camel.kafkaconnector:camel-google-pubsub-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-google-pubsub-source-kafka-connector (4.18.0) +8 more potentially affected by CVE-2026-40453 via org.apache.camel:camel-google-pubsub (>=4.15.0, <=4.18.1)

org.apache.camel:camel-google-pubsub MAVEN version =4.15.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.1 Source cves: CVE-2026-40453 Source advisory: OSV:GHSA-JG2M-9X48-3GVJ...

org.apache.camel.kafkaconnector:camel-google-pubsub-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-google-pubsub-source-kafka-connector (4.18.0) +8 more potentially affected by CVE-2025-27636 +1 more via org.apache.camel:camel-google-pubsub (>=4.15.0, <=4.18.1)

org.apache.camel:camel-google-pubsub MAVEN version =4.15.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.1 Source cves: CVE-2025-27636, CVE-2026-40453 Source advisory: GHSA-JG2M-9X48-3GVJ...

org.apache.camel.springboot:camel-google-pubsub-starter (4.19.0) potentially affected by CVE-2026-40453 via org.apache.camel:camel-google-pubsub (4.19.0)

org.apache.camel:camel-google-pubsub MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-google-pubsub and may be impacted: - org.apache.camel.springboot:camel-google-pubsub-starter 4.19.0 Source cves:...

org.apache.camel.springboot:camel-google-pubsub-starter (4.19.0) potentially affected by CVE-2025-27636 +1 more via org.apache.camel:camel-google-pubsub (4.19.0)

org.apache.camel:camel-google-pubsub MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-google-pubsub and may be impacted: - org.apache.camel.springboot:camel-google-pubsub-starter 4.19.0 Source cves:...

CVE-2026-40453

The fix for CVE-2025-27636 added setLowerCasetrue to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCasetrue call was not applied to five non-HTTP HeaderFilterStrategy...

CVE-2026-40453 Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection

The fix for CVE-2025-27636 added setLowerCasetrue to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCasetrue call was not applied to five non-HTTP HeaderFilterStrategy...

org.apache.camel.kafkaconnector:camel-google-pubsub-kafka-connector (>=0.1.0, <=0.11.5), org.apache.camel.kafkaconnector:camel-google-pubsub-sink-kafka-connector (>=1.0.0, <=4.14.5) +13 more potentially affected by CVE-2026-40453 via org.apache.camel:camel-google-pubsub (>=3.0.0, <=4.14.5)

org.apache.camel:camel-google-pubsub MAVEN version =3.0.0, =0.1.0, =1.0.0, =1.0.0, =3.19.0, =4.8.0, =0.9.0, =4.7.0, =4.7.0, =1.0.0-m6, =1.0.0-m6, =1.0.0-m6, =1.5.0, =3.0.0, =0.1.9, =0.1.6, =2025.1...

org.apache.camel.kafkaconnector:camel-google-pubsub-sink-kafka-connector (4.18.0), org.apache.camel.kafkaconnector:camel-google-pubsub-source-kafka-connector (4.18.0) +8 more potentially affected by CVE-2026-40453 via org.apache.camel:camel-google-pubsub (>=4.15.0, <=4.18.1)

org.apache.camel:camel-google-pubsub MAVEN version =4.15.0, =3.29.0, =3.29.0, =3.29.0, =4.15.0, =4.18.1 Source cves: CVE-2026-40453 Source advisory: MEND:CVE-2026-40453...

org.apache.camel.springboot:camel-google-pubsub-starter (4.19.0) potentially affected by CVE-2026-40453 via org.apache.camel:camel-google-pubsub (4.19.0)

org.apache.camel:camel-google-pubsub MAVEN version 4.19.0 is affected by a known vulnerability. The following packages have a transitive dependency on org.apache.camel:camel-google-pubsub and may be impacted: - org.apache.camel.springboot:camel-google-pubsub-starter 4.19.0 Source cves:...

CVE-2026-40453 Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection

The fix for CVE-2025-27636 added setLowerCasetrue to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCasetrue call was not applied to five non-HTTP HeaderFilterStrategy...

EUVD-2026-25791

The fix for CVE-2025-27636 added setLowerCasetrue to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCasetrue call was not applied to five non-HTTP HeaderFilterStrategy...

CVE-2026-40453 Apache Camel JMS, Apache Camel CoAP, Apache Camel Google PubSub: Incomplete fix for CVE-2025-27636 in non-HTTP HeaderFilterStrategies (camel-jms, camel-sjms, camel-coap, camel-google-pubsub) allows case-variant header injection

The fix for CVE-2025-27636 added setLowerCasetrue to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same setLowerCasetrue call was not applied to five non-HTTP HeaderFilterStrategy...

Security Bulletin: IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that use Google PubSub nodes are vulnerable to arbitrary code execution due to [CVE-2023-36665]

Summary Node.js module protobuf.js is used by IBM App Connect Enterprise Certified Container by the Google PubSub node. IBM App Connect Enterprise Certified Container IntegrationServer and IntegrationRuntime operands that use the Google PubSub node are vulnerable to arbitrary code execution. This...