CVE-2026-85313 Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which acce...

CVE-2026-85313

The Apache Camel Jetty component is vulnerable to a Permissive Cross-domain Policy with Untrusted Domains (CWE-942) when the enableCORS option is used. The vulnerability arises because enableCORS installs Jetty's CrossOriginFilter with default settings that accept every origin and allow credentia...

EUVD-2026-104201

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which acce...

CVE-2026-85313 Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which acce...

Apache ActiveMQ < 5.16.5/5.17.3 - Remote Code Execution

Once an user is authenticated on Jolokia, he can potentially trigger arbitrary code execution. In details, in ActiveMQ configurations, jetty allows org.jolokia.http.AgentServlet to handler request to /api/jolokia org.jolokia.http.HttpRequestHandlerhandlePostRequest is able to create JmxRequest...

PT-2026-117360

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which acce...

CVE-2026-85313: Permissive Cross-domain Policy with Untrusted Domains

Permissive Cross-domain Policy with Untrusted Domains vulnerability in Apache Camel Jetty component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Setting enableCORS on a Jetty endpoint installed Jetty's CrossOriginFilter with its stock defaults, which acce...

DeliberatelyVulnerableWebApp

Deliberately Vulnerable Web Application Struts 2 This project is a Java web application using the Struts 2 framework. It is built with Maven and can be run using the Jetty server. Prerequisites Java Development Kit JDK 8 or higher Apache Maven 3.6.0 or higher Getting Started Build the project mvn...

jetty-9.4.31.v20200723_CVE-2023-26049

This repository does not have a README...

Linux Distros Unpatched Vulnerability : CVE-2026-18662

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse Jetty, across various versions of jetty-security, and jetty-eeN-security, two or more security constraints with the same http-method-omission set, an...

Linux Distros Unpatched Vulnerability : CVE-2026-18661

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse Jetty, across various versions of jetty-annotations, and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed...

CVE-2026-19864

A flaw was found in Eclipse Jetty. The session authentication mechanism retains user credentials in session objects, which can cause plaintext passwords to be written to persistent storage when authenticated sessions are saved. An attacker with read access to the persistent session data store can...

CVE-2026-18662

A flaw was found in Eclipse Jetty. When multiple security constraints are configured with identical HTTP method omission definitions and no URL patterns, the server improperly overrides earlier constraints rather than combining their rules as required by the Jakarta Servlet specification. A remot...

CVE-2026-76182

A flaw was found in Eclipse Jetty. When configured to forward requests to template Uniform Resource Identifiers URIs using TryPathsHandler or TryFilesFilter, path values are not properly encoded before substitution into query strings. A remote attacker can exploit this flaw by sending requests...

CVE-2026-76184

A flaw was found in Eclipse Jetty's HttpClient. When handling HTTP redirects containing path traversal sequences, the client fails to normalize the destination path before matching stored authentication credentials. A remote attacker who controls redirect responses can exploit this issue to cause...

CVE-2026-77711

A flaw was found in Eclipse Jetty's HttpClient. A malicious destination server can cause an information disclosure of proxy authentication credentials when client requests are routed through a forward proxy. By returning a proxy authentication challenge, the server misleads the client into...

CVE-2026-18659

A flaw was found in Eclipse Jetty. A remote attacker can bypass security constraints by sending HTTP requests containing substrings of configured HTTP methods when method omission rules are used. This issue allows unauthorized users to access protected resources and endpoints that should be...

CVE-2026-18660

A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to bypass access controls and reach restricted resources. The issue occurs because the server and proxy components perform case-sensitive validation on host allowlists and denylists. By sending requests with altered...

CVE-2026-18660

In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case...

Linux Distros Unpatched Vulnerability : CVE-2026-18660

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - In Eclipse Jetty, across various versions of jetty-server, and jetty-proxy, the host whitelist/blacklist is case-sensitive, and would allow hosts through that...