GHSA-FHX5-2XQW-2CGM vulnerabilities

Vulnerabilities for packages: camunda-zeebe, debezium-server, request-9047-keycloak-fips, traccar, keycloak-fips, reposilite, airbyte-platform, traccar-fips, debezium, keycloak, airbyte-platform-fips, camunda...

GHSA-GRFQ-R75J-RW9X vulnerabilities

Vulnerabilities for packages: camunda-zeebe, debezium-server, request-9047-keycloak-fips, traccar, keycloak-fips, reposilite, airbyte-platform, traccar-fips, debezium, keycloak, airbyte-platform-fips, camunda...

CVE-2026-119276 vulnerabilities

Vulnerabilities for packages: camunda-zeebe, debezium-server, request-9047-keycloak-fips, traccar, keycloak-fips, reposilite, airbyte-platform, traccar-fips, debezium, keycloak, airbyte-platform-fips, camunda...

CVE-2026-119280 vulnerabilities

Vulnerabilities for packages: camunda-zeebe, debezium-server, request-9047-keycloak-fips, traccar, keycloak-fips, reposilite, airbyte-platform, traccar-fips, debezium, keycloak, airbyte-platform-fips, camunda...

CVE-2026-119281 vulnerabilities

Vulnerabilities for packages: camunda-zeebe, debezium-server, request-9047-keycloak-fips, traccar, keycloak-fips, reposilite, airbyte-platform, traccar-fips, debezium, keycloak, airbyte-platform-fips, camunda...

GHSA-H599-M3W5-9M7X vulnerabilities

Vulnerabilities for packages: camunda-zeebe, debezium-server, request-9047-keycloak-fips, traccar, keycloak-fips, reposilite, airbyte-platform, traccar-fips, debezium, keycloak, airbyte-platform-fips, camunda...

GHSA-4JQ2-8V3C-97W8 vulnerabilities

Vulnerabilities for packages: camunda-zeebe, debezium-server, request-9047-keycloak-fips, traccar, keycloak-fips, reposilite, airbyte-platform, traccar-fips, debezium, keycloak, airbyte-platform-fips, camunda...

CVE-2026-119210 vulnerabilities

Vulnerabilities for packages: camunda-zeebe, debezium-server, request-9047-keycloak-fips, traccar, keycloak-fips, reposilite, airbyte-platform, traccar-fips, debezium, keycloak, airbyte-platform-fips, camunda...

VulnCheck KEV: CVE-2026-109432

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the...

CVE-2026-41854 vulnerabilities

Vulnerabilities for packages: camunda-zeebe...

GHSA-7M2P-62GW-P8QQ vulnerabilities

Vulnerabilities for packages: camunda-zeebe...

CVE-2026-109432

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the...

CVE-2026-109433

Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled. Attackers with...

CVE-2026-109431

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains a missing authorization check vulnerability in engine-rest task sub-resources that allows authenticated attackers with no permission grants to access task comments and attachments by calling singular read and delete endpoints that...

CVE-2026-109433 Camunda Broken Access Control via Cockpit

Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled. Attackers with...

CVE-2026-109433

Camunda versions 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 are vulnerable to an authorization bypass in the Cockpit webapp . The root cause is an inverted comparison logic within the AbstractCockpitPluginResource.isPermissionDisabled() method. Authenticated attackers with minimal Cockpit ac...

EUVD-2026-104393

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled. Attackers with...

CVE-2026-109433 Camunda Broken Access Control via Cockpit

Camunda 7.24.0 before 7.24.16 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled. Attackers with...

CVE-2026-109433

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an authorization bypass vulnerability in the Cockpit webapp that allows authenticated attackers to bypass permission checks due to an inverted comparison logic in AbstractCockpitPluginResource.isPermissionDisabled. Attackers with...

CVE-2026-109432 Camunda Expression Injection via orQueries RCE

Camunda 7.24.0 before 7.24.14 and 7.23.0 before 7.23.17 contains an expression injection vulnerability where AdhocQueryValidator.validate fails to check sub-query expression maps within the orQueries field exposed by TaskQueryDto, allowing authenticated users to bypass the...