CVE-2026-78165

Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1. RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was...

Millions of California students’ sensitive data stolen in breach

Personal information belonging to millions of current and former California public school students has been stolen from a system operated by Educational Testing Service ETS. ETS is a nonprofit organization that helps run the state’s standardized tests under contract with the California Department...

kernel: dm cache policy smq: fix missing locks in invalidating cache blocks

A flaw was found in the Linux kernel's device-mapper dm cache policy, specifically within the smq module. In passthrough mode, the invalidatemapping operation lacks proper locking, allowing for concurrent access. This can lead to data races, resulting in data corruption or use-after-free issues,...

EUVD-2026-104197

Exposure of Data Element to Wrong Session vulnerability in Apache Camel AS2 component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. Signing material belonging to an individual request was stored in state that is shared across requests rather than confined ...

CVE-2026-85260

Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log...

EUVD-2026-104196

Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log...

CVE-2026-85260

The Apache Camel MLLP component is vulnerable to Insertion of Sensitive Information into Log File (CWE-532). In affected versions (4.0.0 to before 4.18.5, and 4.19.0 to before 4.22.1), the logPhi option defaulted to true , causing protected health information (PHI) from HL7 clinical messages to b...

CVE-2026-85260 Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default

Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log...

CVE-2026-85260 Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default

Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log...

CVE-2026-85260 Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default

Insertion of Sensitive Information into Log File vulnerability in Apache Camel MLLP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-mllp component carries a logPhi option that governs whether HL7 payload content may be written to the log...

CVE-2026-85245 Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target

Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Thrift data format unmarshalled incoming data into the shared defaultInstance of the target type rather than into a...

CVE-2026-85245

The Apache Camel camel-thrift component is vulnerable to a cross-exchange data disclosure (CWE-488) because the ThriftDataFormat.unmarshal function uses a shared process-wide defaultInstance for deserialization. When unmarshalling, state from a previous message persists in the shared object if su...

CVE-2026-85245

Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Thrift data format unmarshalled incoming data into the shared defaultInstance of the target type rather than into a...

CVE-2026-85245 Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target

Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Thrift data format unmarshalled incoming data into the shared defaultInstance of the target type rather than into a...

EUVD-2026-104186

Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Thrift data format unmarshalled incoming data into the shared defaultInstance of the target type rather than into a...

CVE-2026-85245 Apache Camel: Camel-Thrift Cross-Exchange Data Disclosure via a Shared Deserialization Target

Exposure of Data Element to Wrong Session vulnerability in Apache Camel Thrift component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Thrift data format unmarshalled incoming data into the shared defaultInstance of the target type rather than into a...

CVE-2026-111408

Deserialization of Untrusted Data vulnerability in ExpressTech Quiz And Survey Master quiz-master-next allows Object Injection.This issue affects Quiz And Survey Master: from n/a through 11.2.7...

Exploit for CVE-2026-85245

CVE-2026-85245 — camel-thrift: cross-exchange data disclosure...

CVE-2026-78165

Deserialization of Untrusted Data vulnerability in Apache Camel Spring Redis component. This issue affects Apache Camel: from 2.11.0 before 4.18.5, from 4.19.0 before 4.22.1. RedisConfiguration.getSerializer lazily built a bare JdkSerializationRedisSerializer whenever no serializer option was...

CVE-2026-78162 Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)

Deserialization of Untrusted Data vulnerability in Apache Camel. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The camel-hazelcast component applies a default Hazelcast JavaSerializationFilterConfig to the instances it creates from its own configuration, a...