CVE-2026-98445

A flaw was found in the Linux kernel's XFS file system. A local user could cause a Denial of Service DoS by triggering an online file system repair under low-memory conditions. When a memory allocation failure occurs during repair block reservation, the kernel cannot cleanly recover from the erro...

Directory Traversal

Overview Affected versions of this package are vulnerable to Directory Traversal via the process that resolves remote file paths from server directory listings without constraining them to the intended polling directory. An attacker can access, delete, or rename files outside the intended directo...

BIT-PARSE-2026-109301 Parse Server before 8.6.95 and 9.0.0 before 9.10.2 Denial of Service via File Pointer Without URL

Parse Server before 8.6.95 and 9.0.0 before 9.10.2 does not resolve file references lacking a URL before passing objects to Cloud Code triggers and LiveQuery, causing an uncaught exception that terminates the process. Attackers able to write to a class with Cloud Code save, find, or delete trigge...

CVE-2026-91858

FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURESECUREPROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone...

CVE-2026-85250

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which build...

CVE-2026-79984

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Camel Mina SFTP component. This issue affects Apache Camel: from 4.18.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the...

CVE-2026-79985

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Camel SMB component. This issue affects Apache Camel: from 4.2.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the absolut...

CVE-2026-79986

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Camel Azure Files component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the...

CVE-2026-79983

Improper Limitation of a Pathname to a Restricted Directory 'Path Traversal' vulnerability in Apache Camel FTP component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. The Camel remote-file consumers poll a directory on a remote server and build the absolut...

Security Bulletin: IBM App Connect Enterprise is vulnerable to an arbitrary file write (CVE-2026-17437)

Summary IBM App Connect Enterprise Toolkit is vulnerable to an arbitrary file write. Vulnerability Details CVEID:CVE-2026-17437 DESCRIPTION: IBM App Connect Enterprise could allow a local attacker to perform an arbitrary file write due to improper validation of pathnames during archive extraction...

EUVD-2026-104208

FopProducer transforms the incoming XSL-FO message body by creating a javax.xml.transform.TransformerFactory through TransformerFactory.newInstance and enabling only FEATURESECUREPROCESSING before running an identity transform over the body. On the JDK's built-in transformer, that feature alone...

CVE-2026-85300

The Apache Camel PQC component is vulnerable to Incorrect Default Permissions (CWE-276) in versions 4.12.0 to 4.18.5 and 4.19.0 to 4.22.1. The root cause is that the component writes generated key material to disk using default process umask permissions instead of restricting access to the owner....

CVE-2026-85300 Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions

Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. When the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than...

CVE-2026-85300 Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions

Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. When the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than...

CVE-2026-85300 Apache Camel: Camel-PQC Private Key Disclosure via Key Material Written with Default File Permissions

Incorrect Default Permissions vulnerability in Apache Camel PQC component. This issue affects Apache Camel: from 4.12.0 before 4.18.5, from 4.19.0 before 4.22.1. When the component wrote generated key material to disk it did so with the permissions the process default umask produced, rather than...

CVE-2026-85250

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which build...

EUVD-2026-104191

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which build...

CVE-2026-85250

Apache Camel is vulnerable to Improper Restriction of XML External Entity Reference (CWE-611) within its XPath component . The flaw occurs when the documentType is set to InputSource, causing the XPathBuilder to use javax.xml.xpath defaults. This bypasses Camel's standard hardening, allowing an a...

CVE-2026-85250 Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which build...

CVE-2026-85250 Apache Camel: Camel-XPath XML External Entity Processing and File Disclosure via the documentType=InputSource Option

Improper Restriction of XML External Entity Reference vulnerability in Apache Camel XPath component. This issue affects Apache Camel: from 4.0.0 before 4.18.5, from 4.19.0 before 4.22.1. With documentType set to InputSource, XPathBuilder handed the payload straight to javax.xml.xpath, which build...