3368 matches found
CVE-2026-55994
Improper Input Validation, Exposure of Sensitive Information to an Unauthorized Actor, Server-Side Request Forgery SSRF vulnerability in Apache Camel in Iggy component. The camel-iggy consumer mapped the user-headers of inbound Iggy messages into the Camel Exchange header map without applying any...
CVE-2026-46726
Apache Camel Vertx Websocket: the inbound WebSocket consumer maps external query/path parameters into the Exchange header map without HeaderFilterStrategy, enabling injection of Camel headers (e.g., CamelHttpUri) and potential server-side request forgery (SSRF) to attacker-controlled URIs. The HT...
CVE-2026-46590 Apache Camel: Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)
Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata KeyMetadata through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadat...
CVE-2026-46590
CVE-2026-46590 (Apache Camel-PQC) describes a deserialization of untrusted data issue in the camel-pqc component. Hashicorp Vault and AWS Secrets Manager key lifecycle managers deserialize a Base64-wrapped value via java.io.ObjectInputStream.readObject() without an ObjectInputFilter or class allo...
CVE-2026-46590
Deserialization of Untrusted Data vulnerability in Apache Camel PQC component. The camel-pqc component persists post-quantum key metadata KeyMetadata through pluggable KeyLifecycleManager implementations. HashicorpVaultKeyLifecycleManager and AwsSecretsManagerKeyLifecycleManager read that metadat...
PT-2026-55895
Name of the Vulnerable Software and Affected Versions Apache Camel versions 4.18.0 through 4.18.2 Apache Camel versions 4.19.0 through 4.20.x Description Deserialization of untrusted data in the Apache Camel PQC component occurs when HashicorpVaultKeyLifecycleManager,...
SUSE-SU-2026:2740-1 Security update for golang-github-docker-libnetwork
This update for golang-github-docker-libnetwork fixes the following issue - CVE-2026-2808: github.com/hashicorp/consul: unvalidated user-supplied file paths can lead to arbitrary file reads through the Vault Kubernetes authentication provider bsc1259566...
CVE-2026-3605 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector, vault-fips, vault, splunk-otel-collector-fips...
GHSA-M2W4-8GGF-RJ47 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector, vault-fips, vault, splunk-otel-collector-fips...
CVE-2026-5052 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector, vault-fips, vault, splunk-otel-collector-fips...
CVE-2026-5807 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector, vault-fips, vault, splunk-otel-collector-fips...
GHSA-88V5-9HXC-F85R vulnerabilities
Vulnerabilities for packages: splunk-otel-collector, vault-fips, vault, splunk-otel-collector-fips...
CVE-2026-4525 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector, vault-fips, vault, splunk-otel-collector-fips...
GHSA-72GW-FMMR-C4R4 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector, vault-fips, vault, splunk-otel-collector-fips...
GHSA-8R5M-3F66-QPR3 vulnerabilities
Vulnerabilities for packages: splunk-otel-collector, vault-fips, vault, splunk-otel-collector-fips...
CVE-2026-5051
A flaw was found in HashiCorp Vault and Vault Enterprise. The audit device validation logic did not consistently apply plugin directory protections when a legacy file audit path option was used. This inconsistency could allow an attacker to bypass security controls, potentially leading to...
CVE-2026-5051
HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability CVE-2026-5051 is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17...
CVE-2026-5051 Audit Log Plugin Directory Guard Bypass via Legacy path Option
HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability CVE-2026-5051 is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17...
CVE-2026-5051
HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability CVE-2026-5051 is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17...
EUVD-2026-41098
HashiCorp Vault and Vault Enterprise prior to 2.0.1 audit device validation logic did not consistently apply plugin directory protections when the legacy file audit path option was used. This vulnerability CVE-2026-5051 is fixed in 2.0.1, 1.21.6, 1.20.11, and 1.19.17...