Authorization Bypass

Apache Camel Lucene Component is vulnerable to Authorization Bypass. The vulnerability is due to the camel-lucene producer accepting the QUERY and RETURNLUCENEDOCS headers from inbound HTTP requests because HttpHeaderFilterStrategy only blocks the Camel-prefixed header namespace, where an attacke...

Cypher Injection

Apache Camel Neo4J component is vulnerable to Cypher Injection. The vulnerability is due to insufficient validation of property names in the CamelNeo4jMatchProperties map, where attacker-controlled property names are concatenated directly into Cypher queries, allowing attackers to inject arbitrar...

Deserialization Of Untrusted Data

Apache Camel PQC component is vulnerable to Deserialization Of Untrusted Data. The vulnerability is due to unfiltered Java deserialization in HashicorpVaultKeyLifecycleManager, AwsSecretsManagerKeyLifecycleManager, and the legacy-migration path of FileBasedKeyLifecycleManager, where...

Missing Authorization

Apache ActiveMQ is vulnerable to a Missing Authorization vulnerability. The vulnerability is due to temporary destination isolation being enforced only on the client side, which allows an attacker to bypass the authorization check and consume messages from another connection's temporary destinati...

Server-Side Request Forgery

Apache Camel Solr component is vulnerable to Server-Side Request Forgery. The vulnerability is due to insufficient validation of SolrParam. and SolrField. headers, where attacker-controlled HTTP headers can inject arbitrary Solr request parameters or document fields, allowing unauthorized...

Denial-of-service (DoS)

Apache HttpComponents Core is vulnerable to a denial-of-service DoS vulnerability. The vulnerability is due to the decoder processing oversized compressed HTTP/2 header blocks without applying the configured header list size limit until the SETTINGS acknowledgement, which allows a remote attacker...

Improper Neutralization Of Argument Delimiters (Argument Injection)

Apache Camel is vulnerable to Improper Neutralization of Argument Delimiters. The vulnerability is due to insufficient validation of custom CLI arguments and path values supplied through Camel headers, which allows an attacker who can influence these values to inject unintended docling command-li...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to Elasticsearch control headers lacking the Camel prefix and therefore bypassing Camel's inbound HTTP header filtering, which allows an unauthenticated attacker to inject user-controlled headers and override...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to improper inbound filtering of SQS message attributes, which allows an attacker who can send messages to the SQS queue to inject arbitrary Camel control headers, potentially influencing downstream producers such a...

Improper Input Validation

Apache Camel JIRA component is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of JIRA control headers, where attacker-controlled HTTP headers can override configured issue keys, project keys, transitions, and other operation parameters, allowing...

Improper Input Validation

Apache Camel Kafka component is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of Kafka control headers, where attacker-controlled kafka. headers can override the configured Kafka topic, partition, or timestamp, allowing unauthorized message redirecti...

Improper Input Validation

Apache Camel Salesforce is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of Salesforce control headers, where attacker-controlled HTTP headers can override configured SOQL queries, SObject parameters, or Apex REST requests, allowing unauthorized acce...

Sensitive Information Disclosure

Apache Camel Netty HTTP component is vulnerable to Sensitive Information Disclosure. The vulnerability is due to improper handling of exception responses, where processing errors return full Java stack traces instead of suppressing them, allowing attackers to obtain sensitive information such as...

Server-Side Request Forgery (SSRF)

Apache Camel is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to unfiltered WebSocket query parameters being mapped to Camel control headers, which allows an attacker to redirect server-side HTTP requests to arbitrary destinations and potentially disclose environment...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of user-supplied input, which allows an attacker to provide crafted input that can be processed in an unintended manner and potentially compromise application behavior...

Secrets Disclosure

Apache Airflow is vulnerable to Secrets Disclosure. The vulnerability is due to the AWS Systems Manager Parameter Store and Secrets Manager backends resolving a team-scoped Connection or Variable id through the team-agnostic lookup when the team-scoped lookup missed, where a caller in one team...

Server-Side Request Forgery (SSRF)

Apache Camel is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to improper filtering of inbound WebSocket query and path parameters, allowing an attacker to inject Camel control headers such as CamelHttpUri, which can redirect server-side HTTP requests to...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to the Dapr Pub/Sub consumer copying attacker-controlled CloudEvent fields into producer routing headers, which allows an attacker with permission to publish to the subscribed topic to manipulate the destination and...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of user-supplied input, allowing specially crafted input to bypass expected processing logic and potentially affect application behavior or security...

Denial Of Service (DoS)

Apache IoTDB is vulnerable to Denial Of Service DoS.The vulnerability is due to missing authentication and insufficient validation of attacker-controlled allocation sizes in the AirGap receiver, allowing unauthenticated attackers to trigger excessive memory allocation and exhaust JVM heap memory,...

Denial Of Service (DoS)

Apache IoTDB is vulnerable to Denial Of Service DoS. The vulnerability is due to uncontrolled recursion in the AirGap receiver's readLength method, where repeated E-language prefixes trigger unbounded recursive calls, allowing unauthenticated attackers to exhaust the JVM stack and cause a...

Improper Input Validation

Apache Camel is vulnerable to Improper Input Validation. The vulnerability is due to the Iggy consumer copying externally controlled message headers directly into the Camel Exchange without filtering Camel control headers, which allows an attacker who can publish messages to a consumed Iggy...

Improper Cross-Origin Resource Sharing (CORS) Configuration

Apache Helix is vulnerable to Improper Cross-Origin Resource Sharing CORS Configuration. The vulnerability is due to the REST API allowing arbitrary origins and credentials through permissive CORS headers, which allows an attacker controlling a malicious webpage to issue cross-origin requests and...

Authorization Bypass

Apache IoTDB is vulnerable to Authorization Bypass. The vulnerability is due to insufficient authorization checks in the /rest/v2/fastLastQuery endpoint, allowing authenticated users to bypass access controls and retrieve last-value query results they are not authorized to access...

Improper Input Validation

Apache Camel AWS SNS component is vulnerable to Improper Input Validation. The vulnerability is due to the absence of an inbound header-filtering rule in Sns2HeaderFilterStrategy, which could theoretically allow externally supplied message attributes to be mapped into Camel control headers;...

Server-Side Request Forgery

Apache Gravitino is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to insufficient validation of job template URIs in JobManager, allowing authenticated attackers to force the server to send HTTP requests to arbitrary internal network services or cloud metadata endpoints...

Insecure Deserialization

Apache Axis2/Java is vulnerable to Insecure Deserialization. The vulnerability is due to deserialization of untrusted data in the Tribes-based clustering component, where crafted serialized Java objects received over the clustering channel can trigger arbitrary code execution by unauthenticated...

Improper Input Validation

Apache Camel IRC component is vulnerable to Improper Input Validation. The vulnerability is due to insufficient validation of IRC control headers, where attacker-controlled irc. headers from untrusted HTTP requests can override the intended message destination, allowing unauthorized message...

Use After Free

Apache Fory is vulnerable to Use After Free. The vulnerability is due to a use-after-free flaw in the Rust deserialization logic, where a crafted Fory payload can trigger undefined behavior, leading to process crashes or potential disclosure of sensitive memory contents...

Deserialization Of Untrusted Data

Apache Camel is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to improper deserialization of a crafted JMS ObjectMessage containing an allowed DefaultExchangeHolder object, which bypasses the CVE-2026-40860 class check and allows an attacker who can publish messages to...

Deserialization Of Untrusted Data

Apache Camel is vulnerable to Deserialization of Untrusted Data. The vulnerability is due to an overly permissive ObjectInputFilter that allows classes such as java.net.URL and java.net.InetAddress during deserialization, which allows an attacker to deliver a crafted Java-serialized payload...

Cross-site Scripting (XSS)

Silverstripe CMS is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to improper escaping of page titles when rendered in CMS breadcrumbs, which allows an attacker to inject malicious JavaScript that executes in the browser when the affected page list view is accessed...

Uncontrolled Resource Consumption

Netty is vulnerable to Uncontrolled Resource Consumption. The vulnerability is due to retained partial Redis aggregate state not being cleared when the maxElements limit is exceeded, which allows an unauthenticated attacker to keep attacker-controlled state and pooled buffers retained across...

Uncontrolled Resource Consumption

jackson-core is vulnerable to uncontrolled resource consumption. The vulnerability is due to the non-blocking parser failing to enforce the maxNumberLength constraint when processing excessively long numeric tokens, which allows an attacker to submit a JSON payload containing an arbitrarily long...

Prototype Pollution

Axios is vulnerable to Prototype Pollution. The vulnerability is due to inherited username and password values from a polluted Object.prototype being used to construct the Authorization: Basic header, allowing an attacker to inject or replace Basic authentication credentials in outbound requests...

Denial Of Service

Mermaid is vulnerable to Denial Of Service. The vulnerability is due to unrestricted ticks values in Radar Diagrams, allowing an attacker to trigger excessive CPU usage and potentially exhaust memory by causing prolonged rendering...

Uncontrolled Recursion

Axios is vulnerable to Denial Of Service. The vulnerability is due to uncontrolled recursion in formDataToJSON through buildPath when processing attacker-controlled FormData field names with deeply nested brackets, allowing an attacker to exhaust the JavaScript call stack and trigger a RangeError...

MaxBodyLength Limit Bypass

axios is vulnerable to a maxBodyLength limit bypass. The vulnerability is due to the HTTP/2 request API not enforcing the configured maxBodyLength limit and axios's byte-counting stream wrapper being conditionally applied, which allows an attacker who controls a streamed request body to transmit...

Prototype Pollution

Axios is vulnerable to Prototype Pollution. The vulnerability is due to inherited data, proxy, and paramsSerializer values being read from polluted Object.prototype, allowing attackers to alter request bodies, proxy routing, or URL serialization when affected low-level paths are used...

Denial Of Service (DoS)

axios is vulnerable to Denial of Service DoS. The vulnerability is due to the fetch adapter failing to enforce maxBodyLength for unknown-length ReadableStream request bodies, which allows an attacker to bypass upload size limits and cause excessive network or resource consumption...

Cross-Site Scripting (XSS)

PDF.js is vulnerable to Cross-Site Scripting XSS. The vulnerability is due to PDF.js allowing JavaScript embedded in a malicious PDF to execute when enableScripting is enabled and no restrictive script-src CSP is configured, which allows an attacker to craft and load a malicious PDF to execute...

Server-Side Request Forgery (SSRF)

axios is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to shouldBypassProxy.js failing to recognize 0.0.0.0 as a loopback address, which allows an attacker to supply 0.0.0.0 URLs that bypass NOPROXY rules and route requests through a configured proxy to potentially acce...

Prototype Pollution

Axios is vulnerable to Prototype Pollution. The vulnerability is due to Object.prototype.proxy being able to influence the Node HTTP adapter through an un-rehardened request configuration, allowing an attacker who can pollute the prototype to route requests through an attacker-controlled proxy...

Prototype Pollution

Mermaid is vulnerable to Prototype Pollution. The vulnerability is due to assignWithDepth being used to deep-merge caller-supplied configuration into Mermaid's internal config, allowing prototype pollution when untrusted data is passed directly to configuration setters such as mermaid.initialize...

Prototype Pollution

Axios is vulnerable to prototype pollution. The vulnerability is due to nested request option objects being read without validating own properties, which allows an attacker to exploit pre-existing Object.prototype pollution to inject inherited authentication values or alter query-string...

CSS Injection

Mermaid is vulnerable to CSS Injection. The vulnerability is due to sibling combinator selectors generated from attacker-controlled diagram class or ID names, allowing CSS injection that can alter the appearance or behavior of unrelated page elements...

Server-Side Request Forgery (SSRF)

ip-address is vulnerable to Server-Side Request Forgery SSRF. The vulnerability is due to isInSubnet suppressing special-use address classification when the input CIDR mask is shorter than the reference range, allowing an attacker to use a suffix such as /0 to bypass checks like isPrivate and...

Improper Input Validation

Electron is vulnerable to Improper Input Validation. The vulnerability is due to the mode option of webContents.openDevTools not being sanitized before use by the DevTools frontend, which allows an attacker who can influence the value to execute arbitrary script in the DevTools context and...

Prototype Pollution

Mermaid is vulnerable to Prototype Pollution. The vulnerability is due to an Architecture Diagram group ID of proto being used directly as an object property key without validation, allowing an attacker who can supply diagram text to pollute Object.prototype...

Denial Of Service

Axios is vulnerable to Denial Of Service. The vulnerability is due to uncontrolled recursion in formDataToJSON when processing deeply nested FormData field names, allowing an attacker to exhaust the JavaScript call stack and trigger a RangeError...