CVE Vulnerability Catalog

An improper input validation vulnerability has been discovered in Apache Camel. This flaw allows an attacker to inject malicious data, potentially leading to unexpected application behavior.

A vulnerability in SUSE Rancher Fleet allows forgery of unauthenticated webhook requests, which can be exploited by a remote attacker to cause a denial of service (DoS) or a downgrade attack on other repositories in the system. The issue affects versions 0.15 before 0.15.2, 0.14 before 0.14.6, 0.13 before 0.13.11, and 0.12 before 0.12.5.

A flaw in Red Hat Advanced Cluster Security for Kubernetes (RHACS) allows an authenticated user with a valid API token to send deeply nested GraphQL queries, causing excessive resource consumption in Central and resulting in a denial of service for the management plane.

A vulnerability in the Iggy component of Apache Camel allows an attacker to inject Camel control headers, including CamelHttpUri, by publishing messages to the consumed Iggy stream/topic. In a route with an Iggy consumer and an HTTP producer, this can lead to server-side request forgery (SSRF) and, via placeholder resolution, disclosure of environment variables, application properties, and vault secrets.

A vulnerability in the Atmosphere Websocket component of Apache Camel allows an attacker to inject internal Camel control headers via WebSocket query parameters. This leads to Server-Side Request Forgery (SSRF) and exposure of sensitive information such as environment variables, application properties, and vault secrets.

A vulnerability in Apache Camel's Vertx Websocket component allows an attacker to inject Camel control headers, including CamelHttpUri, via WebSocket query parameters. This leads to server-side request forgery (SSRF) and exposure of sensitive information such as environment variables, application properties, and vault secrets. Affected versions: 4.0.0 to 4.14.7, 4.15.0 to 4.18.2, and 4.19.0 to 4.20.0.

A vulnerability in the Apache Camel CXF SOAP component allows an attacker to manipulate the operationName/operationNamespace headers to invoke an unintended WSDL operation on the backend. The lack of a Camel prefix in these headers prevents filtering at the HTTP boundary, allowing them to pass from an HTTP request into the Exchange. This enables a confused-deputy attack where a read operation can be replaced with a destructive one.

A vulnerability in the Neo4J component of Apache Camel allows Cypher injection through property names in the CamelNeo4jMatchProperties map. Although property values are bound as parameters, JSON key names are concatenated verbatim into the query, enabling an attacker to alter the query structure and perform arbitrary operations on the Neo4j database.

Untrusted data deserialization vulnerability in Apache Camel's PQC component allows remote code execution via a crafted Java object. The flaw stems from missing input filtering when reading post-quantum key metadata from HashiCorp Vault, AWS Secrets Manager, and local file backends.

A vulnerability in the Apache Camel Lucene component allows improper input validation and authorization bypass via a user-controlled key. An attacker can set the QUERY header in an HTTP request to execute arbitrary Lucene queries, including reading the entire index or performing expensive regex queries, without proper credentials.

Improper input validation in Apache Camel's camel-nats component allows injection of Camel control headers via NATS messages. The missing header filtering lets attackers modify Camel route behavior, such as redirecting HTTP requests or changing file names.

In SUSE Rancher AI Agent versions 1.0 before 1.0.2, when DEBUG log level is set, API keys or LLM response text with potentially sensitive data may be leaked into log files. A local attacker could misuse the obtained data or credentials.

A vulnerability in Apache Camel (JMS components) allows deserialization of untrusted data by bypassing the CVE-2026-40860 fix. An attacker can publish a JMS ObjectMessage with a DefaultExchangeHolder object, which passes the allow-list check, and then write arbitrary data into the Camel Exchange, manipulating routing, headers, and properties.

Deserialization of untrusted data vulnerability in Apache Camel Hazelcast component. The default Hazelcast configuration applies no deserialization filter, allowing an attacker to achieve remote code execution by sending a crafted Java object to the Hazelcast cluster. Affects versions 4.0.0 before 4.14.8, 4.15.0 before 4.18.3, and 4.19.0 before 4.21.0.

Deserialization of untrusted data vulnerability in Apache Camel allows an attacker to trigger DNS queries by delivering a crafted Java payload. The issue stems from the default ObjectInputFilter pattern that permits java.net.URL and java.net.InetAddress classes, enabling data exfiltration via an out-of-band DNS side channel.

A vulnerability in Apache Camel allows remote code execution via deserialization of untrusted data in the camel-vertx-http component. An attacker can exploit a man-in-the-middle position or compromised backend to deliver a crafted Java object, leading to code execution on the Camel host.

An uncontrolled resource consumption vulnerability exists in Apache IoTDB. Some interfaces fail to impose reasonable limits on the time span and aggregation interval of queries, allowing an attacker to craft a request with extreme parameters, leading to Java heap exhaustion and DataNode crash.

Prog Management System developed by PROG MIS has a SQL Injection vulnerability, allowing unauthenticated remote attackers to inject arbitrary SQL commands to read database contents.

A vulnerability was found in create-react-app up to version 5.0.1 on macOS. The startBrowserProcess function in openBrowser.js of the react-dev-utils component allows OS command injection. Remote exploitation is possible and the exploit is publicly available.

The Admin and Site Enhancements (ASE) WordPress plugin before version 8.8.4 does not perform authentication, authorization, or nonce checks on a role-restoration request handler, allowing unauthenticated attackers to restore a previously demoted administrator account back to the administrator role. This is an incomplete fix of CVE-2024-43333 / CVE-2025-24648, which closed the issue for only one of the demotion paths the WordPress role API exposes.