Browse CVEs by Ecosystem and Severity

install -D: symlink race in directory creation allows arbitrary file overwrite

install: TOCTOU symlink race (unlink-then-create without O_EXCL) allows arbitrary file overwrite

chmod: --preserve-root bypassed by any path that resolves to root (e.g. /../)

Scriban: Template Writes to Arbitrary CLR Properties via `TypedObjectAccessor` (Mass Assignment + `private` / `init` / `internal` Setter Bypass)

Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access

Formie Hidden field defaults vulnerable to Server-Side Template Injection

Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF)

Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open Vulnerabilities

Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy

Apache Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter, allowing an HTTP client to inject Solr query parameters (server-side request forgery) and document fields

Apache Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter (incomplete remediation of CVE-2026-40048)

Apache Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message sender to inject Camel control headers

Apache Camel: camel-mongodb-gridfs producer allows GridFS operation override and NoSQL operator injection via unfiltered  gridfs.*  HTTP headers

Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the HTTP header filter, allowing an HTTP client to redirect the invoked SOAP operation

Apache Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without validation, allowing Cypher injection (incomplete remediation of CVE-2025-66169)

Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when transferException is enabled

Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no ObjectInputFilter

Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosure

Apache Camel JMS deserialization filter bypass

Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier, allowing expired tokens to be accepted

Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated clients to inject Camel control headers

Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer

Apache Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code execution

Gitea pre-receive hook scanner errors allow branch-protection bypass

Gitea OAuth2 authorization codes can be reused after expiry

Gitea repository creation accepts insufficiently validated fields

Gitea template repository generation follows unsafe filesystem paths

Gitea OAuth2 PKCE S256 verifier bypass

Gitea LFS mirror operations bypass migration HTTP transport protections

Recce server has unauthenticated SQL execution that allows local file read/write through DuckDB

9router's Hardcoded Default fallback JWT Secret Allows Authentication Bypass

LaunchServer FileServerHandler has an unauthenticated path traversal issue

jxl-grid on 32-bit platforms has an out-of-bounds writes due to integer overflow

fast-mcp-telegram: Bearer token path traversal bypasses reserved Telegram session protection

Steeltoe: TLS private keys written to /tmp with default permissions, never deleted

Steeltoe's static JWKS cache shared across schemes and never invalidated

Steeltoe's sensitive actuators (heapdump/env) only require Restricted permission

Steeltoe's env sanitizer misses connection strings — leaks embedded DB passwords

Steeltoe.Discovery.Eureka: Unrecognized DataCenterInfo.Name poisons entire registry fetch

Steeltoe vulnerable to management-port isolation bypass via spoofed Host header

Zebra Address Book Aborted by IPv4-Mapped Mempool Misbehavior Update

SimpleSAMLphp HTTP-Artifact TLS validator confusion allows cross-IdP authentication bypass

9router: Missing Authorization and OS Command Injection

zebrad has persistent on-disk corruption of Sapling/Orchard subtree roots after chain fork via pop_tip

Mautic vulnerable to Path Traversal via Campaign Import

Mautic has Server-Side Template Injection (SSTI) in Theme Templates

Zebra: Repeated Non-Finalized Shielded Transaction Aborts Zebra Before Duplicate-Nullifier Rejection

zebrad has consensus divergence via P2SH sigop undercount in pure-Rust disabled-opcode parser