Maven vulnerabilities

Browse known CVEs and advisories by package and ecosystem. Severity tells you the worst case. What determines real risk is whether the vulnerable code actually runs in your applications.

Get a demo

Browse by ecosystem

npmPyPIMavenGoRubyGemsCargoNuGetComposerpubSwiftGitHub Actions
CVE-IDSeverityPackage summary
CVE-2026-49099Mediumorg.apache.camel:camel-salesforce: Apache Camel-Salesforce: Non-Camel-prefixed Exchange header constants bypass the HTTP header filterCVE-2026-55993Highorg.apache.camel:camel-atmosphere-websocket: Apache Camel-Atmosphere-Websocket: The inbound consumer maps externally-supplied WebSocket query parameters into the Exchange without a…CVE-2026-55994Highorg.apache.camel:camel-iggy: Apache Camel-Iggy: The inbound consumer maps externally-supplied Iggy message user-headers into the Exchange without a HeaderFilterStrategyCVE-2026-56140Criticalorg.apache.camel:camel-aws2-sns: Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategyCVE-2026-48204Criticalorg.apache.camel:camel-mongodb-gridfs: Apache Camel: camel-mongodb-gridfs producer allows GridFS operation override and NoSQL operator injection via unfiltered  gridfs.*  HTTP…CVE-2026-46592Highorg.apache.camel:camel-cxf-soap: Apache Camel-CXF: The SOAP operation-selection headers used non-Camel-prefixed names (operationName, operationNamespace) that bypass the…CVE-2026-46590Highorg.apache.camel:camel-pqc: Apache Camel-PQC: The HashiCorp Vault and AWS Secrets Manager key-lifecycle managers deserialize persisted key metadata with…CVE-2026-46726Highorg.apache.camel:camel-vertx-websocket: Apache Camel-Vertx-Websocket: The inbound consumer maps externally-supplied WebSocket query and path parameters into the Exchange without a…CVE-2026-46585Highorg.apache.camel:camel-lucene: Apache Camel-Lucene: The query control headers used non-Camel-prefixed names (QUERY, RETURN_LUCENE_DOCS) that bypass the HTTP header…CVE-2026-46591Highorg.apache.camel:camel-neo4j: Apache Camel-Neo4j: JSON property names from the CamelNeo4jMatchProperties header are interpolated into the Cypher WHERE clause without…CVE-2026-46456Criticalorg.apache.camel:camel-aws2-sqs: Apache Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message…CVE-2026-48203Criticalorg.apache.camel:camel-solr: Apache Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header filter,…CVE-2026-46584Loworg.apache.camel:camel-mail: Apache Camel-Mail: The mail producer applied attacker-supplied mail.smtp.* / mail.smtps.* message headers as JavaMail session propertiesCVE-2026-46453Mediumorg.apache.camel:camel-elasticsearch-rest-client: Apache Camel-Elasticsearch-Rest-Client: Exchange header constants without the Camel prefix bypass inbound HTTP header filtering, allowing…CVE-2026-43866Highorg.apache.camel:camel-jms: Apache Camel JMS deserialization filter bypassCVE-2026-43867Criticalorg.apache.camel:camel-pqc: Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no…CVE-2026-46454Criticalorg.apache.camel:camel-cometd: Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated…CVE-2026-46457Highorg.apache.camel:camel-nats: Apache Camel-NATS: Inbound NATS message headers are mapped into the Exchange without a configured HeaderFilterStrategy, allowing a client…CVE-2026-40047Criticalorg.apache.camel:camel-docling: Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducerCVE-2026-40859Highorg.apache.camel:camel-vertx-http: Apache Camel-Vertx-Http and Camel-Netty-Http: Unsafe Java deserialization of HTTP response bodies via a raw ObjectInputStream when…CVE-2026-43865Highorg.apache.camel:camel-hazelcast: Apache Camel-Hazelcast: Unsafe Java deserialization in default-configured managed Hazelcast instances enables remote code executionCVE-2026-46455Criticalorg.apache.camel:camel-keycloak: Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier,…CVE-2026-42527Highorg.apache.camel:camel-jms: Apache Camel: Permissive default ObjectInputFilter pattern admits java.net.** and enables DNS-based information disclosureCVE-2026-54617Criticalpro.gravit.launcher:launchserver-api: LaunchServer FileServerHandler has an unauthenticated path traversal issueCVE-2026-2092Highorg.keycloak:keycloak-services: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions

Stop the waste.
Protect your environment with Kodem.

Get a personalized demo
Get a personalized demo