CVE Tools
Track your stack

Camel

117 CVEs tracked. None of them is in CISA KEV.

This hub aggregates every CVE we track for Camel, a product in the oss libraries space. Use it to gauge the current risk picture and drill into individual advisories.

Camel CVEs per month

Dec 2024 to Nov 2026. Point at a month, or focus the strip and use the arrow keys.
Camel CVEs per month
MonthCVEs
2024-120
2025-010
2025-020
2025-032
2025-041
2025-050
2025-060
2025-070
2025-080
2025-090
2025-100
2025-110
2025-120
2026-011
2026-022
2026-030
2026-049
2026-051
2026-060
2026-0734
2026-088
2026-093
2026-1031
2026-110

Severity

How the 117 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.

  • Critical3126%
  • High4135%
  • Medium4236%
  • Low33%

Latest CVEs

The 15 most recently published vulnerabilities affecting Camel.

  1. CVE-2026-95628Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)5.4
  2. CVE-2026-95629Apache Camel: Camel-Docling Unvalidated Output Path Header Enables Writing Conversion Output to an Arbitrary Directory5.4
  3. CVE-2026-95663Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token Expiry4.8
  4. CVE-2026-95664Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple Expressions5.4
  5. CVE-2026-101259Apache Camel: Camel-CoAP Information Disclosure via Unmuted Consumer Exceptions5.3
  6. CVE-2026-88900Apache Camel: Camel-JGroups: Unsafe Java Deserialization of Cluster Messages in the JGroups Consumer Can Lead to Remote Code Execution8.8
  7. CVE-2026-85317Apache Camel: Camel-HTTP OAuth2 Token Confusion via an Under-Keyed JVM-Global Token Cache4.8
  8. CVE-2026-85316Apache Camel: Camel-Platform-HTTP Unintended Proxy Mode via Prefix Path Matching4.8
  9. CVE-2026-85315Apache Camel: Camel-gRPC Information Disclosure via Unmuted Consumer Exceptions5.3
  10. CVE-2026-85314Apache Camel: Camel-Mail Header Injection via Unfiltered mail.smtp Headers in the MimeMultipart Data Format (Incomplete Fix of CVE-2026-46584)6.5
  11. CVE-2026-85313Apache Camel: Camel-Jetty Cross-Origin Credential Exposure via Allow-All CrossOriginFilter Defaults When enableCORS Is Set4.3
  12. CVE-2026-85312Apache Camel: Camel-Core Saga Participation Hijacking via the Unfiltered Long-Running-Action Header4.8
  13. CVE-2026-85296Apache Camel: Camel-AS2 Cross-Partner Signing Key Confusion via Shared Per-Request State6.5
  14. CVE-2026-85260Apache Camel: Camel-MLLP Protected Health Information Disclosure to Logs by Default5.5
  15. CVE-2026-85257Apache Camel: Camel-CXF Information Disclosure via Unmuted Consumer Exceptions5.3

Product grouping is registry-driven, with AI assist and human review. How it works