Apache Camel

Every one of the 103 is a mark on the map. Named now: 1 to 26, most at risk first.

1. Apache Camel camel-coap - Remote Code ExecutionCVE-2026-33453Apache Software Foundation · CVSS 10 · 9.2% likely

   CWE-915

2. Apache Camel: Camel Message Header Injection via Improper FilteringCVE-2025-27636Apache Software Foundation · CVSS 5.6 · 97% likely

   CWE-178

3. Apache Camel: Camel Message Header Injection through request parametersCVE-2025-29891Apache Software Foundation · CVSS 4.8 · 76% likely

   CWE-164

4. Apache Camel: Camel-CXF Message Header Injection via Missing Inbound FilteringCVE-2026-47323Apache Software Foundation · CVSS 9.8 · 20% likely

   CWE-178

5. Apache Camel's JMX is vulnerable to Rebind Flaw. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.x, 3.0.0 up to 3.1.0 is affected. Users should upgrade to 3.2.0.CVE-2020-11971Apache · 14% likely
6. Apache Camel's Jackson and JacksonXML unmarshalling operation are vulnerable to Remote Code Execution attacks.CVE-2016-8749Apache Software Foundation · 11% likely

   CWE-502

7. Apache Camel prior to 2.24.0 contains an XML external entity injection (XXE) vulnerability (CWE-611) due to using an outdated vulnerable JSON-lib library. This affects only the ca…CVE-2019-0188Apache · 9.8% likely

   CWE-611

8. Apache Camel's Mail 2.20.0 through 2.20.3, 2.21.0 through 2.21.1 and 2.22.0 is vulnerable to path traversal.CVE-2018-8041Apache Software Foundation · 9.6% likely

   CWE-22

9. Apache Camel's File is vulnerable to directory traversal. Camel 2.21.0 to 2.21.3, 2.22.0 to 2.22.2, 2.23.0 and the unsupported Camel 2.x (2.19 and earlier) versions may be also af…CVE-2019-0194Apache · 8.5% likely

   CWE-22

10. The camel-castor component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data ca…CVE-2017-12634Apache Software Foundation · 7.2% likely

    CWE-502

11. The camel-hessian component in Apache Camel 2.x before 2.19.4 and 2.20.x before 2.20.1 is vulnerable to Java object de-serialisation vulnerability. De-serializing untrusted data c…CVE-2017-12633Apache Software Foundation · 7.2% likely

    CWE-502

12. Apache Camel Netty enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x us…CVE-2020-11973Apache · 6.8% likely

    CWE-502

13. Apache Camel's camel-snakeyaml component is vulnerable to Java object de-serialization vulnerability. De-serializing untrusted data can lead to security flaws.CVE-2017-3159Apache Software Foundation · 6.3% likely

    CWE-502

14. Apache Camel's Validation Component is vulnerable against SSRF via remote DTDs and XXE.CVE-2017-5643Apache Software Foundation · 5.9% likely

    CWE-918

15. Apache Camel RabbitMQ enables Java deserialization by default. Apache Camel 2.22.x, 2.23.x, 2.24.x, 2.25.0, 3.0.0 up to 3.1.0 are affected. 2.x users should upgrade to 2.25.1, 3.x…CVE-2020-11972Apache · 5.7% likely

    CWE-502

16. Apache Camel 2.20.0 to 2.20.3 and 2.21.0 Core is vulnerable to XXE in XSD validation processor.CVE-2018-8027Apache Software Foundation · 5.4% likely

    CWE-611

17. Server-Side Template Injection and arbitrary file disclosure on Camel templating componentsCVE-2020-11994Apache · 4.5% likely

    CWE-74

18. Apache Camel: Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducerCVE-2026-40047Apache Software Foundation · CVSS 9.1 · 2.4% likelycovered by CyberSIXT

    CWE-881 article

19. Apache Camel: Unsafe Deserialization of JMS ObjectMessage in camel-jms, camel-sjms, camel-sjms2 and camel-amqpCVE-2026-40860Apache Software Foundation · CVSS 9.8 · 1.7% likely

    CWE-502

20. Apache Camel: Inbound Header Filter Missing in MailHeaderFilterStrategy Allows Remote Code Execution via MIME Header Injection (CVE-2025-30177 Variant)CVE-2026-33454Apache Software Foundation · CVSS 9.4 · 1.5% likely

    CWE-502

21. Apache Camel: Camel-Infinispan: Unsafe Deserialization in Remote Aggregation RepositoryCVE-2026-40858Apache Software Foundation · CVSS 8.8 · 1.3% likely

    CWE-502

22. Apache Camel: Camel-Undertow Message Header Injection via Improper FilteringCVE-2025-30177Apache Software Foundation · CVSS 6.5 · 1.3% likely

    CWE-164

23. Apache Camel: Camel-CassandraQL: Unsafe Deserialization from CassandraAggregationRepositoryCVE-2024-23114Apache Software Foundation · CVSS 9.8 · 1.3% likely

    CWE-502

24. Apache Camel: Unsafe Java deserialization in camel-consul ConsulRegistry allows arbitrary code execution via malicious values read from the Consul KV storeCVE-2026-27172Apache Software Foundation · CVSS 8.8 · 1.2% likely

    CWE-502

25. Apache Camel: Camel-Hazelcast Managed Instances Missing Java Deserialization Filter (Incomplete Fix for CVE-2026-43865)CVE-2026-78162Apache Software Foundation · CVSS 10 · 1.1% likely

    CWE-502

26. Apache Camel: camel-azure-files resolved the remote path of a polled file from the name reported in the server directory listing without constraining it to the directory being pol…CVE-2026-79986Apache Software Foundation · CVSS 7.4 · 1.0% likely

    CWE-22

exploited in the wildcheck availableringed, named or not: CyberSIXT has reported on it

Zoom in on the map and the dots under the middle of it are named where they are.