Apache product

Camel

← All Apache products

No Camel CVE is in the CISA KEV catalogue.

Tracked since 26 Oct · latest article Mon 26 Oct · RSS

Open KEV deadlines: 0; None open
Added to KEV · 90 days: 0; of 0 in the full CISA catalogue · all time
High exploit odds · current: 0; EPSS top 5%, not in KEV
Articles · 7 days: 1; usual rate

Exploited, by due date

CSV download

No Camel CVE is in the CISA KEV catalogue.

Coverage

1 article · all timeFull timeline

One article so far, 26 Oct. A pattern appears once more outlets cover Camel.

Mon 26 Oct · first reportApache Camel fixes eight flaws, including an XXE vulnerabilitySecurityOnline

All CVEs in coverage

CVE-2026-95628Apache Camel: Camel-Docling Custom CLI Argument Path Validation Does Not Reject Absolute Paths (Incomplete Fix of CVE-2026-40047)CVSSUnrated–Not in KEV0.3%EPSS1article

CVE-2026-95664Apache Camel: Camel-AWS2-S3 Producer Evaluates Untrusted S3 Object Keys From the CamelAwsS3Key Header as Simple ExpressionsCVSSUnrated–Not in KEV0.3%EPSS1article

CVE-2026-95663Apache Camel: Camel-Keycloak Security Policy Accepts Expired Access Tokens Because Cached Token Introspection Results Are Not Bounded by the Token ExpiryCVSSUnrated–Not in KEV0.2%EPSS1article

CVE-2026-94386Apache Camel: Camel-OAuth Cross-Scope Token Reuse via an Under-Keyed JVM-Global Client Credentials Token CacheCVSS4.8Medium–Not in KEV–EPSS1article

CVE-2026-90885Apache Camel: Camel-Saxon XML External Entity Processing - XQueryBuilder Parsed a Message Body That Was Already a javax.xml.transform.Source With Saxon's Default Parser Settings, so an External Entity Declared in That Body Was ResolvedCVSSUnrated–Not in KEV–EPSS1article

How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.

Camel

Exploited, by due date

Coverage

All CVEs in coverage

On this device

Intel

Settings

Keyboard shortcuts