Digest · Monday

Security digest: July 6, 2026

19 critical advisories.

Take stock

Maven: 10 critical advisories (org.apache.camel:camel-aws2-sns, org.apache.camel:camel-docling, org.apache.camel:camel-cometd, org.apache.camel:camel-keycloak, org.apache.camel:camel-dns, org.apache.camel:camel-mongodb-gridfs, org.apache.camel:camel-aws2-sqs, org.apache.camel:camel-pqc …). Check with mvn dependency:tree -Dincludes=<groupId>:<artifactId>.
npm: 3 critical advisories (9router, @xhmikosr/decompress, decompress). Check with npm audit (or: npm ls <package>).
PyPI: 3 critical advisories (langroid). Check with pip-audit (or: pip show <package>).
crates.io (Rust): 1 critical advisory (zebrad, halo2_gadgets, orchard, zcash_primitives). Check with cargo audit.
Composer (PHP): 1 critical advisory (verbb/formie). Check with composer audit.
Go: 1 critical advisory (github.com/cilium/cilium). Check with govulncheck ./....
None of it touches your stack? Then there is nothing to do today. That is a result, not a failure to read carefully.

Known exploited (CISA KEV) 0

Added to CISA’s catalog on this day: confirmed exploitation in the wild. Due date = CISA’s deadline for US federal agencies.

None.

Critical advisories by ecosystem 19

GitHub-reviewed advisories rated critical, published this day (Pacific time).

Maven 10

Check: mvn dependency:tree -Dincludes=<groupId>:<artifactId>

Apache Camel-AWS2-SNS: An inbound Camel-namespace filter was added to Sns2HeaderFilterStrategy CVE-2026-56140 CVSS 9.8 Critical
org.apache.camel:camel-aws2-sns >= 4.0.0, < 4.14.8 → fixed in 4.14.8; org.apache.camel:camel-aws2-sns >= 4.15.0, < 4.18.3 → fixed in 4.18.3; org.apache.camel:camel-aws2-sns >= 4.19.0, < 4.21.0 → fixed in 4.21.0
Apache Camel-Docling: Insufficient validation of custom CLI arguments enables argument injection and path traversal in DoclingProducer CVE-2026-40047 CVSS 9.1 Critical
org.apache.camel:camel-docling >= 4.15.0, < 4.18.3 → fixed in 4.18.3
Apache Camel-Cometd: Inbound Bayeux message headers are mapped into the Exchange without a HeaderFilterStrategy, allowing unauthenticated… CVE-2026-46454 CVSS 9.8 Critical
org.apache.camel:camel-cometd >= 4.0.0, < 4.14.8 → fixed in 4.14.8; org.apache.camel:camel-cometd >= 4.15.0, < 4.18.3 → fixed in 4.18.3; org.apache.camel:camel-cometd >= 4.19.0, < 4.21.0 → fixed in 4.21.0
Apache Camel: KeycloakSecurityPolicy has Improper Authentication, Missing Authentication for Critical Function and Failing Open… CVE-2026-53913 CVSS 9.8 Critical
org.apache.camel:camel-keycloak >= 4.15.0, < 4.18.3 → fixed in 4.18.3; org.apache.camel:camel-keycloak >= 4.19.0, < 4.21.0 → fixed in 4.21.0
Apache Camel-Keycloak: The access-token validity window is not verified because the IS_ACTIVE check is missing from the TokenVerifier… CVE-2026-46455 CVSS 9.8 Critical
org.apache.camel:camel-keycloak >= 4.18.0, < 4.18.3 → fixed in 4.18.3; org.apache.camel:camel-keycloak >= 4.19.0, < 4.21.0 → fixed in 4.21.0
Apache Camel DNS Has Improper Input Validation, Leading to Server-Side Request Forgery (SSRF) CVE-2026-48205 CVSS 9.1 Critical
org.apache.camel:camel-dns >= 4.0.0, < 4.14.8 → fixed in 4.14.8; org.apache.camel:camel-dns >= 4.15.0, < 4.18.3 → fixed in 4.18.3; org.apache.camel:camel-dns >= 4.19.0, < 4.21.0 → fixed in 4.21.0
Apache Camel: camel-mongodb-gridfs producer allows GridFS operation override and NoSQL operator injection via unfiltered gridfs.* HTTP… CVE-2026-48204 CVSS 9.8 Critical
org.apache.camel:camel-mongodb-gridfs >= 4.0.0, < 4.14.8 → fixed in 4.14.8; org.apache.camel:camel-mongodb-gridfs >= 4.15.0, < 4.18.3 → fixed in 4.18.3; org.apache.camel:camel-mongodb-gridfs >= 4.19.0, < 4.21.0 → fixed in 4.21.0
Apache Camel-AWS2-SQS: Inbound message attributes are mapped into the Exchange without an inbound HeaderFilterStrategy, allowing a message… CVE-2026-46456 CVSS 9.8 Critical
org.apache.camel:camel-aws2-sqs >= 4.0.0, < 4.14.8 → fixed in 4.14.8; org.apache.camel:camel-aws2-sqs >= 4.15.0, < 4.18.3 → fixed in 4.18.3; org.apache.camel:camel-aws2-sqs >= 4.19.0, < 4.21.0 → fixed in 4.21.0
Apache Camel-PQC: The AWS Secrets Manager key-lifecycle manager deserializes persisted key metadata with java.io.ObjectInputStream and no… CVE-2026-43867 CVSS 9.8 Critical
org.apache.camel:camel-pqc >= 4.18.0, < 4.18.3 → fixed in 4.18.3; org.apache.camel:camel-pqc >= 4.19.0, < 4.21.0 → fixed in 4.21.0
Apache Camel-Solr: The SolrParam. and SolrField. Exchange header prefixes used non-Camel-prefixed names that bypass the HTTP header… CVE-2026-48203 CVSS 9.1 Critical
org.apache.camel:camel-solr >= 4.0.0, < 4.14.8 → fixed in 4.14.8; org.apache.camel:camel-solr >= 4.15.0, < 4.18.3 → fixed in 4.18.3; org.apache.camel:camel-solr >= 4.19.0, < 4.21.0 → fixed in 4.21.0

npm 3

Check: npm audit (or: npm ls <package>)

9router has unauthenticated CRUD on /api/providers and Full API Key Leak via /api/usage/stats GHSA-vjc7-jrh9-9j86 CVSS 10.0 Critical
9router <= 0.4.41 → no fix listed
9routers has Exposure of Sensitive Information and Unprotected Database Import/Export, Allowing Complete Credential Theft and Database… CVE-2026-55500 CVSS 9.9 Critical
9router <= 0.4.71 → no fix listed
Decompress: Archive extraction can create files and links outside of the target directory CVE-2026-53486 CVSS 9.1 Critical
@xhmikosr/decompress < 10.2.1 → fixed in 10.2.1; @xhmikosr/decompress >= 11.0.0, < 11.1.3 → fixed in 11.1.3; decompress <= 4.2.1 → no fix listed

PyPI 3

Check: pip-audit (or: pip show <package>)

Langroid: Sandbox Escape to Remote Code Execution via Incomplete `eval()` Mitigation in TableChatAgent CVE-2026-54769 CVSS 10.0 Critical
langroid <= 0.65.1 → fixed in 0.65.2
Langroid: SQLChatAgent dangerous-function blocklist can be bypassed with quoted or schema-qualified pg_read_file calls CVE-2026-54760 CVSS 9.3 Critical
langroid <= 0.65.0 → fixed in 0.65.1
Langroid: Neo4jChatAgent executes LLM-generated Cypher without validation (prompt-to-Cypher injection; config-conditional RCE), mirroring… CVE-2026-55615 CVSS 9.2 Critical
langroid <= 0.65.4 → fixed in 0.65.5

Composer (PHP) 1

Check: composer audit

Formie Hidden field defaults vulnerable to Server-Side Template Injection CVE-2026-52889 CVSS 9.8 Critical
verbb/formie < 3.1.27 → fixed in 3.1.27

Go 1

Check: govulncheck ./...

Cilium vulnerable to sensitive information disclosure and cluster disruption via local Envoy admin socket access CVE-2026-49445 CVSS 9.2 Critical
github.com/cilium/cilium >= 1.19.0, < 1.19.2 → fixed in 1.19.2; github.com/cilium/cilium >= 1.18.0, < 1.18.8 → fixed in 1.18.8; github.com/cilium/cilium < 1.17.14 → fixed in 1.17.14

crates.io (Rust) 1

Check: cargo audit

Zebra: Missing copy constraint in halo2_gadgets variable-base scalar multiplication allows under-constrained base, breaking Orchard Action… CVE-2026-54496 CVSS 9.3 Critical
zebrad <= 4.5.1 → fixed in 5.0.0; halo2_gadgets < 0.5.0 → fixed in 0.5.0; orchard < 0.14.0 → fixed in 0.14.0; +1 more packages