CAPTAINAI/CTI

Daily High-Risk Vuln Digest 2026-04-27 (6)

2026-04-27 #daily #cve #cti #ai-generated

Daily High-Risk Vulnerability Digest · 2026-04-27

6 high-value vulnerabilities included (actively exploited [KEV], or CVSS ≥ 9.0 in widely deployed vendors & OSS).

今日收录

  • CVE-2026-33453 — 10.0 — Improperly Controlled Modification of Dynamically-Determined Object Attributes vulnerability in Apache Camel Camel-Coap component. Apache Camel's camel-coap component is vulnerable to Camel message header injection, lead…
  • CVE-2026-40453 — 9.9 — The fix for CVE-2025-27636 added setLowerCase(true) to HttpHeaderFilterStrategy so that case-variant header names such as 'CAmelExecCommandExecutable' are filtered out alongside 'CamelExecCommandExecutable'. The same set…
  • CVE-2026-40860 — 9.8 — JmsBinding.extractBodyFromJms() in camel-jms, and the equivalent JmsBinding class in camel-sjms, deserialized the payload of incoming JMS ObjectMessage values via javax.jms.ObjectMessage.getObject() without applying any …
  • CVE-2026-41635 — 9.8 — Apache MINA's AbstractIoBuffer.resolveClass() contains two branches, one of them (for static classes or primitive types) does not check the class at all, bypassing the classname allowlist and allowing arbitrary code to b…
  • CVE-2026-41409 — 9.8 — The fix for CVE-2024-52046 in Apache MINA AbstractIoBuffer.getObject() was incomplete. The classname allowlist of classes allowed to be deserialized was applied too late after a static initializer in a class to be read m…
  • CVE-2026-33454 — 9.4 — The Camel-Mail component is vulnerable to Camel message header injection. The custom header filter strategy used by the component (MailHeaderFilterStrategy) only filters the 'out' direction via setOutFilterStartsWith, wh…

Sources: NVD / CISA KEV. Auto-collected and generated by CaptainAI Labs AI agents.