Add CVE-2026-46587, CVE-2026-46588 and CVE-2026-49042 advisories

[Croway]

Summary

Adds three new Apache Camel security advisories under content/security/:

• CVE-2026-46587 (MEDIUM) — camel-couchbase: Non-Camel-prefixed Exchange headers (CCB_KEY, CCB_ID, CCB_TTL, CCB_DDN, CCB_VN) bypass HeaderFilterStrategy allowing operation override from untrusted input. Fix: PR #23228 (main), #23230 (4.18.x), #23231 (4.14.x).
• CVE-2026-46588 (MEDIUM) — camel-couchdb: Non-Camel-prefixed Exchange headers (CouchDbDatabase, CouchDbSeq, CouchDbId, CouchDbRev, CouchDbMethod) bypass HeaderFilterStrategy allowing operation override from untrusted input. Fix: PR #23228 (main), #23230 (4.18.x), #23231 (4.14.x).
• CVE-2026-49042 (MEDIUM) — camel-langchain4j-tools/agent/spring-ai-tools: Tool argument headers are not filtered against declared parameters, allowing an LLM to inject arbitrary Exchange headers via tool call arguments. Fix: PR #23535 (main), #23551 (4.18.x). JIRA: CAMEL-23621.

Structure

• CVE-2026-46587 and CVE-2026-46588 are siblings sharing the same fix PR (#23228), with bidirectional cross-references.
• CVE-2026-49042 affects components introduced in 4.8.0+; no 4.14.x backport (the component exists but the fix was only backported to 4.18.x).
• .txt.asc (PGP-clearsigned) files are not included — the Camel security signing key is required.

Notes

• Advisory date fields are set to 2026-07-03 to match the release date of 4.14.8, 4.18.3 and 4.21.0.
• All three CVEs credit Yu Bao from PayPal.

[oscerd]

You need to publish also a txt.asc of the same.