NCSC-2026-0258

Vulnerability from csaf_ncscnl - Published: 2026-07-22 15:20 - Updated: 2026-07-22 15:20
Summary
Kwetsbaarheden verholpen in Oracle Financial Services
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions: NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein. NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory. This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Oracle heeft kwetsbaarheden verholpen in diverse Financial Services modules. Ook heeft Oracle updates voor diverse third-party-producten verwerkt.
Interpretaties: De kwetsbaarheden betreffen onder andere code-injectie via malafide schema's in Apache Avro, onbevoegde toegang tot gevoelige data in diverse Oracle producten, en autorisatie-omzeilingen in Spring Security. Verder zijn er problemen met onjuiste verwerking van HTTP-headers in Spring Security, onjuiste validatie van JWT-tokens in Apache Kafka, en onveilige sessiestatusbeheer in Eclipse Jetty. Ook zijn er kwetsbaarheden die leiden tot denial-of-service via resource-uitputting in Apache Netty en urllib3. Sommige kwetsbaarheden kunnen leiden tot volledige systeemcompromittering, ongeautoriseerde datamodificatie, of het lekken van gevoelige informatie. Exploitatie kan plaatsvinden via netwerktoegang, HTTP-verzoeken, of het verwerken van speciaal vervaardigde bestanden of berichten. Voor bepaalde kwetsbaarheden is gebruikersinteractie vereist, terwijl andere op afstand en zonder authenticatie kunnen worden misbruikt.
Oplossingen: Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Het wordt aanbevolen om de betreffende producten te updaten naar de gepatchte versies zoals vermeld in de advisories. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-200: Exposure of Sensitive Information to an Unauthorized Actor
CVE-2024-47561

Apache Avro versions prior to 1.11.4 contain schema parsing vulnerabilities that enable remote code execution, data disclosure, modification, and denial of service across multiple enterprise products including Red Hat JBoss, NetApp, Oracle BPM, SOA Suite, Hyperion, and HPE solutions.

9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-502 - Deserialization of Untrusted Data
Affected products
Product Identifier Version Remediation
vers:unknown/*
Oracle / Oracle Banking Branch
 vers:unknown/*
vers:unknown/*
Oracle / Oracle Banking Cash Management
 vers:unknown/*
vers:unknown/*
Oracle / Oracle Banking Corporate Lending
 vers:unknown/*
vers:unknown/*
Oracle / Oracle Banking Corporate Lending Process Management
 vers:unknown/*
vers:unknown/*
Oracle / Oracle Banking Origination
 vers:unknown/*
vers:unknown/*
Oracle / Oracle Banking Trade Finance
 vers:unknown/*
vers:unknown/*
Oracle / Oracle Banking Virtual Account Management
 vers:unknown/*
vers:unknown/*
Oracle / Oracle Financial Services Analytical Applications Infrastructure
 vers:unknown/*
vers:unknown/*
Oracle / Oracle Financial Services Behavior Detection Platform
 vers:unknown/*
vers:unknown/*
Oracle / Oracle Financial Services Compliance Studio
 vers:unknown/*
vers:unknown/*
Oracle / Oracle Financial Services Model Management and Governance
 vers:unknown/*
vers:unknown/*
Oracle / Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition
 vers:unknown/*
vers:unknown/*
Oracle Corporation / Oracle Banking Origination
 vers:unknown/*
vers:unknown/*
Oracle Corporation / Oracle Banking Trade Finance
 vers:unknown/*
vers:unknown/*
Oracle Corporation / Oracle Banking Trade Finance Process Management
 vers:unknown/*
CVE-2025-33042

Apache Avro versions up to 1.12.0 and Oracle Business Intelligence Enterprise Edition 7.6.0.0.0 and 8.2.0.0.0 contain vulnerabilities including code injection from untrusted schemas and network exploits allowing unauthorized data access and partial denial of service.

7.3 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Affected products
Known affected 15 products, the same list as for CVE-2024-47561
CVE-2025-41248

Multiple vulnerabilities affect Spring Framework versions prior to 6.4.11 and 6.5.5, Oracle Financial Services Model Management and Governance 8.1.3.2, and Oracle Banking Branch 14.5.0.0.0 to 14.8.0.0.0, enabling unauthorized access and sensitive data disclosure.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-289 - Authentication Bypass by Alternate Name
Affected products
Known affected 15 products, the same list as for CVE-2024-47561
CVE-2025-41249

Multiple vulnerabilities affect Oracle Financial Services, Oracle Retail Service Backbone, Oracle Enterprise Manager for Fusion Middleware, and certain Spring Framework versions, enabling unauthorized data access and potential sensitive information disclosure.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-863 - Incorrect Authorization
Affected products
Known affected 15 products, the same list as for CVE-2024-47561
CVE-2025-70873

SQLite versions up to 3.51.1 contain an information disclosure vulnerability in the zipfileInflate function allowing heap memory access via crafted ZIP files, with the 3.51.3 update addressing this and other security and stability issues.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-908 - Use of Uninitialized Resource
Affected products
Known affected 15 products, the same list as for CVE-2024-47561
CVE-2026-4800

Lodash versions prior to 4.18.0 contain a critical vulnerability (CVE-2021-23337) in the _.template function allowing code injection via unvalidated options.imports keys, alongside other issues including prototype pollution and denial of service.

9.8 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Affected products
Known affected 15 products, the same list as for CVE-2024-47561
CVE-2026-5795

Eclipse Jetty's JASPIAuthenticator contains a vulnerability where ThreadLocal variables are not cleared on early authentication exit, causing privilege escalation, broken access control, and potential data breaches in affected versions including Oracle REST Data Services 24.2.0-26.1.0.

7.4 (High)
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-226 - Sensitive Information in Resource Not Removed Before Reuse
Affected products
Known affected 15 products, the same list as for CVE-2024-47561
CVE-2026-21441

urllib3 versions prior to 2.6.3 improperly decompress HTTP redirect response bodies in streaming mode, leading to excessive resource consumption and denial of service vulnerabilities.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-409 - Improper Handling of Highly Compressed Data (Data Amplification)
Affected products
Known affected 15 products, the same list as for CVE-2024-47561
CVE-2026-22732

Spring Security versions 5.7.0 to 7.0.3 contain a vulnerability in servlet applications where HTTP response headers may not be written properly, potentially leading to security policy bypass and unauthorized data access.

9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-425 - Direct Request ('Forced Browsing')
Affected products
Known affected 15 products, the same list as for CVE-2024-47561
CVE-2026-22747

A vulnerability in Spring Security versions 7.0.0 through 7.0.4 allows attackers to impersonate users by exploiting improper handling of malformed X.509 certificate CN values in SubjectX500PrincipalExtractor.

6.8 (Medium)
CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N
CWE-297 - Improper Validation of Certificate with Host Mismatch
Affected products
Known affected 15 products, the same list as for CVE-2024-47561
CVE-2026-24308

Apache ZooKeeper versions 3.8.5 and 3.9.4, as well as Oracle Communications Unified Assurance 6.1.1 to 7.0.0, contain vulnerabilities that expose sensitive client configuration data via INFO level logging and allow unauthenticated access to critical data.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CWE-532 - Insertion of Sensitive Information into Log File
Affected products
Known affected 15 products, the same list as for CVE-2024-47561
CVE-2026-33557

Apache Kafka versions 4.1.0 and 4.1.1 have a critical JWT validation vulnerability allowing acceptance of any token without proper checks, and Oracle Communications Unified Assurance Message Bus versions 6.1.1 to 7.0.0 contain a critical unauthenticated access flaw with a CVSS score of 9.1.

9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-1285 - Improper Validation of Specified Index, Position, or Offset in Input
Affected products
Known affected 15 products, the same list as for CVE-2024-47561
CVE-2026-34481

Apache Log4j JsonTemplateLayout up to version 2.25.3 improperly serializes non-finite floating-point values, causing invalid JSON output and potential log processing failures, with critical vulnerabilities also affecting Oracle Enterprise Manager Base Platform.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
CWE-116 - Improper Encoding or Escaping of Output
Affected products
Known affected 15 products, the same list as for CVE-2024-47561
CVE-2026-40976

Spring Boot versions 4.0.0 through 4.0.5 contain a security vulnerability allowing default web security bypass under certain conditions, resolved in version 4.0.6 and later.

9.1 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N
CWE-862 - Missing Authorization
Affected products
Known affected 15 products, the same list as for CVE-2024-47561
CVE-2026-41044

Apache ActiveMQ versions prior to 5.19.6 and 6.2.5, including Oracle Communications Unified Assurance's Message Bus component versions 6.1.1 to 7.0.0, contain critical vulnerabilities allowing authenticated or low-privileged attackers to execute arbitrary code or fully compromise the system via HTTP access.

8.8 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-94 - Improper Control of Generation of Code ('Code Injection')
Affected products
Known affected 15 products, the same list as for CVE-2024-47561
CVE-2026-44248

Netty versions prior to 4.1.133.Final and 4.2.13.Final contain a vulnerability where MQTT 5 header Properties sections are parsed without size limits, causing excessive CPU and memory usage and enabling denial of service attacks.

7.5 (High)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CWE-770 - Allocation of Resources Without Limits or Throttling
Affected products
Known affected 15 products, the same list as for CVE-2024-47561
CVE-2026-61097

A critical vulnerability in Oracle Banking Trade Finance Process Management (v14.6.0-14.8.0) allows unauthenticated attackers with HTTP network access to manipulate data, access unauthorized information, and cause partial denial of service, scoring 9.6 on CVSS 3.1.

9.6 (Critical)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L
Affected products
Known affected 15 products, the same list as for CVE-2024-47561
CVE-2026-61102

A critical vulnerability in Oracle Banking Trade Finance versions 14.6.0 to 14.8.0 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1.

8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
Known affected 15 products, the same list as for CVE-2024-47561
CVE-2026-61105

A critical vulnerability in Oracle Banking Trade Finance versions 14.6.0 to 14.8.0 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1.

8.1 (High)
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N
Affected products
Known affected 15 products, the same list as for CVE-2024-47561
CVE-2026-61220

A vulnerability in Oracle Banking Origination 14.5.0.16.0 allows unauthenticated attackers with HTTP network access to perform unauthorized read and write operations on accessible data, with a CVSS 3.1 base score of 6.1.

6.1 (Medium)
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Affected products
Known affected 15 products, the same list as for CVE-2024-47561
References
To clipboard 

{
  "document": {
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE"
      }
    },
    "lang": "nl",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n    NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n    NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n    This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
      },
      {
        "category": "description",
        "text": "Oracle heeft kwetsbaarheden verholpen in diverse Financial Services modules. Ook heeft Oracle updates voor diverse third-party-producten verwerkt.",
        "title": "Feiten"
      },
      {
        "category": "description",
        "text": "De kwetsbaarheden betreffen onder andere code-injectie via malafide schema\u0027s in Apache Avro, onbevoegde toegang tot gevoelige data in diverse Oracle producten, en autorisatie-omzeilingen in Spring Security. Verder zijn er problemen met onjuiste verwerking van HTTP-headers in Spring Security, onjuiste validatie van JWT-tokens in Apache Kafka, en onveilige sessiestatusbeheer in Eclipse Jetty. Ook zijn er kwetsbaarheden die leiden tot denial-of-service via resource-uitputting in Apache Netty en urllib3. Sommige kwetsbaarheden kunnen leiden tot volledige systeemcompromittering, ongeautoriseerde datamodificatie, of het lekken van gevoelige informatie. Exploitatie kan plaatsvinden via netwerktoegang, HTTP-verzoeken, of het verwerken van speciaal vervaardigde bestanden of berichten. Voor bepaalde kwetsbaarheden is gebruikersinteractie vereist, terwijl andere op afstand en zonder authenticatie kunnen worden misbruikt.",
        "title": "Interpretaties"
      },
      {
        "category": "description",
        "text": "Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Het wordt aanbevolen om de betreffende producten te updaten naar de gepatchte versies zoals vermeld in de advisories. Zie bijgevoegde referenties voor meer informatie.",
        "title": "Oplossingen"
      },
      {
        "category": "general",
        "text": "medium",
        "title": "Kans"
      },
      {
        "category": "general",
        "text": "high",
        "title": "Schade"
      },
      {
        "category": "general",
        "text": "Exposure of Sensitive Information to an Unauthorized Actor",
        "title": "CWE-200"
      }
    ],
    "publisher": {
      "category": "coordinator",
      "contact_details": "cert@ncsc.nl",
      "name": "Nationaal Cyber Security Centrum",
      "namespace": "https://www.ncsc.nl/"
    },
    "references": [
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.oracle.com/security-alerts/cpujul2026.html"
      },
      {
        "category": "external",
        "summary": "Reference",
        "url": "https://www.oracle.com/security-alerts/cpujul2026verbose.html"
      }
    ],
    "title": "Kwetsbaarheden verholpen in Oracle Financial Services",
    "tracking": {
      "current_release_date": "2026-07-22T15:20:37.999858Z",
      "generator": {
        "date": "2025-08-04T16:30:00Z",
        "engine": {
          "name": "V.A.",
          "version": "1.3"
        }
      },
      "id": "NCSC-2026-0258",
      "initial_release_date": "2026-07-22T15:20:37.999858Z",
      "revision_history": [
        {
          "date": "2026-07-22T15:20:37.999858Z",
          "number": "1.0.0",
          "summary": "Initiele versie"
        }
      ],
      "status": "final",
      "version": "1.0.0"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-1"
                }
              }
            ],
            "category": "product_name",
            "name": "Oracle Banking Branch"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-2"
                }
              }
            ],
            "category": "product_name",
            "name": "Oracle Banking Cash Management"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-3"
                }
              }
            ],
            "category": "product_name",
            "name": "Oracle Banking Corporate Lending"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-4"
                }
              }
            ],
            "category": "product_name",
            "name": "Oracle Banking Corporate Lending Process Management"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-5"
                }
              }
            ],
            "category": "product_name",
            "name": "Oracle Banking Origination"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-6"
                }
              }
            ],
            "category": "product_name",
            "name": "Oracle Banking Trade Finance"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-7"
                }
              }
            ],
            "category": "product_name",
            "name": "Oracle Banking Virtual Account Management"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-8"
                }
              }
            ],
            "category": "product_name",
            "name": "Oracle Financial Services Analytical Applications Infrastructure"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-9"
                }
              }
            ],
            "category": "product_name",
            "name": "Oracle Financial Services Behavior Detection Platform"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-10"
                }
              }
            ],
            "category": "product_name",
            "name": "Oracle Financial Services Compliance Studio"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-11"
                }
              }
            ],
            "category": "product_name",
            "name": "Oracle Financial Services Model Management and Governance"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-12"
                }
              }
            ],
            "category": "product_name",
            "name": "Oracle Financial Services Trade-Based Anti Money Laundering Enterprise Edition"
          }
        ],
        "category": "vendor",
        "name": "Oracle"
      },
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-13"
                }
              }
            ],
            "category": "product_name",
            "name": "Oracle Banking Origination"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-14"
                }
              }
            ],
            "category": "product_name",
            "name": "Oracle Banking Trade Finance"
          },
          {
            "branches": [
              {
                "category": "product_version_range",
                "name": "vers:unknown/*",
                "product": {
                  "name": "vers:unknown/*",
                  "product_id": "CSAFPID-15"
                }
              }
            ],
            "category": "product_name",
            "name": "Oracle Banking Trade Finance Process Management"
          }
        ],
        "category": "vendor",
        "name": "Oracle Corporation"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-47561",
      "cwe": {
        "id": "CWE-502",
        "name": "Deserialization of Untrusted Data"
      },
      "notes": [
        {
          "category": "other",
          "text": "Deserialization of Untrusted Data",
          "title": "CWE-502"
        },
        {
          "category": "description",
          "text": "Apache Avro versions prior to 1.11.4 contain schema parsing vulnerabilities that enable remote code execution, data disclosure, modification, and denial of service across multiple enterprise products including Red Hat JBoss, NetApp, Oracle BPM, SOA Suite, Hyperion, and HPE solutions.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10",
          "CSAFPID-11",
          "CSAFPID-12",
          "CSAFPID-13",
          "CSAFPID-14",
          "CSAFPID-15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-47561 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2024/cve-2024-47561.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10",
            "CSAFPID-11",
            "CSAFPID-12",
            "CSAFPID-13",
            "CSAFPID-14",
            "CSAFPID-15"
          ]
        }
      ],
      "title": "CVE-2024-47561"
    },
    {
      "cve": "CVE-2025-33042",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
          "title": "CWE-94"
        },
        {
          "category": "description",
          "text": "Apache Avro versions up to 1.12.0 and Oracle Business Intelligence Enterprise Edition 7.6.0.0.0 and 8.2.0.0.0 contain vulnerabilities including code injection from untrusted schemas and network exploits allowing unauthorized data access and partial denial of service.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10",
          "CSAFPID-11",
          "CSAFPID-12",
          "CSAFPID-13",
          "CSAFPID-14",
          "CSAFPID-15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-33042 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-33042.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.3,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10",
            "CSAFPID-11",
            "CSAFPID-12",
            "CSAFPID-13",
            "CSAFPID-14",
            "CSAFPID-15"
          ]
        }
      ],
      "title": "CVE-2025-33042"
    },
    {
      "cve": "CVE-2025-41248",
      "cwe": {
        "id": "CWE-289",
        "name": "Authentication Bypass by Alternate Name"
      },
      "notes": [
        {
          "category": "other",
          "text": "Authentication Bypass by Alternate Name",
          "title": "CWE-289"
        },
        {
          "category": "other",
          "text": "Incorrect Authorization",
          "title": "CWE-863"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities affect Spring Framework versions prior to 6.4.11 and 6.5.5, Oracle Financial Services Model Management and Governance 8.1.3.2, and Oracle Banking Branch 14.5.0.0.0 to 14.8.0.0.0, enabling unauthorized access and sensitive data disclosure.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10",
          "CSAFPID-11",
          "CSAFPID-12",
          "CSAFPID-13",
          "CSAFPID-14",
          "CSAFPID-15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-41248 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-41248.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10",
            "CSAFPID-11",
            "CSAFPID-12",
            "CSAFPID-13",
            "CSAFPID-14",
            "CSAFPID-15"
          ]
        }
      ],
      "title": "CVE-2025-41248"
    },
    {
      "cve": "CVE-2025-41249",
      "cwe": {
        "id": "CWE-863",
        "name": "Incorrect Authorization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Incorrect Authorization",
          "title": "CWE-863"
        },
        {
          "category": "description",
          "text": "Multiple vulnerabilities affect Oracle Financial Services, Oracle Retail Service Backbone, Oracle Enterprise Manager for Fusion Middleware, and certain Spring Framework versions, enabling unauthorized data access and potential sensitive information disclosure.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10",
          "CSAFPID-11",
          "CSAFPID-12",
          "CSAFPID-13",
          "CSAFPID-14",
          "CSAFPID-15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-41249 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-41249.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10",
            "CSAFPID-11",
            "CSAFPID-12",
            "CSAFPID-13",
            "CSAFPID-14",
            "CSAFPID-15"
          ]
        }
      ],
      "title": "CVE-2025-41249"
    },
    {
      "cve": "CVE-2025-70873",
      "cwe": {
        "id": "CWE-908",
        "name": "Use of Uninitialized Resource"
      },
      "notes": [
        {
          "category": "other",
          "text": "Use of Uninitialized Resource",
          "title": "CWE-908"
        },
        {
          "category": "other",
          "text": "Improper Clearing of Heap Memory Before Release (\u0027Heap Inspection\u0027)",
          "title": "CWE-244"
        },
        {
          "category": "description",
          "text": "SQLite versions up to 3.51.1 contain an information disclosure vulnerability in the zipfileInflate function allowing heap memory access via crafted ZIP files, with the 3.51.3 update addressing this and other security and stability issues.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10",
          "CSAFPID-11",
          "CSAFPID-12",
          "CSAFPID-13",
          "CSAFPID-14",
          "CSAFPID-15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2025-70873 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-70873.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10",
            "CSAFPID-11",
            "CSAFPID-12",
            "CSAFPID-13",
            "CSAFPID-14",
            "CSAFPID-15"
          ]
        }
      ],
      "title": "CVE-2025-70873"
    },
    {
      "cve": "CVE-2026-4800",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
          "title": "CWE-94"
        },
        {
          "category": "other",
          "text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
          "title": "CWE-77"
        },
        {
          "category": "description",
          "text": "Lodash versions prior to 4.18.0 contain a critical vulnerability (CVE-2021-23337) in the _.template function allowing code injection via unvalidated options.imports keys, alongside other issues including prototype pollution and denial of service.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10",
          "CSAFPID-11",
          "CSAFPID-12",
          "CSAFPID-13",
          "CSAFPID-14",
          "CSAFPID-15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-4800 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-4800.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.8,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10",
            "CSAFPID-11",
            "CSAFPID-12",
            "CSAFPID-13",
            "CSAFPID-14",
            "CSAFPID-15"
          ]
        }
      ],
      "title": "CVE-2026-4800"
    },
    {
      "cve": "CVE-2026-5795",
      "cwe": {
        "id": "CWE-226",
        "name": "Sensitive Information in Resource Not Removed Before Reuse"
      },
      "notes": [
        {
          "category": "other",
          "text": "Sensitive Information in Resource Not Removed Before Reuse",
          "title": "CWE-226"
        },
        {
          "category": "description",
          "text": "Eclipse Jetty\u0027s JASPIAuthenticator contains a vulnerability where ThreadLocal variables are not cleared on early authentication exit, causing privilege escalation, broken access control, and potential data breaches in affected versions including Oracle REST Data Services 24.2.0-26.1.0.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10",
          "CSAFPID-11",
          "CSAFPID-12",
          "CSAFPID-13",
          "CSAFPID-14",
          "CSAFPID-15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-5795 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-5795.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10",
            "CSAFPID-11",
            "CSAFPID-12",
            "CSAFPID-13",
            "CSAFPID-14",
            "CSAFPID-15"
          ]
        }
      ],
      "title": "CVE-2026-5795"
    },
    {
      "cve": "CVE-2026-21441",
      "cwe": {
        "id": "CWE-409",
        "name": "Improper Handling of Highly Compressed Data (Data Amplification)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Handling of Highly Compressed Data (Data Amplification)",
          "title": "CWE-409"
        },
        {
          "category": "description",
          "text": "urllib3 versions prior to 2.6.3 improperly decompress HTTP redirect response bodies in streaming mode, leading to excessive resource consumption and denial of service vulnerabilities.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:H",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10",
          "CSAFPID-11",
          "CSAFPID-12",
          "CSAFPID-13",
          "CSAFPID-14",
          "CSAFPID-15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-21441 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-21441.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10",
            "CSAFPID-11",
            "CSAFPID-12",
            "CSAFPID-13",
            "CSAFPID-14",
            "CSAFPID-15"
          ]
        }
      ],
      "title": "CVE-2026-21441"
    },
    {
      "cve": "CVE-2026-22732",
      "cwe": {
        "id": "CWE-425",
        "name": "Direct Request (\u0027Forced Browsing\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Direct Request (\u0027Forced Browsing\u0027)",
          "title": "CWE-425"
        },
        {
          "category": "other",
          "text": "Improper Handling of Missing Special Element",
          "title": "CWE-166"
        },
        {
          "category": "description",
          "text": "Spring Security versions 5.7.0 to 7.0.3 contain a vulnerability in servlet applications where HTTP response headers may not be written properly, potentially leading to security policy bypass and unauthorized data access.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10",
          "CSAFPID-11",
          "CSAFPID-12",
          "CSAFPID-13",
          "CSAFPID-14",
          "CSAFPID-15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-22732 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-22732.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10",
            "CSAFPID-11",
            "CSAFPID-12",
            "CSAFPID-13",
            "CSAFPID-14",
            "CSAFPID-15"
          ]
        }
      ],
      "title": "CVE-2026-22732"
    },
    {
      "cve": "CVE-2026-22747",
      "cwe": {
        "id": "CWE-297",
        "name": "Improper Validation of Certificate with Host Mismatch"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Validation of Certificate with Host Mismatch",
          "title": "CWE-297"
        },
        {
          "category": "other",
          "text": "Improper Certificate Validation",
          "title": "CWE-295"
        },
        {
          "category": "description",
          "text": "A vulnerability in Spring Security versions 7.0.0 through 7.0.4 allows attackers to impersonate users by exploiting improper handling of malformed X.509 certificate CN values in SubjectX500PrincipalExtractor.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10",
          "CSAFPID-11",
          "CSAFPID-12",
          "CSAFPID-13",
          "CSAFPID-14",
          "CSAFPID-15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-22747 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-22747.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.8,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10",
            "CSAFPID-11",
            "CSAFPID-12",
            "CSAFPID-13",
            "CSAFPID-14",
            "CSAFPID-15"
          ]
        }
      ],
      "title": "CVE-2026-22747"
    },
    {
      "cve": "CVE-2026-24308",
      "cwe": {
        "id": "CWE-532",
        "name": "Insertion of Sensitive Information into Log File"
      },
      "notes": [
        {
          "category": "other",
          "text": "Insertion of Sensitive Information into Log File",
          "title": "CWE-532"
        },
        {
          "category": "other",
          "text": "Improper Output Neutralization for Logs",
          "title": "CWE-117"
        },
        {
          "category": "description",
          "text": "Apache ZooKeeper versions 3.8.5 and 3.9.4, as well as Oracle Communications Unified Assurance 6.1.1 to 7.0.0, contain vulnerabilities that expose sensitive client configuration data via INFO level logging and allow unauthenticated access to critical data.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10",
          "CSAFPID-11",
          "CSAFPID-12",
          "CSAFPID-13",
          "CSAFPID-14",
          "CSAFPID-15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-24308 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-24308.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10",
            "CSAFPID-11",
            "CSAFPID-12",
            "CSAFPID-13",
            "CSAFPID-14",
            "CSAFPID-15"
          ]
        }
      ],
      "title": "CVE-2026-24308"
    },
    {
      "cve": "CVE-2026-33557",
      "cwe": {
        "id": "CWE-1285",
        "name": "Improper Validation of Specified Index, Position, or Offset in Input"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Validation of Specified Index, Position, or Offset in Input",
          "title": "CWE-1285"
        },
        {
          "category": "other",
          "text": "Incorrect Implementation of Authentication Algorithm",
          "title": "CWE-303"
        },
        {
          "category": "description",
          "text": "Apache Kafka versions 4.1.0 and 4.1.1 have a critical JWT validation vulnerability allowing acceptance of any token without proper checks, and Oracle Communications Unified Assurance Message Bus versions 6.1.1 to 7.0.0 contain a critical unauthenticated access flaw with a CVSS score of 9.1.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10",
          "CSAFPID-11",
          "CSAFPID-12",
          "CSAFPID-13",
          "CSAFPID-14",
          "CSAFPID-15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-33557 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-33557.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10",
            "CSAFPID-11",
            "CSAFPID-12",
            "CSAFPID-13",
            "CSAFPID-14",
            "CSAFPID-15"
          ]
        }
      ],
      "title": "CVE-2026-33557"
    },
    {
      "cve": "CVE-2026-34481",
      "cwe": {
        "id": "CWE-116",
        "name": "Improper Encoding or Escaping of Output"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Encoding or Escaping of Output",
          "title": "CWE-116"
        },
        {
          "category": "other",
          "text": "Improper Handling of Unexpected Data Type",
          "title": "CWE-241"
        },
        {
          "category": "description",
          "text": "Apache Log4j JsonTemplateLayout up to version 2.25.3 improperly serializes non-finite floating-point values, causing invalid JSON output and potential log processing failures, with critical vulnerabilities also affecting Oracle Enterprise Manager Base Platform.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:H/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:L/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10",
          "CSAFPID-11",
          "CSAFPID-12",
          "CSAFPID-13",
          "CSAFPID-14",
          "CSAFPID-15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-34481 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-34481.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10",
            "CSAFPID-11",
            "CSAFPID-12",
            "CSAFPID-13",
            "CSAFPID-14",
            "CSAFPID-15"
          ]
        }
      ],
      "title": "CVE-2026-34481"
    },
    {
      "cve": "CVE-2026-40976",
      "cwe": {
        "id": "CWE-862",
        "name": "Missing Authorization"
      },
      "notes": [
        {
          "category": "other",
          "text": "Missing Authorization",
          "title": "CWE-862"
        },
        {
          "category": "other",
          "text": "Authentication Bypass by Primary Weakness",
          "title": "CWE-305"
        },
        {
          "category": "description",
          "text": "Spring Boot versions 4.0.0 through 4.0.5 contain a security vulnerability allowing default web security bypass under certain conditions, resolved in version 4.0.6 and later.",
          "title": "Summary"
        },
        {
          "category": "general",
          "text": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N",
          "title": "CVSSV4"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10",
          "CSAFPID-11",
          "CSAFPID-12",
          "CSAFPID-13",
          "CSAFPID-14",
          "CSAFPID-15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-40976 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-40976.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.1,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10",
            "CSAFPID-11",
            "CSAFPID-12",
            "CSAFPID-13",
            "CSAFPID-14",
            "CSAFPID-15"
          ]
        }
      ],
      "title": "CVE-2026-40976"
    },
    {
      "cve": "CVE-2026-41044",
      "cwe": {
        "id": "CWE-94",
        "name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
      },
      "notes": [
        {
          "category": "other",
          "text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
          "title": "CWE-94"
        },
        {
          "category": "description",
          "text": "Apache ActiveMQ versions prior to 5.19.6 and 6.2.5, including Oracle Communications Unified Assurance\u0027s Message Bus component versions 6.1.1 to 7.0.0, contain critical vulnerabilities allowing authenticated or low-privileged attackers to execute arbitrary code or fully compromise the system via HTTP access.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10",
          "CSAFPID-11",
          "CSAFPID-12",
          "CSAFPID-13",
          "CSAFPID-14",
          "CSAFPID-15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-41044 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-41044.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10",
            "CSAFPID-11",
            "CSAFPID-12",
            "CSAFPID-13",
            "CSAFPID-14",
            "CSAFPID-15"
          ]
        }
      ],
      "title": "CVE-2026-41044"
    },
    {
      "cve": "CVE-2026-44248",
      "cwe": {
        "id": "CWE-770",
        "name": "Allocation of Resources Without Limits or Throttling"
      },
      "notes": [
        {
          "category": "other",
          "text": "Allocation of Resources Without Limits or Throttling",
          "title": "CWE-770"
        },
        {
          "category": "description",
          "text": "Netty versions prior to 4.1.133.Final and 4.2.13.Final contain a vulnerability where MQTT 5 header Properties sections are parsed without size limits, causing excessive CPU and memory usage and enabling denial of service attacks.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10",
          "CSAFPID-11",
          "CSAFPID-12",
          "CSAFPID-13",
          "CSAFPID-14",
          "CSAFPID-15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-44248 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-44248.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10",
            "CSAFPID-11",
            "CSAFPID-12",
            "CSAFPID-13",
            "CSAFPID-14",
            "CSAFPID-15"
          ]
        }
      ],
      "title": "CVE-2026-44248"
    },
    {
      "cve": "CVE-2026-61097",
      "notes": [
        {
          "category": "description",
          "text": "A critical vulnerability in Oracle Banking Trade Finance Process Management (v14.6.0-14.8.0) allows unauthenticated attackers with HTTP network access to manipulate data, access unauthorized information, and cause partial denial of service, scoring 9.6 on CVSS 3.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10",
          "CSAFPID-11",
          "CSAFPID-12",
          "CSAFPID-13",
          "CSAFPID-14",
          "CSAFPID-15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-61097 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61097.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 9.6,
            "baseSeverity": "CRITICAL",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10",
            "CSAFPID-11",
            "CSAFPID-12",
            "CSAFPID-13",
            "CSAFPID-14",
            "CSAFPID-15"
          ]
        }
      ],
      "title": "CVE-2026-61097"
    },
    {
      "cve": "CVE-2026-61102",
      "notes": [
        {
          "category": "description",
          "text": "A critical vulnerability in Oracle Banking Trade Finance versions 14.6.0 to 14.8.0 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10",
          "CSAFPID-11",
          "CSAFPID-12",
          "CSAFPID-13",
          "CSAFPID-14",
          "CSAFPID-15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-61102 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61102.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10",
            "CSAFPID-11",
            "CSAFPID-12",
            "CSAFPID-13",
            "CSAFPID-14",
            "CSAFPID-15"
          ]
        }
      ],
      "title": "CVE-2026-61102"
    },
    {
      "cve": "CVE-2026-61105",
      "notes": [
        {
          "category": "description",
          "text": "A critical vulnerability in Oracle Banking Trade Finance versions 14.6.0 to 14.8.0 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10",
          "CSAFPID-11",
          "CSAFPID-12",
          "CSAFPID-13",
          "CSAFPID-14",
          "CSAFPID-15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-61105 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61105.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10",
            "CSAFPID-11",
            "CSAFPID-12",
            "CSAFPID-13",
            "CSAFPID-14",
            "CSAFPID-15"
          ]
        }
      ],
      "title": "CVE-2026-61105"
    },
    {
      "cve": "CVE-2026-61220",
      "notes": [
        {
          "category": "description",
          "text": "A vulnerability in Oracle Banking Origination 14.5.0.16.0 allows unauthenticated attackers with HTTP network access to perform unauthorized read and write operations on accessible data, with a CVSS 3.1 base score of 6.1.",
          "title": "Summary"
        }
      ],
      "product_status": {
        "known_affected": [
          "CSAFPID-1",
          "CSAFPID-2",
          "CSAFPID-3",
          "CSAFPID-4",
          "CSAFPID-5",
          "CSAFPID-6",
          "CSAFPID-7",
          "CSAFPID-8",
          "CSAFPID-9",
          "CSAFPID-10",
          "CSAFPID-11",
          "CSAFPID-12",
          "CSAFPID-13",
          "CSAFPID-14",
          "CSAFPID-15"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2026-61220 | NCSC-NL Website",
          "url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61220.json"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "baseScore": 6.1,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
            "version": "3.1"
          },
          "products": [
            "CSAFPID-1",
            "CSAFPID-2",
            "CSAFPID-3",
            "CSAFPID-4",
            "CSAFPID-5",
            "CSAFPID-6",
            "CSAFPID-7",
            "CSAFPID-8",
            "CSAFPID-9",
            "CSAFPID-10",
            "CSAFPID-11",
            "CSAFPID-12",
            "CSAFPID-13",
            "CSAFPID-14",
            "CSAFPID-15"
          ]
        }
      ],
      "title": "CVE-2026-61220"
    }
  ]
}



Log in or create an account to share your comment.




Tags
Taxonomy of the tags.





Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.

Sightings

Author Source Type Date Other

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.