NCSC-2026-0449
Vulnerability from csaf_ncscnl - Published: 2026-10-22 12:04 - Updated: 2026-10-22 12:04Summary
Meerdere kwetsbaarheden verholpen in Oracle Java
Notes
The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:
NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.
NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.
This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings.
Feiten: Oracle heeft meerdere kwetsbaarheden verholpen in Oracle Java.
Interpretaties: In Oracle Java SE, JavaFX en GraalVM Enterprise Edition zijn diverse kwetsbaarheden aanwezig die door ongeauthenticeerde netwerkaanvallers kunnen worden misbruikt via blootgestelde API's of sandboxed Java-applicaties.
Deze kwetsbaarheden maken het mogelijk om denial of service te veroorzaken, ongeautoriseerde lees- en schrijfacties op data uit te voeren, en in sommige gevallen beperkte data toegang te verkrijgen. Exploitatie kan plaatsvinden via netwerktoegang, soms met vereiste van gebruikersinteractie, en betreft meerdere componenten zoals de compiler, networking, JAXP, JDBC, RMI, ImageIO, Lightweight HTTP Server en CORBA. Daarnaast zijn er kwetsbaarheden die leiden tot crashes of het vastlopen van systemen bij het uitvoeren van onbetrouwbare code in sandboxed omgevingen.
Oplossingen: Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.
Kans: medium
Schade: high
CWE-369: Divide By Zero
CWE-416: Use After Free
CWE-843: Access of Resource Using Incompatible Type ('Type Confusion')
CWE-863: Incorrect Authorization
Multiple vulnerabilities including type confusion and memory release issues in libxml2 and a denial of service flaw in Oracle Java SE, JavaFX, and GraalVM Enterprise Edition can cause system crashes or hangs when processing crafted documents or running untrusted code.
7.5 (High)
Affected products
Known affected
7 products
| Product | Identifier | Version | Remediation |
|---|---|---|---|
|
vers:unknown/*
Oracle / GraalVM
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Java Se
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / JavaFX
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM Enterprise Edition
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle GraalVM for JDK
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle Java SE
|
vers:unknown/* | ||
|
vers:unknown/*
Oracle / Oracle JavaFX
|
vers:unknown/* |
Multiple security vulnerabilities including Content Security Policy bypasses, crashes, and code execution issues were fixed in WebKitGTK and Oracle Java SE/JavaFX, with updates addressing moderate severity flaws requiring user interaction.
7.5 (High)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
Multiple vulnerabilities affect GStreamer gst-plugins-good before 1.28.2 causing denial of service via integer division by zero in MP4 audio handling, and Oracle Java SE/JavaFX allowing limited unauthorized data access and partial denial of service through a difficult-to-exploit network flaw requiring user interaction.
9.1 (Critical)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to potentially modify critical data via APIs, with an integrity impact and a CVSS score of 5.9.
5.9 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers via TLS to perform unauthorized data modification operations, with a CVSS 3.1 base score of 3.7.
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE Compiler versions 21.0.12.1, 25.0.4.1, and 27 allows unauthenticated network attackers to gain unauthorized read and write access to data via APIs, with a CVSS 3.1 base score of 4.8.
4.8 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to gain unauthorized read access to data via APIs, with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE and GraalVM allows unauthenticated network attackers to gain unauthorized read and write access to data via APIs, including sandboxed Java Web Start applications and applets, with a CVSS 3.1 base score of 4.8.
4.8 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in the JDBC component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to potentially access critical data, with a CVSS score of 5.9.
5.9 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to exploit APIs, leading to unauthorized data modification or partial denial of service with a CVSS 3.1 base score of 6.5.
6.5 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to cause a partial denial of service via JAXP APIs, with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE Compiler versions 25.0.4.1 and 27 allows unauthenticated network attackers to gain unauthorized read access to certain data via specific API inputs, with a CVSS 3.1 base score of 3.7.
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in multiple versions of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to exploit APIs and potentially access critical data, with a CVSS 3.1 base score of 5.9.
5.9 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE Networking affects versions 21.0.12.1, 25.0.4.1, and 27, enabling unauthenticated attackers with network access to read certain data via multiple protocols without user interaction, rated CVSS 3.1 base score 5.3.
5.3 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to potentially perform unauthorized data modifications via APIs, with a CVSS 3.1 base score of 3.7.
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE RMI component and Oracle GraalVM Enterprise Edition 21.3.19.1.1 allows unauthenticated network attackers to gain unauthorized read and write access, with a CVSS 3.1 base score of 5.4.
5.4 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to gain unauthorized read and write access to data via APIs, with a CVSS score of 6.5.
6.5 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to potentially perform unauthorized data modifications via APIs, with a CVSS 3.1 base score of 3.7.
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in the Networking component of Oracle Java SE and GraalVM allows unauthenticated network attackers to exploit APIs, potentially causing unauthorized data modification, with a CVSS 3.1 base score of 5.3 indicating an integrity impact.
5.3 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE (versions 21.0.12.1, 25.0.4.1, and 27) allows unauthenticated network attackers to perform unauthorized data modification via APIs, primarily impacting sandboxed Java Web Start applications or applets with a CVSS score of 3.7.
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition ImageIO component allows unauthenticated network attackers to gain unauthorized read access to data, with a CVSS 3.1 base score of 3.7.
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows a low-privileged attacker with network access and user interaction to gain unauthorized read access to data in sandboxed Java applications, rated CVSS 3.1 score 2.6.
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in the JSSE component of Oracle Java SE and Oracle GraalVM allows unauthenticated network attackers via TLS to cause a partial denial of service, rated with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to gain unauthorized read and write access to data via APIs, with a CVSS 3.1 score of 4.8.
4.8 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE libraries across multiple supported versions allows an unauthenticated attacker with infrastructure access and user interaction to potentially modify or delete critical data via APIs, with a CVSS 3.1 base score of 4.7.
4.7 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows a difficult-to-exploit attack by an unauthenticated user with infrastructure logon and human interaction, potentially enabling unauthorized modification of critical data in sandboxed Java applications, with a CVSS 3.1 base score of 4.7.
4.7 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows an unauthenticated user with infrastructure logon to potentially gain unauthorized read and write access to some accessible data, with a CVSS 3.1 base score of 4.0.
4.0 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE 8u503 and GraalVM Enterprise Edition 21.3.19.1.1 allows unauthenticated network attackers to potentially perform unauthorized data modifications via APIs, with a CVSS score of 3.7.
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to modify critical data or cause partial denial of service, with a CVSS 3.1 base score of 6.5.
6.5 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, JavaFX, and GraalVM Enterprise Edition allows unauthenticated attackers with network access and user interaction to gain unauthorized read and write access to data in sandboxed Java applications running untrusted code.
5.4 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE and Oracle GraalVM networking components allows an unauthenticated attacker with network access to potentially gain unauthorized access to critical data, with a CVSS 3.1 base score of 5.9.
5.9 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to modify data and cause partial denial of service via APIs or sandboxed Java applications, with a CVSS 3.1 score of 6.5.
6.5 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to modify data and cause partial denial of service via APIs or sandboxed Java applications, with a CVSS 3.1 score of 6.5.
6.5 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows an unauthenticated attacker with infrastructure logon and user interaction to cause unauthorized data modification and partial denial of service, with a CVSS 3.1 score of 3.6.
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers via SOCKS5 to compromise data integrity by unauthorized creation, deletion, or modification, with a CVSS 3.1 score of 6.8.
6.8 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows an unauthenticated attacker with network access and user interaction to cause a partial denial of service, scoring 3.1 on CVSS 3.1.
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, JavaFX, and GraalVM Enterprise Edition allows unauthenticated network attackers, requiring user interaction, to gain unauthorized read access to data in sandboxed Java applications, with a CVSS 3.1 base score of 3.1.
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE Networking component version 27 allows unauthenticated attackers with network access to cause a partial denial of service, impacting availability with a CVSS score of 3.7 via APIs or sandboxed Java applications.
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in multiple supported versions of Oracle Java SE libraries allows unauthenticated network attackers to cause a partial denial of service, with a CVSS 3.1 base score of 5.3, mainly affecting Java deployments running untrusted code.
5.3 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE and Oracle GraalVM allows unauthenticated network attackers to cause denial of service or unauthorized data modification via APIs, affecting sandboxed Java applications with a CVSS 3.1 score of 6.5.
6.5 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to cause denial of service, unauthorized data modification, and limited data disclosure, with a CVSS 3.1 base score of 7.0.
7.0 (High)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE and Oracle GraalVM Enterprise Edition's CORBA component allows unauthenticated network attackers to cause a partial denial of service, with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, JavaFX, GraalVM for JDK, and GraalVM Enterprise Edition's ImageIO component allows unauthenticated network attackers to cause a partial denial of service, with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE and GraalVM Networking components allows unauthenticated attackers with network access to perform unauthorized data modifications via specific API inputs, with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to modify accessible data via specific APIs, with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition's Lightweight HTTP Server allows unauthenticated network attackers to perform unauthorized data modifications, with a CVSS 3.1 base score of 5.3.
5.3 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers via TLS to perform unauthorized data modification operations, with a CVSS 3.1 score of 3.7.
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to potentially modify critical data without user interaction, with a CVSS 3.1 score of 5.9.
5.9 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers with user interaction to potentially access critical data in sandboxed Java environments, rated CVSS 3.1 score 5.3.
5.3 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers with user interaction to potentially access critical data in sandboxed Java environments, rated CVSS 3.1 score 5.3.
5.3 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle JavaFX versions 25.0.4 and 27 allows unauthenticated attackers with network access and user interaction to gain unauthorized read access to data in sandboxed Java Web Start applications, rated CVSS 3.1 at 3.1 severity.
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE 8u503 and 8u503-perf allows local low-privileged attackers to compromise systems by unauthorized manipulation of critical data in sandboxed Java Web Start applications or applets, with a CVSS 3.1 score of 7.5.
7.5 (High)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE compiler allows unauthenticated network attackers to gain unauthorized read and write access via specific API inputs, with a CVSS 3.1 base score of 4.8.
4.8 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to gain unauthorized read and write access to data via APIs, with a CVSS score of 6.5.
6.5 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
A vulnerability in Oracle Java SE 26.0.2's compiler component allows unauthenticated network attackers to cause denial of service by hanging or crashing the system through specific API data inputs, though exploitation is difficult and excludes untrusted Java Web Start applications or applets.
5.9 (Medium)
Affected products
Known affected
7 products, the same list as for
CVE-2026-6732
References
56 references
{
"document": {
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE"
}
},
"lang": "nl",
"notes": [
{
"category": "legal_disclaimer",
"text": "The Netherlands Cyber Security Center (henceforth: NCSC-NL) maintains this page to enhance access to its information and security advisories. The use of this security advisory is subject to the following terms and conditions:\n\n NCSC-NL makes every reasonable effort to ensure that the content of this page is kept up to date, and that it is accurate and complete. Nevertheless, NCSC-NL cannot entirely rule out the possibility of errors, and therefore cannot give any warranty in respect of its completeness, accuracy or continuous keeping up-to-date. The information contained in this security advisory is intended solely for the purpose of providing general information to professional users. No rights can be derived from the information provided therein.\n\n NCSC-NL and the Kingdom of the Netherlands assume no legal liability or responsibility for any damage resulting from either the use or inability of use of this security advisory. This includes damage resulting from the inaccuracy of incompleteness of the information contained in the advisory.\n This security advisory is subject to Dutch law. All disputes related to or arising from the use of this advisory will be submitted to the competent court in The Hague. This choice of means also applies to the court in summary proceedings."
},
{
"category": "description",
"text": "Oracle heeft meerdere kwetsbaarheden verholpen in Oracle Java.",
"title": "Feiten"
},
{
"category": "description",
"text": "In Oracle Java SE, JavaFX en GraalVM Enterprise Edition zijn diverse kwetsbaarheden aanwezig die door ongeauthenticeerde netwerkaanvallers kunnen worden misbruikt via blootgestelde API\u0027s of sandboxed Java-applicaties.\n\nDeze kwetsbaarheden maken het mogelijk om denial of service te veroorzaken, ongeautoriseerde lees- en schrijfacties op data uit te voeren, en in sommige gevallen beperkte data toegang te verkrijgen. Exploitatie kan plaatsvinden via netwerktoegang, soms met vereiste van gebruikersinteractie, en betreft meerdere componenten zoals de compiler, networking, JAXP, JDBC, RMI, ImageIO, Lightweight HTTP Server en CORBA. Daarnaast zijn er kwetsbaarheden die leiden tot crashes of het vastlopen van systemen bij het uitvoeren van onbetrouwbare code in sandboxed omgevingen.",
"title": "Interpretaties"
},
{
"category": "description",
"text": "Oracle heeft updates uitgebracht om de kwetsbaarheden te verhelpen. Zie bijgevoegde referenties voor meer informatie.",
"title": "Oplossingen"
},
{
"category": "general",
"text": "medium",
"title": "Kans"
},
{
"category": "general",
"text": "high",
"title": "Schade"
},
{
"category": "general",
"text": "Divide By Zero",
"title": "CWE-369"
},
{
"category": "general",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "general",
"text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"title": "CWE-843"
},
{
"category": "general",
"text": "Incorrect Authorization",
"title": "CWE-863"
}
],
"publisher": {
"category": "coordinator",
"contact_details": "cert@ncsc.nl",
"name": "Nationaal Cyber Security Centrum",
"namespace": "https://www.ncsc.nl/"
},
"references": [
{
"category": "external",
"summary": "Reference",
"url": "https://www.oracle.com/security-alerts/cpuoct2026.html"
}
],
"title": "Meerdere kwetsbaarheden verholpen in Oracle Java",
"tracking": {
"current_release_date": "2026-10-22T12:04:56.348522Z",
"generator": {
"date": "2025-08-04T16:30:00Z",
"engine": {
"name": "V.A.",
"version": "1.3"
}
},
"id": "NCSC-2026-0449",
"initial_release_date": "2026-10-22T12:04:56.348522Z",
"revision_history": [
{
"date": "2026-10-22T12:04:56.348522Z",
"number": "1.0.0",
"summary": "Initiele versie"
}
],
"status": "final",
"version": "1.0.0"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-1"
}
}
],
"category": "product_name",
"name": "GraalVM"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-2"
}
}
],
"category": "product_name",
"name": "Java Se"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-3"
}
}
],
"category": "product_name",
"name": "JavaFX"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-4"
}
}
],
"category": "product_name",
"name": "Oracle GraalVM Enterprise Edition"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-5"
}
}
],
"category": "product_name",
"name": "Oracle GraalVM for JDK"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-6"
}
}
],
"category": "product_name",
"name": "Oracle Java SE"
},
{
"branches": [
{
"category": "product_version_range",
"name": "vers:unknown/*",
"product": {
"name": "vers:unknown/*",
"product_id": "CSAFPID-7"
}
}
],
"category": "product_name",
"name": "Oracle JavaFX"
}
],
"category": "vendor",
"name": "Oracle"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2026-6732",
"cwe": {
"id": "CWE-843",
"name": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)"
},
"notes": [
{
"category": "other",
"text": "Access of Resource Using Incompatible Type (\u0027Type Confusion\u0027)",
"title": "CWE-843"
},
{
"category": "description",
"text": "Multiple vulnerabilities including type confusion and memory release issues in libxml2 and a denial of service flaw in Oracle Java SE, JavaFX, and GraalVM Enterprise Edition can cause system crashes or hangs when processing crafted documents or running untrusted code.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-6732 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-6732.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-6732"
},
{
"cve": "CVE-2026-43660",
"notes": [
{
"category": "description",
"text": "Multiple security vulnerabilities including Content Security Policy bypasses, crashes, and code execution issues were fixed in WebKitGTK and Oracle Java SE/JavaFX, with updates addressing moderate severity flaws requiring user interaction.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-43660 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-43660.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-43660"
},
{
"cve": "CVE-2026-46470",
"cwe": {
"id": "CWE-369",
"name": "Divide By Zero"
},
"notes": [
{
"category": "other",
"text": "Divide By Zero",
"title": "CWE-369"
},
{
"category": "description",
"text": "Multiple vulnerabilities affect GStreamer gst-plugins-good before 1.28.2 causing denial of service via integer division by zero in MP4 audio handling, and Oracle Java SE/JavaFX allowing limited unauthorized data access and partial denial of service through a difficult-to-exploit network flaw requiring user interaction.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-46470 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-46470.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 9.1,
"baseSeverity": "CRITICAL",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-46470"
},
{
"cve": "CVE-2026-83374",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to potentially modify critical data via APIs, with an integrity impact and a CVSS score of 5.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83374 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83374.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-83374"
},
{
"cve": "CVE-2026-83376",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers via TLS to perform unauthorized data modification operations, with a CVSS 3.1 base score of 3.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83376 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83376.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-83376"
},
{
"cve": "CVE-2026-83378",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE Compiler versions 21.0.12.1, 25.0.4.1, and 27 allows unauthenticated network attackers to gain unauthorized read and write access to data via APIs, with a CVSS 3.1 base score of 4.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83378 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83378.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-83378"
},
{
"cve": "CVE-2026-83380",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to gain unauthorized read access to data via APIs, with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83380 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83380.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-83380"
},
{
"cve": "CVE-2026-83381",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE and GraalVM allows unauthenticated network attackers to gain unauthorized read and write access to data via APIs, including sandboxed Java Web Start applications and applets, with a CVSS 3.1 base score of 4.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83381 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83381.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-83381"
},
{
"cve": "CVE-2026-83387",
"notes": [
{
"category": "description",
"text": "A vulnerability in the JDBC component of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to potentially access critical data, with a CVSS score of 5.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83387 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83387.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-83387"
},
{
"cve": "CVE-2026-83395",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to exploit APIs, leading to unauthorized data modification or partial denial of service with a CVSS 3.1 base score of 6.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83395 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83395.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-83395"
},
{
"cve": "CVE-2026-83400",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to cause a partial denial of service via JAXP APIs, with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-83400 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-83400.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-83400"
},
{
"cve": "CVE-2026-87255",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE Compiler versions 25.0.4.1 and 27 allows unauthenticated network attackers to gain unauthorized read access to certain data via specific API inputs, with a CVSS 3.1 base score of 3.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87255 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87255.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-87255"
},
{
"cve": "CVE-2026-87290",
"notes": [
{
"category": "description",
"text": "A vulnerability in multiple versions of Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to exploit APIs and potentially access critical data, with a CVSS 3.1 base score of 5.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87290 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87290.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-87290"
},
{
"cve": "CVE-2026-87291",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE Networking affects versions 21.0.12.1, 25.0.4.1, and 27, enabling unauthenticated attackers with network access to read certain data via multiple protocols without user interaction, rated CVSS 3.1 base score 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87291 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87291.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-87291"
},
{
"cve": "CVE-2026-87292",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to potentially perform unauthorized data modifications via APIs, with a CVSS 3.1 base score of 3.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87292 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87292.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-87292"
},
{
"cve": "CVE-2026-87293",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE RMI component and Oracle GraalVM Enterprise Edition 21.3.19.1.1 allows unauthenticated network attackers to gain unauthorized read and write access, with a CVSS 3.1 base score of 5.4.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87293 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87293.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-87293"
},
{
"cve": "CVE-2026-87294",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to gain unauthorized read and write access to data via APIs, with a CVSS score of 6.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87294 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87294.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-87294"
},
{
"cve": "CVE-2026-87367",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to potentially perform unauthorized data modifications via APIs, with a CVSS 3.1 base score of 3.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-87367 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-87367.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-87367"
},
{
"cve": "CVE-2026-91332",
"notes": [
{
"category": "description",
"text": "A vulnerability in the Networking component of Oracle Java SE and GraalVM allows unauthenticated network attackers to exploit APIs, potentially causing unauthorized data modification, with a CVSS 3.1 base score of 5.3 indicating an integrity impact.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91332 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91332.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91332"
},
{
"cve": "CVE-2026-91333",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE (versions 21.0.12.1, 25.0.4.1, and 27) allows unauthenticated network attackers to perform unauthorized data modification via APIs, primarily impacting sandboxed Java Web Start applications or applets with a CVSS score of 3.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91333 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91333.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91333"
},
{
"cve": "CVE-2026-91334",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition ImageIO component allows unauthenticated network attackers to gain unauthorized read access to data, with a CVSS 3.1 base score of 3.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91334 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91334.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91334"
},
{
"cve": "CVE-2026-91335",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows a low-privileged attacker with network access and user interaction to gain unauthorized read access to data in sandboxed Java applications, rated CVSS 3.1 score 2.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91335 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91335.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 2.6,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91335"
},
{
"cve": "CVE-2026-91373",
"notes": [
{
"category": "description",
"text": "A vulnerability in the JSSE component of Oracle Java SE and Oracle GraalVM allows unauthenticated network attackers via TLS to cause a partial denial of service, rated with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91373 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91373.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91373"
},
{
"cve": "CVE-2026-91374",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to gain unauthorized read and write access to data via APIs, with a CVSS 3.1 score of 4.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91374 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91374.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91374"
},
{
"cve": "CVE-2026-91375",
"cwe": {
"id": "CWE-863",
"name": "Incorrect Authorization"
},
"notes": [
{
"category": "other",
"text": "Incorrect Authorization",
"title": "CWE-863"
},
{
"category": "description",
"text": "A vulnerability in Oracle Java SE libraries across multiple supported versions allows an unauthenticated attacker with infrastructure access and user interaction to potentially modify or delete critical data via APIs, with a CVSS 3.1 base score of 4.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91375 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91375.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91375"
},
{
"cve": "CVE-2026-91379",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows a difficult-to-exploit attack by an unauthenticated user with infrastructure logon and human interaction, potentially enabling unauthorized modification of critical data in sandboxed Java applications, with a CVSS 3.1 base score of 4.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91379 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91379.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.7,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91379"
},
{
"cve": "CVE-2026-91380",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows an unauthenticated user with infrastructure logon to potentially gain unauthorized read and write access to some accessible data, with a CVSS 3.1 base score of 4.0.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91380 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91380.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.0,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91380"
},
{
"cve": "CVE-2026-91381",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE 8u503 and GraalVM Enterprise Edition 21.3.19.1.1 allows unauthenticated network attackers to potentially perform unauthorized data modifications via APIs, with a CVSS score of 3.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91381 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91381.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91381"
},
{
"cve": "CVE-2026-91382",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to modify critical data or cause partial denial of service, with a CVSS 3.1 base score of 6.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91382 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91382.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91382"
},
{
"cve": "CVE-2026-91385",
"cwe": {
"id": "CWE-416",
"name": "Use After Free"
},
"notes": [
{
"category": "other",
"text": "Use After Free",
"title": "CWE-416"
},
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, JavaFX, and GraalVM Enterprise Edition allows unauthenticated attackers with network access and user interaction to gain unauthorized read and write access to data in sandboxed Java applications running untrusted code.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91385 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91385.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.4,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91385"
},
{
"cve": "CVE-2026-91394",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE and Oracle GraalVM networking components allows an unauthenticated attacker with network access to potentially gain unauthorized access to critical data, with a CVSS 3.1 base score of 5.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91394 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91394.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91394"
},
{
"cve": "CVE-2026-91395",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to modify data and cause partial denial of service via APIs or sandboxed Java applications, with a CVSS 3.1 score of 6.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91395 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91395.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91395"
},
{
"cve": "CVE-2026-91396",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to modify data and cause partial denial of service via APIs or sandboxed Java applications, with a CVSS 3.1 score of 6.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91396 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91396.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91396"
},
{
"cve": "CVE-2026-91397",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows an unauthenticated attacker with infrastructure logon and user interaction to cause unauthorized data modification and partial denial of service, with a CVSS 3.1 score of 3.6.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91397 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91397.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.6,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91397"
},
{
"cve": "CVE-2026-91398",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers via SOCKS5 to compromise data integrity by unauthorized creation, deletion, or modification, with a CVSS 3.1 score of 6.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91398 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91398.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91398"
},
{
"cve": "CVE-2026-91400",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows an unauthenticated attacker with network access and user interaction to cause a partial denial of service, scoring 3.1 on CVSS 3.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91400 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91400.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91400"
},
{
"cve": "CVE-2026-91402",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, JavaFX, and GraalVM Enterprise Edition allows unauthenticated network attackers, requiring user interaction, to gain unauthorized read access to data in sandboxed Java applications, with a CVSS 3.1 base score of 3.1.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91402 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91402.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91402"
},
{
"cve": "CVE-2026-91409",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE Networking component version 27 allows unauthenticated attackers with network access to cause a partial denial of service, impacting availability with a CVSS score of 3.7 via APIs or sandboxed Java applications.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91409 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91409.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91409"
},
{
"cve": "CVE-2026-91410",
"notes": [
{
"category": "description",
"text": "A vulnerability in multiple supported versions of Oracle Java SE libraries allows unauthenticated network attackers to cause a partial denial of service, with a CVSS 3.1 base score of 5.3, mainly affecting Java deployments running untrusted code.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91410 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91410.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91410"
},
{
"cve": "CVE-2026-91411",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE and Oracle GraalVM allows unauthenticated network attackers to cause denial of service or unauthorized data modification via APIs, affecting sandboxed Java applications with a CVSS 3.1 score of 6.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91411 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91411.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91411"
},
{
"cve": "CVE-2026-91415",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to cause denial of service, unauthorized data modification, and limited data disclosure, with a CVSS 3.1 base score of 7.0.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91415 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91415.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.0,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91415"
},
{
"cve": "CVE-2026-91417",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE and Oracle GraalVM Enterprise Edition\u0027s CORBA component allows unauthenticated network attackers to cause a partial denial of service, with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91417 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91417.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91417"
},
{
"cve": "CVE-2026-91418",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, JavaFX, GraalVM for JDK, and GraalVM Enterprise Edition\u0027s ImageIO component allows unauthenticated network attackers to cause a partial denial of service, with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91418 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91418.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91418"
},
{
"cve": "CVE-2026-91451",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE and GraalVM Networking components allows unauthenticated attackers with network access to perform unauthorized data modifications via specific API inputs, with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91451 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91451.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91451"
},
{
"cve": "CVE-2026-91452",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to modify accessible data via specific APIs, with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91452 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91452.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91452"
},
{
"cve": "CVE-2026-91453",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition\u0027s Lightweight HTTP Server allows unauthenticated network attackers to perform unauthorized data modifications, with a CVSS 3.1 base score of 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91453 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91453.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91453"
},
{
"cve": "CVE-2026-91461",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers via TLS to perform unauthorized data modification operations, with a CVSS 3.1 score of 3.7.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91461 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91461.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.7,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91461"
},
{
"cve": "CVE-2026-91462",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to potentially modify critical data without user interaction, with a CVSS 3.1 score of 5.9.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91462 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91462.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91462"
},
{
"cve": "CVE-2026-91463",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers with user interaction to potentially access critical data in sandboxed Java environments, rated CVSS 3.1 score 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91463 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91463.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91463"
},
{
"cve": "CVE-2026-91464",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers with user interaction to potentially access critical data in sandboxed Java environments, rated CVSS 3.1 score 5.3.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91464 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91464.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91464"
},
{
"cve": "CVE-2026-91477",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle JavaFX versions 25.0.4 and 27 allows unauthenticated attackers with network access and user interaction to gain unauthorized read access to data in sandboxed Java Web Start applications, rated CVSS 3.1 at 3.1 severity.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91477 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91477.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91477"
},
{
"cve": "CVE-2026-91484",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE 8u503 and 8u503-perf allows local low-privileged attackers to compromise systems by unauthorized manipulation of critical data in sandboxed Java Web Start applications or applets, with a CVSS 3.1 score of 7.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91484 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91484.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:C/C:H/I:H/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91484"
},
{
"cve": "CVE-2026-91487",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE compiler allows unauthenticated network attackers to gain unauthorized read and write access via specific API inputs, with a CVSS 3.1 base score of 4.8.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-91487 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-91487.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 4.8,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-91487"
},
{
"cve": "CVE-2026-101516",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE, Oracle GraalVM for JDK, and Oracle GraalVM Enterprise Edition allows unauthenticated network attackers to gain unauthorized read and write access to data via APIs, with a CVSS score of 6.5.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101516 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101516.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-101516"
},
{
"cve": "CVE-2026-101737",
"notes": [
{
"category": "description",
"text": "A vulnerability in Oracle Java SE 26.0.2\u0027s compiler component allows unauthenticated network attackers to cause denial of service by hanging or crashing the system through specific API data inputs, though exploitation is difficult and excludes untrusted Java Web Start applications or applets.",
"title": "Summary"
}
],
"product_status": {
"known_affected": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2026-101737 | NCSC-NL Website",
"url": "https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-101737.json"
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 5.9,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
"version": "3.1"
},
"products": [
"CSAFPID-1",
"CSAFPID-2",
"CSAFPID-3",
"CSAFPID-4",
"CSAFPID-5",
"CSAFPID-6",
"CSAFPID-7"
]
}
],
"title": "CVE-2026-101737"
}
]
}
Loading…
Loading…
Drag nodes to arrange them. Double-click a related vulnerability to open it, or a source to visit its link. The Physics button on the left tunes the layout and the simulation; the legend at the bottom left hides or shows nodes by kind and by sighting type.
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Vulnerability timeline
Sightings and recorded dates, grouped by day · UTC
Loading timeline…
Loading…
Loading…
The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the
vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base
model, served locally by ML-Gateway.
They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.
Loading…
Related by attack behaviour
Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.