Skip to content
OpenAdvisories
Critical SCA-2026-0016 2 CVEs

Vulnerabilities Affecting SICK CorivaHub

Published Oct 16, 2026 · Updated Oct 16, 2026

Vendor: SICK Product: CorivaHub

Summary

SICK CorivaHub includes the third-party components Apache Tomcat and MapLibre GL, which are affected by two known vulnerabilities. These vulnerabilities include an improper input validation issue in Apache Tomcat and a vulnerability in MapLibre GL that could allow malicious behavior through custom GUIs. Under certain conditions, successful exploitation could affect the confidentiality, integrity and availability of the affected system. The attack surface associated with the Apache Tomcat vulnerability is significantly reduced by the default product configuration. Nevertheless, SICK recommends updating to CorivaHub 2026.1.2 to remediate both vulnerabilities.

Vulnerabilities 2

  • Critical 10.0
    CVE-2026-85061

    MapLibre GL JS: XSS Sanitizer Bypass in DOM.sanitize() via Live NamedNodeMap Removal Skip

    MapLibre GL JS is an interactive vector tile map library for web browsers. Prior to 6.4.1, DOM.sanitize() in src/util/dom.ts iterates elem.attributes as a live NamedNodeMap while removeAttributes() removes attributes from the same collection, shifting indexes…

    maplibre maplibre-gl-js tileserver-gl opensearch-dashboards-3-dashboards-maps Wolfi npm
  • Critical 9.8
    CVE-2026-65637

    Apache Tomcat: HTTP/2 no-authority bypass of strict SNI validation - CVE-2026-32990 fix incomplete

    Improper Input Validation vulnerability in Apache Tomcat due to incomplete fix for CVE-2026-32990. This issue affects Apache Tomcat: from 11.0.20 through 11.0.24, from 10.1.53 through 10.1.57, from 9.0.115 through 9.0.120. Users are recommended to upgrade to …

    Apache Software Foundation Apache Tomcat tomcat8 tomcat9 Debian Ubuntu Maven

Revision history

  1. #1

    Initial version

References