High WID-SEC-2026-0154 6 CVEs

Oracle Commerce: Mehrere Schwachstellen

Published Jan 20, 2026 · Updated Jan 20, 2026 · de-DE

Vendor: Oracle Product: Commerce Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Commerce ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle Commerce ist eine elektronische Handelsplattform.

Vulnerabilities 6

High 8.6

CVE-2025-50059

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine Wolfi

Jul 15, 2025
High 8.4

CVE-2025-66516 Public exploit Scanner template EPSS 89%

Apache Tika core, Apache Tika parsers, Apache Tika PDF parser module: Update to CVE-2025-54988 to expand scope of artifacts affected

Critical XXE in Apache Tika tika-core (1.13-3.2.1), tika-pdf-module (2.0.0-3.2.1) and tika-parsers (1.13-1.28.5) modules on all platforms allows an attacker to carry out XML External Entity injection via a crafted XFA file inside of a PDF. This CVE covers the…

Apache Software Foundation Apache Tika PDF parser module Apache Tika parsers Apache Tika core Debian Ubuntu Wolfi Maven

Dec 4, 2025
High 7.5

CVE-2025-41249 Public exploit

CVE-2025-41249: Spring Framework Annotation Detection Vulnerability

The Spring Framework annotation detection mechanism may not correctly resolve annotations on methods within type hierarchies with a parameterized super type with unbounded generics. This can be an issue if such annotations are used for authorization decisions…

VMware Spring Framework thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven

Sep 16, 2025
High 7.5

CVE-2025-9086

Out of bounds read for cookie path

1. A cookie is set using the `secure` keyword for `https://target` 2. curl is redirected to or otherwise made to speak with `http://target` (same hostname, but using clear text HTTP) using the same cookie set 3. The same cookie name is set - but with only a s…

curl curl curl curl Debian Ubuntu Alpine

Sep 12, 2025
Medium 5.3

CVE-2025-48924 Public exploit

Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs

Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can thr…

Apache Software Foundation Apache Commons Lang druid thingsboard-tb-node Debian Ubuntu Azure Linux Wolfi Maven

Jul 11, 2025
Medium 5.3

CVE-2025-61795

Apache Tomcat: Delayed cleaning of multi-part upload temporary files may lead to DoS

Improper Resource Shutdown or Release vulnerability in Apache Tomcat. If an error occurred (including exceeding limits) during the processing of a multipart upload, temporary copies of the uploaded parts written to disc were not cleaned up immediately but lef…

Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven

Oct 27, 2025

Revision history

2026-01-20 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - January 2026 - Appendix Oracle Commerce vom 2026-01-20
https://www.oracle.com/security-alerts/cpujan2026.html#AppendixOCOM