High 1 exploited CVE WID-SEC-2026-0169 7 CVEs

Oracle JD Edwards: Mehrere Schwachstellen

Published Jan 20, 2026 · Updated Jan 20, 2026 · de-DE

Vendor: Oracle Product: JD Edwards Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle JD Edwards ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Die Komponenten der Oracle JDEdwards sind vollständig integrierte und komplette Lösungen geschäftlicher Anwendungen (ERP) für Unternehmen.

Vulnerabilities 7

High 8.1

CVE-2025-27363 Exploited Public exploit EPSS 28%

An out of bounds write exists in FreeType versions 2.13.0 and below (newer versions of FreeType are not vulnerable) whe…

FreeType FreeType freetype freetype Debian Ubuntu Azure Linux Alpine

Mar 11, 2025
KEV May 6, 2025
High 7.8

CVE-2023-1393

A flaw was found in X.Org Server Overlay Window. A Use-After-Free may lead to local privilege escalation. If a client e…

xorg-server xorg-server xorg-server-hwe-16.04 xorg-server-hwe-18.04 Debian Ubuntu Azure Linux

Mar 30, 2023
High 7.5

CVE-2025-27210 Public exploit EPSS 14%

An incomplete fix has been identified for CVE-2025-23084 in Node.js, specifically affecting Windows device names like C…

Node.js node nodejs

Jul 18, 2025
Medium 6.5

CVE-2023-42670

Samba: ad dc busy rpc multiple listener dos

A flaw was found in Samba. It is susceptible to a vulnerability where multiple incompatible RPC listeners can be initiated, causing disruptions in the AD DC service. When Samba's RPC server experiences a high load or unresponsiveness, servers intended for non…

Red Hat Red Hat Enterprise Linux 9 Red Hat Enterprise Linux 8 Red Hat Enterprise Linux 7 Linux Debian Ubuntu Azure Linux Alpine

Nov 3, 2023
Medium 6.1

CVE-2026-21946

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC). Supporte…

Oracle JD Edwards EnterpriseOne Tools

Jan 20, 2026
Medium 5.9

CVE-2025-26333

Dell BSAFE Crypto-J generates an error message that includes sensitive information about its environment and associated…

Dell BSAFE Crypto-J

Sep 25, 2025
Medium 5.0

CVE-2024-43796

express vulnerable to XSS via response.redirect()

Express.js minimalist web framework for node. In express < 4.20.0, passing untrusted user input - even after sanitizing it - to response.redirect() may execute untrusted code. This issue is patched in express 4.20.0.

expressjs express kubeflow-pipelines-apiserver kubeflow-centraldashboard Debian Ubuntu Azure Linux Wolfi npm

Sep 10, 2024

Revision history

2026-01-20 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - January 2026 - Appendix Oracle JD Edwards vom 2026-01-20
https://www.oracle.com/security-alerts/cpujan2026.html#AppendixJDE