Oracle Supply Chain: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 9

• Critical 9.8
  CVE-2026-21969

  Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: S…

  Oracle Oracle Agile Product Lifecycle Management for Process
  Jan 20, 2026
• High 8.8
  CVE-2025-48734 Public exploit

  Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default

  Improper Access Control vulnerability in Apache Commons. A special BeanIntrospector class was added in version 1.9.2. This can be used to stop attackers from using the declared class property of Java enum objects to get access to the classloader. However this…

  Apache Software Foundation Apache Commons BeanUtils 2.x Apache Commons BeanUtils 1.x druid Debian Ubuntu Azure Linux Wolfi Maven
  May 28, 2025
• High 7.7
  CVE-2025-5115

  MadeYouReset HTTP/2 vulnerability

  In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state,…

  Eclipse Jetty Eclipse Jetty trino trino-plugin-opensearch Debian Ubuntu Wolfi Maven
  Aug 20, 2025
• High 7.5
  CVE-2025-48976 Public exploit EPSS 34%

  Apache Commons FileUpload, Apache Commons FileUpload: FileUpload DoS via part headers

  Allocation of resources for multipart headers with insufficient limits enabled a DoS vulnerability in Apache Commons FileUpload. This issue affects Apache Commons FileUpload: from 1.0 before 1.6; from 2.0.0-M1 before 2.0.0-M4. Users are recommended to upgrade…

  Apache Software Foundation Apache Commons FileUpload tomcat9 tomcat9 Debian Ubuntu Wolfi Maven
  Jun 16, 2025
• High 7.5
  CVE-2025-48989

  Apache Tomcat: h2 DoS - Made You Reset

  Improper Resource Shutdown or Release vulnerability in Apache Tomcat made Tomcat vulnerable to the made you reset attack. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.9, from 10.1.0-M1 through 10.1.43 and from 9.0.0.M1 through 9.0.107. Older,…

  Apache Software Foundation Apache Tomcat tomcat9 tomcat8 Debian Ubuntu Maven
  Aug 13, 2025
• High 7.5
  CVE-2026-21940

  Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: User and User Group). The supported ve…

  Oracle Oracle Agile PLM
  Jan 20, 2026
• Medium 6.6
  CVE-2025-54874 Public exploit

  OpenJPEG allows OOB heap memory write in opj_jp2_read_header

  OpenJPEG is an open-source JPEG 2000 codec. In OpenJPEG from 2.5.1 through 2.5.3, a call to opj_jp2_read_header may lead to OOB heap memory write when the data stream p_stream is too short and p_image is not initialized.

  uclouvain openjpeg qt6-qtwebengine insighttoolkit4 Debian Ubuntu Azure Linux Alpine Wolfi
  Aug 5, 2025
• Medium 6.5
  CVE-2026-21944

  Vulnerability in the Oracle Agile Product Lifecycle Management for Process product of Oracle Supply Chain (component: P…

  Oracle Oracle Agile Product Lifecycle Management for Process
  Jan 20, 2026
• Medium 5.3
  CVE-2025-31672

  Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names

  Improper Input Validation vulnerability in Apache POI. The issue affects the parsing of OOXML format files like xlsx, docx and pptx. These file formats are basically zip files and it is possible for malicious users to add zip entries with duplicate names (inc…

  Apache Software Foundation Apache POI opensearch-2 libapache-poi-java Debian Ubuntu Wolfi Maven
  Apr 9, 2025

Revision history

1. 2026-01-20 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - January 2026 - Appendix Oracle Supply Chain vom 2026-01-20
  https://www.oracle.com/security-alerts/cpujan2026.html#AppendixSCP