High WID-SEC-2026-0862 8 CVEs

RealObjects PDFreactor: Mehrere Schwachstellen

Published Mar 25, 2026 · Updated Mar 25, 2026 · de-DE

Vendor: RealObjects Product: PDFreactor Platform: Linux Platform: Windows

Summary

Ein Angreifer kann mehrere Schwachstellen in RealObjects PDFreactor ausnutzen, um beliebigen Code auszuführen, einen Denial-of-Service-Zustand herbeizuführen, Daten zu manipulieren, Sicherheitsmaßnahmen zu umgehen, vertrauliche Informationen offenzulegen oder andere, nicht näher spezifizierte Angriffe durchzuführen.

Product

PDFreactor ist eine Software zur Konvertierung von HTML-Dokumenten in PDF.

Vulnerabilities 8

Critical 9.8

CVE-2025-48913

Apache CXF: Untrusted JMS configuration can lead to RCE

If untrusted users are allowed to configure JMS for Apache CXF, previously they could use RMI or LDAP URLs, potentially leading to code execution capabilities. This interface is now restricted to reject those protocols, removing this possibility. Users are re…

Apache Software Foundation Apache CXF wildfly-openjdk-21 wildfly-openjdk-17 Wolfi Maven

Aug 8, 2025
High 7.5

CVE-2026-1605

The Eclipse Jetty Server Artifact has a Gzip request memory leak

In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Inf…

Eclipse Foundation Eclipse Jetty druid trino Debian Ubuntu Wolfi Maven

Mar 5, 2026
High 7.5

CVE-2026-21945

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine Wolfi

Jan 20, 2026
High 7.4

CVE-2026-21932

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine Wolfi

Jan 20, 2026
Medium 6.1

CVE-2026-21933

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine Wolfi

Jan 20, 2026
Medium 5.9

CVE-2025-41242 Public exploit Scanner template

CVE-2025-41242: Path traversal vulnerability on non-compliant Servlet containers

Spring Framework MVC applications can be vulnerable to a “Path Traversal Vulnerability” when deployed on a non-compliant Servlet container. An application can be vulnerable when all the following are true: * the application is deployed as a WAR or with an emb…

VMware Spring Framework thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven

Aug 18, 2025
Medium 4.8

CVE-2026-21925

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

Oracle Oracle Java SE Oracle GraalVM Enterprise Edition Oracle GraalVM for JDK Debian Ubuntu Alpine Wolfi

Jan 20, 2026
Low 3.7

CVE-2025-11143

org.eclipse.jetty:jetty-http has different parsing of invalid URIs

The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list…

Eclipse Foundation Eclipse Jetty druid trino Debian Ubuntu Wolfi Maven

Mar 5, 2026

Revision history

2026-03-25 #1
Initiale Fassung

References

PDFreactor 12.5 release notes vom 2026-03-25
https://www.pdfreactor.com/pdfreactor-12-5/