Skip to content
OpenAdvisories
High WID-SEC-2026-2430 15 CVEs

Oracle Database Server: Mehrere Schwachstellen

Published Jul 21, 2026 · Updated Jul 21, 2026 · de-DE

Vendor: Oracle Product: Database Server Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Database Server ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Die Oracle Datenbank ist ein weit verbreitetes relationales Datenbanksystem.

Vulnerabilities 15

  • Critical 9.9
    CVE-2026-61211

    Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.31 and…

    Oracle Oracle Database Server
  • Critical 9.4
    CVE-2026-4738

    GDAL Bundled zlib (inftree9.c) Pointer Offset Optimization Undefined Behavior Allows Heap Corruption or Remote Code Execution

    Improper Restriction of Operations within the Bounds of a Memory Buffer vulnerability in OSGeo gdal (frmts/zlib/contrib/infback9 modules). This vulnerability is associated with program files inftree9.C‎. This issue affects gdal: before 3.11.0.

    OSGeo gdal gdal gdal Debian Ubuntu Azure Linux Alpine
  • Critical 9.1
    CVE-2026-47040

    Vulnerability in the Oracle Net Services component of Oracle Database Server. Supported versions that are affected are …

    Oracle Oracle Net Services
  • High 8.8
    CVE-2026-60175

    Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21…

    Oracle Oracle Database Server
  • High 8.2
    CVE-2026-47046

    Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 23.4.0-23.26.2…

    Oracle Oracle Database Server
  • High 8.1
    CVE-2026-7383

    Possible Heap Buffer Overflow in ASN.1 Multibyte String Conversion

    Issue summary: A signed integer overflow when sizing the destination buffer for Unicode output in ASN1_mbstring_ncopy() can lead to a heap buffer overflow. Impact summary: A heap buffer overflow may lead to a crash or possibly attacker controlled code executi…

    OpenSSL OpenSSL openssl nodejs Debian Ubuntu Azure Linux Alpine Wolfi
  • Medium 6.8
    CVE-2026-47045

    Vulnerability in the JDBC component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.…

    Oracle Oracle Database Server
  • Medium 6.5
    CVE-2026-47039

    Vulnerability in the Java VM component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, …

    Oracle Oracle Database Server
  • Medium 6.5
    CVE-2026-47060

    Vulnerability in the JDBC component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.…

    Oracle Oracle Database Server
  • Medium 6.5
    CVE-2026-54518

    jackson-databind: @JsonView bypass for unwrapped creator parameters in jackson-databind

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.21.0 until 2.21.4 and 3.1.4, UnwrappedPropertyHandler.processUnwrappedCreatorProperties() replays buffered JSON into creator parameters …

    FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 6.0
    CVE-2025-7962

    Jakarta Mail vulnerable to SMTP Injection

    In Jakarta Mail versions prior to 2.0.2 it is possible to perform an SMTP Injection by utilizing the \r and \n UTF-8 characters to separate different messages.

    Eclipse Foundation Jakarta Mail thingsboard-tb-node apache-nifi Debian Ubuntu Wolfi Maven
  • Medium 5.8
    CVE-2026-46975

    Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21…

    Oracle Oracle Database Server
  • Medium 5.6
    CVE-2026-47061

    Vulnerability in the JDBC component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21.…

    Oracle Oracle Database Server
  • Medium 5.3
    CVE-2026-54515 Public exploit

    jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

    jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are appli…

    FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Low 2.7
    CVE-2026-47038

    Vulnerability in the RDBMS component of Oracle Database Server. Supported versions that are affected are 19.3-19.31, 21…

    Oracle Oracle Database Server

Revision history

  1. #1

    Initiale Fassung

References