High WID-SEC-2026-2431 5 CVEs

Oracle SQL Developer: Mehrere Schwachstellen

Published Jul 21, 2026 · Updated Jul 21, 2026 · de-DE

Vendor: Oracle Product: SQL Developer Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle SQL Developer ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle SQL Developer ist eine Entwicklungsumgebung für SQL und PL/SQL, sowie ein Verwaltungswerkzeug für Datenbanken.

Vulnerabilities 5

Critical 9.1

CVE-2026-33557

Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication

A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without valida…

Apache Software Foundation Apache Kafka apache-nifi debezium-3.5-connector-jdbc Ubuntu Wolfi Maven

Apr 20, 2026
High 8.2

CVE-2025-66566

yawkat LZ4 Java has a possible information leak in Java safe decompressor

yawkat LZ4 Java provides LZ4 compression for Java. Insufficient clearing of the output buffer in Java-based decompressor implementations in lz4-java 1.10.0 and earlier allows remote attackers to read previous buffer contents via crafted compressed input. In a…

yawkat lz4-java zipkin spark-4.0-scala-2.13 Debian Ubuntu Wolfi Maven

Dec 5, 2025
High 7.5

CVE-2025-27553

Apache Commons VFS: Possible path traversal issue when using NameScope.DESCENDENT

Relative Path Traversal vulnerability in Apache Commons VFS before 2.10.0. The FileObject API in Commons VFS has a 'resolveFile' method that takes a 'scope' parameter. Specifying 'NameScope.DESCENDENT' promises that "an exception is thrown if the resolved fil…

Apache Software Foundation Apache Commons VFS org.apache.commons:commons-vfs2 commons-vfs Debian Ubuntu Maven

Mar 23, 2025
Medium 5.3

CVE-2025-48924 Public exploit

Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs

Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can thr…

Apache Software Foundation Apache Commons Lang druid thingsboard-tb-node Debian Ubuntu Azure Linux Wolfi Maven

Jul 11, 2025
Medium 4.8

CVE-2025-21502

Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java S…

Oracle Oracle Java SE openjdk-lts openjdk-9 Debian Ubuntu Alpine Wolfi

Jan 21, 2025

Revision history

2026-07-21 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - July 2026 - Appendix Oracle SQL Developer vom 2026-07-21
https://www.oracle.com/security-alerts/cpujul2026.html#AppendixSQLD