High WID-SEC-2026-2436 6 CVEs

Oracle Construction and Engineering: Mehrere Schwachstellen

Published Jul 21, 2026 · Updated Jul 21, 2026 · de-DE

Vendor: Oracle Product: Construction and Engineering Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Construction and Engineering ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Construction and Engineering ist eine Sammlung von Werkzeugen zur Unterstützung von Bau- und Ingenieurbüros. Sie umfasst u. a. Projektmanagement-Lösungen zur Verwaltung von Projekte, zur Schaffung von Transparenz, zur Zusammenarbeit und zur Verwaltung von Änderungen.

Vulnerabilities 6

Critical 9.1

CVE-2026-33557

Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication

A possible security vulnerability has been identified in Apache Kafka. By default, the broker property `sasl.oauthbearer.jwt.validator.class` is set to `org.apache.kafka.common.security.oauthbearer.DefaultJwtValidator`. It accepts any JWT token without valida…

Apache Software Foundation Apache Kafka apache-nifi debezium-3.5-connector-jdbc Ubuntu Wolfi Maven

Apr 20, 2026
High 8.1

CVE-2026-4800 Public exploit

lodash vulnerable to Code Injection via `_.template` imports key names

The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as …

lodash lodash lodash-amd lodash-es Debian Ubuntu Wolfi npm

Mar 31, 2026
High 7.5

CVE-2026-42402

Apache Neethi: Policy Normalization Unbounded Resource Allocation DoS

Apache Neethi is vulnerable to a Denial of Service attack through algorithmic complexity in policy normalization. Specially crafted WS-Policy documents can trigger an exponential Cartesian cross-product expansion during the normalization process, causing unbo…

Apache Software Foundation Apache Neethi wildfly-openjdk-21 wildfly-openjdk-17 Wolfi Maven

May 1, 2026
Medium 6.5

CVE-2026-24308

Apache ZooKeeper: Sensitive information disclosure in client configuration handling

Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO leve…

Apache Software Foundation Apache ZooKeeper druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

Mar 7, 2026
Medium 6.3

CVE-2026-34481

Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout

Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinit…

Apache Software Foundation Apache Log4j JSON Template Layout spark-4.0-scala-2.13 spark-4.1-scala-2.13 Debian Ubuntu Wolfi Maven

Apr 10, 2026
Medium 5.3

CVE-2026-54515 Public exploit

jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

jackson-databind contains the general-purpose data-binding functionality and tree-model for Jackson Data Processor. From 2.8.0 until 2.18.9, 2.21.5, and 3.1.4, in BeanDeserializerBase.createContextual(), per-property @JsonIgnoreProperties exclusions are appli…

FasterXML jackson-databind druid thingsboard-tb-node Debian Ubuntu Wolfi Maven

Jun 23, 2026

Revision history

2026-07-21 #1
Initiale Fassung

References

Oracle Critical Patch Update Advisory - July 2026 - Appendix Oracle Construction and Engineering vom 2026-07-21
https://www.oracle.com/security-alerts/cpujul2026.html#AppendixPVA