Oracle Retail Applications: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 10

• Critical 9.8
  CVE-2026-46982

  Vulnerability in the Oracle Retail Integration Bus product of Oracle Retail Applications (component: RIB Kernal). The s…

  Oracle Oracle Retail Integration Bus
  Jul 21, 2026
• Critical 9.8
  CVE-2026-46983

  Vulnerability in the Oracle Retail Integration Bus product of Oracle Retail Applications (component: RIB Kernal). The s…

  Oracle Oracle Retail Integration Bus
  Jul 21, 2026
• High 8.1
  CVE-2026-41855

  Spring Framework Unsafe Deserialization via Jackson JMS Converters

  In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions vi…

  Spring Spring Framework libspring-java libspring-java Debian Ubuntu Maven
  Jun 9, 2026
• High 7.5
  CVE-2026-34487

  Apache Tomcat: Cloud membership for clustering component exposed the Kubernetes bearer token

  Insertion of Sensitive Information into Log File vulnerability in the cloud membership for clustering component of Apache Tomcat exposed the Kubernetes bearer token. This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.20, from 10.1.0-M1 through 10.1…

  Apache Software Foundation Apache Tomcat thingsboard-tb-node thingsboard-tb-mqtt-transport Debian Ubuntu Wolfi Maven
  Apr 9, 2026
• High 7.5
  CVE-2026-42587

  Netty: HttpContentDecompressor maxAllocation bypass via Content-Encoding: br/zstd/snappy enables decompression bomb DoS

  Netty is an asynchronous, event-driven network application framework. Prior to 4.2.13.Final and 4.1.133.Final, HttpContentDecompressor accepts a maxAllocation parameter to limit decompression buffer size and prevent decompression bomb attacks. This limit is c…

  netty io.netty netty netty-codec-http Debian Wolfi Maven
  May 13, 2026
• High 7.4
  CVE-2026-46943

  Vulnerability in the Oracle Retail EFTLink product of Oracle Retail Applications (component: Core/Plugin). Supported ve…

  Oracle Oracle Retail EFTLink
  Jul 21, 2026
• Medium 6.3
  CVE-2026-34481

  Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout

  Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinit…

  Apache Software Foundation Apache Log4j JSON Template Layout spark-4.0-scala-2.13 spark-4.1-scala-2.13 Debian Ubuntu Wolfi Maven
  Apr 10, 2026
• Medium 5.3
  CVE-2025-48924 Public exploit

  Apache Commons Lang, Apache Commons Lang: ClassUtils.getClass(...) can throw a StackOverflowError on very long inputs

  Uncontrolled Recursion vulnerability in Apache Commons Lang. This issue affects Apache Commons Lang: Starting with commons-lang:commons-lang 2.0 to 2.6, and, from org.apache.commons:commons-lang3 3.0 before 3.18.0. The methods ClassUtils.getClass(...) can thr…

  Apache Software Foundation Apache Commons Lang druid thingsboard-tb-node Debian Ubuntu Azure Linux Wolfi Maven
  Jul 11, 2025
• Medium 4.3
  CVE-2026-21954

  Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xstore Mob…

  Oracle Oracle Retail Xstore Point of Service
  Jul 21, 2026
• Low 3.3
  CVE-2026-21953

  Vulnerability in the Oracle Retail Xstore Point of Service product of Oracle Retail Applications (component: Xstore Mob…

  Oracle Oracle Retail Xstore Point of Service
  Jul 21, 2026

Revision history

1. 2026-07-21 #1

   Initiale Fassung

References

• Oracle Critical Patch Update Advisory - July 2026 - Appendix Oracle Retail Applications vom 2026-07-21
  https://www.oracle.com/security-alerts/cpujul2026.html#AppendixRAPP