Skip to content
OpenAdvisories
High WID-SEC-2026-2448 13 CVEs

Oracle Utilities Applications: Mehrere Schwachstellen

Published Jul 21, 2026 · Updated Jul 21, 2026 · de-DE

Vendor: Oracle Product: Utilities Applications Platform: Linux Platform: Windows

Summary

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Utilities Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.

Product

Oracle Utilities Applications ist eine Produktfamilie mit branchenspezifischen Lösungen für Ver- und Entsorger.

Vulnerabilities 13

  • High 8.9
    CVE-2026-21441

    urllib3 vulnerable to decompression-bomb safeguard bypass when following HTTP redirects (streaming API)

    urllib3 is an HTTP client library for Python. urllib3's streaming API is designed for the efficient handling of large HTTP responses by reading the content in chunks, rather than loading the entire response body into memory at once. urllib3 can perform decodi…

    urllib3 urllib3 open-webui katib-suggestion-hyperopt Debian Ubuntu Azure Linux Alpine Wolfi PyPI
  • High 8.7
    CVE-2026-29062

    jackson-core: Nesting Depth Constraint Bypass in `UTF8DataInputJsonParser` potentially allowing Resource Exhaustion

    jackson-core contains core low-level incremental ("streaming") parser and generator abstractions used by Jackson Data Processor. From version 3.0.0 to before version 3.1.0, the UTF8DataInputJsonParser, which is used when parsing from a java.io.DataInput sourc…

    FasterXML jackson-core apache-nifi sonarqube Ubuntu Wolfi Maven
  • High 8.7
    CVE-2026-3505

    Unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion.

    Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the Bouncy Castle Inc. BC-JAVA bcpg on all (pg modules). This vulnerability is associated with program files AEADEncDataPacket.Java, BcAEADUtil.…

    Legion of the Bouncy Castle BC-JAVA apache-nifi bouncycastle Debian Ubuntu Wolfi Maven
  • High 8.1
    CVE-2026-41855

    Spring Framework Unsafe Deserialization via Jackson JMS Converters

    In an untrusted JMS environment, org.springframework.jms.support.converter.MappingJackson2MessageConverter and org.springframework.jms.support.converter.JacksonJsonMessageConverter allow arbitrary class instantiation, which can lead to unauthorized actions vi…

    Spring Spring Framework libspring-java libspring-java Debian Ubuntu Maven
  • High 8.1
    CVE-2026-4800 Public exploit

    lodash vulnerable to Code Injection via `_.template` imports key names

    The fix for CVE-2021-23337 added validation for the variable option in _.template but did not apply the same validation to options.imports key names, and both paths flow into the same Function() constructor sink. When an application passes untrusted input as …

    lodash lodash lodash-amd lodash-es Debian Ubuntu Wolfi npm
  • High 7.2
    CVE-2026-46981

    Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Mo…

    Oracle Oracle Utilities Network Management System
  • Medium 6.9
    CVE-2025-58050

    PCRE2: heap-buffer-overflow read in match_ref due to missing boundary restoration in SCS

    The PCRE2 library is a set of C functions that implement regular expression pattern matching. In version 10.45, a heap-buffer-overflow read vulnerability exists in the PCRE2 regular expression matching engine, specifically within the handling of the (*scs:...…

    PCRE2Project pcre2 pcre2 pcre2 Debian Alpine PyPI
  • Medium 6.8
    CVE-2026-22747 Public exploit

    Unauthorized User Impersonation when Using X.509 Client Certificates

    Vulnerability in Spring Spring Security. SubjectX500PrincipalExtractor does not correctly handle certain malformed X.509 certificate CN values, which can lead to reading the wrong value for the username. In a carefully crafted certificate, this can lead to an…

    Spring Spring Security apache-nifi apache-nifi-registry Wolfi Maven
  • Medium 6.5
    CVE-2026-24308

    Apache ZooKeeper: Sensitive information disclosure in client configuration handling

    Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO leve…

    Apache Software Foundation Apache ZooKeeper druid thingsboard-tb-node Debian Ubuntu Wolfi Maven
  • Medium 6.3
    CVE-2026-34481

    Apache Log4j JSON Template Layout: Improper serialization of non-finite floating-point values in JsonTemplateLayout

    Apache Log4j's JsonTemplateLayout https://logging.apache.org/log4j/2.x/manual/json-template-layout.html , in versions up to and including 2.25.3, produces invalid JSON output when log events contain non-finite floating-point values (NaN, Infinity, or -Infinit…

    Apache Software Foundation Apache Log4j JSON Template Layout spark-4.0-scala-2.13 spark-4.1-scala-2.13 Debian Ubuntu Wolfi Maven
  • Medium 6.1
    CVE-2026-0540

    DOMPurify XSS via Missing Rawtext Elements in SAFE_FOR_XML

    DOMPurify 3.1.3 through 3.3.1 and 2.5.3 through 2.5.8, fixed in commit 2726c74, contain a cross-site scripting vulnerability that allows attackers to bypass attribute sanitization by exploiting five missing rawtext elements (noscript, xmp, noembed, noframes, …

    cure53 DOMPurify langfuse-3-worker opensearch-dashboards-3 Debian Ubuntu Wolfi npm
  • Medium 4.6
    CVE-2026-46948

    Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Se…

    Oracle Oracle Utilities Network Management System
  • Medium 4.3
    CVE-2026-46980

    Vulnerability in the Oracle Utilities Network Management System product of Oracle Utilities Applications (component: Mo…

    Oracle Oracle Utilities Network Management System

Revision history

  1. #1

    Initiale Fassung

References