{ "generated_at": "2026-11-02T13:02:58.182294+00:00", "ci_project_path": "pdm/hub", "ci_pipeline_id": "36024", "ci_pipeline_url": "https://git.rtb-bl.de/pdm/hub/-/pipelines/36024", "source_manifest": { "generated_at": "2026-11-02T13:00:02.480247+00:00", "project_id": "1133", "ci_project_path": "pdm/hub", "ci_pipeline_id": "36024", "ci_pipeline_url": "https://git.rtb-bl.de/pdm/hub/-/pipelines/36024", "registry_tag_max_age_years": 2, "cutoff_timestamp": "2024-11-02T13:00:02.480247+00:00", "total_repositories": 12, "selected_tag_count": 36, "skipped_missing_created_at_count": 0, "skipped_older_than_cutoff_count": 0, "tag_list_response_fields": [ "location", "name", "path" ], "tag_detail_response_fields": [ "created_at", "digest", "location", "name", "path", "revision", "short_revision", "total_size" ], "images": [ { "image": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2", "repository_id": 222, "repository_path": "pdm/hub/grafana/alloy", "repository_location": "docker.rtb-bl.de/pdm/hub/grafana/alloy", "tag": "v1.19.2", "digest": "sha256:1eeba15ef3193438c72f66efd3d76f769c523a4c661db0fae6eddde906004bc8", "created_at": "2026-10-30T10:37:52.339000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/grafana/loki:3.7.7", "repository_id": 224, "repository_path": "pdm/hub/grafana/loki", "repository_location": "docker.rtb-bl.de/pdm/hub/grafana/loki", "tag": "3.7.7", "digest": "sha256:550d599ec4efacd8ebc0a5871766855057cba2bd0c669c0711d898c00d6d901f", "created_at": "2026-10-30T10:42:18.798000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/homer:26.08.3", "repository_id": 219, "repository_path": "pdm/hub/homer", "repository_location": "docker.rtb-bl.de/pdm/hub/homer", "tag": "26.08.3", "digest": "sha256:a98df254614e66f7f7d1a10053bd8629f0acc45b79c0a63782b817f762e8c23a", "created_at": "2026-10-30T10:33:04.573000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4", "repository_id": 195, "repository_path": "pdm/hub/keycloak", "repository_location": "docker.rtb-bl.de/pdm/hub/keycloak", "tag": "26.5.4", "digest": "sha256:99bf5acb4def27c9d67d2b8907670f60e57d5862a510bdafbb5c5929d66ebff3", "created_at": "2026-08-04T07:48:43.385000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1", "repository_id": 195, "repository_path": "pdm/hub/keycloak", "repository_location": "docker.rtb-bl.de/pdm/hub/keycloak", "tag": "26.6.1", "digest": "sha256:d5cb32524564fe44d0f3a4df6f9a24f1d5c8ada317026eb3ac933ec67cd2c2f1", "created_at": "2026-08-04T07:48:43.385000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0", "repository_id": 195, "repository_path": "pdm/hub/keycloak", "repository_location": "docker.rtb-bl.de/pdm/hub/keycloak", "tag": "26.7.0", "digest": "sha256:46d734881e31934e04ccb2fa561eba25eeb00d597cb6990ad2e5c1065ee688a2", "created_at": "2026-08-04T07:48:43.385000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1", "repository_id": 195, "repository_path": "pdm/hub/keycloak", "repository_location": "docker.rtb-bl.de/pdm/hub/keycloak", "tag": "26.7.0-1", "digest": "sha256:e59801c0c339ca15d4af3dfe1097d3e38b555335703b8f0f3838c4e0c0089e01", "created_at": "2026-08-06T19:18:52.125000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1", "repository_id": 195, "repository_path": "pdm/hub/keycloak", "repository_location": "docker.rtb-bl.de/pdm/hub/keycloak", "tag": "26.7.1", "digest": "sha256:8ef1240839dc6b42b541b2b4a975543033b7ffc29b84eef61b8b1152f4fb7bf2", "created_at": "2026-08-11T10:04:04.564000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3", "repository_id": 195, "repository_path": "pdm/hub/keycloak", "repository_location": "docker.rtb-bl.de/pdm/hub/keycloak", "tag": "26.7.3", "digest": "sha256:7957d8faea9e2af25e9c678f4d89a6f79bac6e080a77003a962a8734b0357dea", "created_at": "2026-09-03T19:14:20.619000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1", "repository_id": 195, "repository_path": "pdm/hub/keycloak", "repository_location": "docker.rtb-bl.de/pdm/hub/keycloak", "tag": "26.7.3-1", "digest": "sha256:504ac5f5254b189fbfe7cb1c7ba3c4d029b674fabb48b53cd674fef423cdec48", "created_at": "2026-09-04T11:26:27.388000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0", "repository_id": 217, "repository_path": "pdm/hub/pdm/control", "repository_location": "docker.rtb-bl.de/pdm/hub/pdm/control", "tag": "23.0.0", "digest": "sha256:b0d15ad834235681ff296eced94d14d9af11cbd8e65bba33671d0af0acab19f5", "created_at": "2026-10-30T10:11:13.421000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1", "repository_id": 217, "repository_path": "pdm/hub/pdm/control", "repository_location": "docker.rtb-bl.de/pdm/hub/pdm/control", "tag": "23.0.1", "digest": "sha256:5ce758e13e5141438b7ead108015fc3b308a64294997f1077c42907dff000fc6", "created_at": "2026-10-30T10:14:44.302000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0", "repository_id": 217, "repository_path": "pdm/hub/pdm/control", "repository_location": "docker.rtb-bl.de/pdm/hub/pdm/control", "tag": "23.1.0", "digest": "sha256:9497da4a59cc71d76166d443ca0c691b9e69f68077c200124a5f9215f0c2fa3a", "created_at": "2026-10-30T10:14:48.432000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0", "repository_id": 217, "repository_path": "pdm/hub/pdm/control", "repository_location": "docker.rtb-bl.de/pdm/hub/pdm/control", "tag": "23.2.0", "digest": "sha256:b9d6c517a7cc147ed0847501f6a8d2d5d05330bfdcd6fe2295db4ddbe1c6b530", "created_at": "2026-10-30T10:14:52.711000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0", "repository_id": 217, "repository_path": "pdm/hub/pdm/control", "repository_location": "docker.rtb-bl.de/pdm/hub/pdm/control", "tag": "23.3.0", "digest": "sha256:4f5bdd3bcee31586de9f741294604bde9593adc10460b8836d8478c0dc824400", "created_at": "2026-10-30T10:14:56.924000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1", "repository_id": 217, "repository_path": "pdm/hub/pdm/control", "repository_location": "docker.rtb-bl.de/pdm/hub/pdm/control", "tag": "23.3.1", "digest": "sha256:a61bd5c7c49d98102abd243500b0d13d3c28dce057afc79aa1ccf7bc4c9ff331", "created_at": "2026-10-30T10:15:01.040000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0", "repository_id": 217, "repository_path": "pdm/hub/pdm/control", "repository_location": "docker.rtb-bl.de/pdm/hub/pdm/control", "tag": "24.0.0", "digest": "sha256:0cee48b8e117e2987db80a4ff102e9ea85cd8a5f780d3f50110ca771e1edd4a3", "created_at": "2026-10-30T10:15:05.238000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0", "repository_id": 217, "repository_path": "pdm/hub/pdm/control", "repository_location": "docker.rtb-bl.de/pdm/hub/pdm/control", "tag": "24.1.0", "digest": "sha256:bc3a49fd44c46476a2ebba4fb00332766d586e9ce8376c21ca702c7c33eda6ea", "created_at": "2026-10-30T10:15:08.928000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1", "repository_id": 217, "repository_path": "pdm/hub/pdm/control", "repository_location": "docker.rtb-bl.de/pdm/hub/pdm/control", "tag": "24.1.1", "digest": "sha256:339335ecfd9f7cf2a8290551254274525ac4403c3d4bc928e10ff6da01071caa", "created_at": "2026-10-30T10:15:12.596000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2", "repository_id": 217, "repository_path": "pdm/hub/pdm/control", "repository_location": "docker.rtb-bl.de/pdm/hub/pdm/control", "tag": "24.1.2", "digest": "sha256:388b33b3b40680d61fcdcb49053c4eb9e6a22a167abbe5495ff5099ae06845b1", "created_at": "2026-10-30T10:15:16.186000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0", "repository_id": 217, "repository_path": "pdm/hub/pdm/control", "repository_location": "docker.rtb-bl.de/pdm/hub/pdm/control", "tag": "24.4.0", "digest": "sha256:e09154b20dd382a7bc1b26b629eca10fa5f2c0aa67076a539d4f4f56d219535e", "created_at": "2026-10-30T10:15:22.557000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0", "repository_id": 217, "repository_path": "pdm/hub/pdm/control", "repository_location": "docker.rtb-bl.de/pdm/hub/pdm/control", "tag": "25.0.0", "digest": "sha256:a43acf6e585a3c44c2a940b64dcd2b704679253226576e989d5d4d5d6a226b10", "created_at": "2026-10-30T10:15:27.406000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1", "repository_id": 217, "repository_path": "pdm/hub/pdm/control", "repository_location": "docker.rtb-bl.de/pdm/hub/pdm/control", "tag": "25.0.1", "digest": "sha256:728c38a9ccf7738a24a74b2406d3ffc9c194c4992ca6b6aaef28fa3c25f0ce6b", "created_at": "2026-10-30T10:15:31.711000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0", "repository_id": 217, "repository_path": "pdm/hub/pdm/control", "repository_location": "docker.rtb-bl.de/pdm/hub/pdm/control", "tag": "25.1.0", "digest": "sha256:beb2c48dd7af9093e694a07f3fd3f4b56e3b110b0107713761b5afa5c2b66136", "created_at": "2026-10-30T10:15:36.153000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0", "repository_id": 217, "repository_path": "pdm/hub/pdm/control", "repository_location": "docker.rtb-bl.de/pdm/hub/pdm/control", "tag": "25.2.0", "digest": "sha256:14f78943e54bae07c18b7f4057c7899a8f0de3a5b6dbfcadbe07ffaba977d87d", "created_at": "2026-10-30T10:15:40.527000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1", "repository_id": 217, "repository_path": "pdm/hub/pdm/control", "repository_location": "docker.rtb-bl.de/pdm/hub/pdm/control", "tag": "25.2.1", "digest": "sha256:82dfb4fcfb91f2361cbfd81e9818f480683b49254b4698fb6ed0e919ef607cd8", "created_at": "2026-10-30T10:15:44.821000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2", "repository_id": 217, "repository_path": "pdm/hub/pdm/control", "repository_location": "docker.rtb-bl.de/pdm/hub/pdm/control", "tag": "25.2.2", "digest": "sha256:b07bbd8ae6458979f63fdbbde3963a6ac9838ba397b898bca7739d04a7389037", "created_at": "2026-10-30T10:15:50.543000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0", "repository_id": 217, "repository_path": "pdm/hub/pdm/control", "repository_location": "docker.rtb-bl.de/pdm/hub/pdm/control", "tag": "25.3.0", "digest": "sha256:74915aa922b9b9e09e76c9aaf2570f0f1a21bc3c437f4f022327a53876d46204", "created_at": "2026-10-30T10:15:54.942000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:26.0.0", "repository_id": 217, "repository_path": "pdm/hub/pdm/control", "repository_location": "docker.rtb-bl.de/pdm/hub/pdm/control", "tag": "26.0.0", "digest": "sha256:98d6f6411d2b66290f89ecc336c21a278ba7ec2d2fd33204121a0bc40aba6b9a", "created_at": "2026-10-30T11:23:54.451000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1", "repository_id": 214, "repository_path": "pdm/hub/pdm/rao", "repository_location": "docker.rtb-bl.de/pdm/hub/pdm/rao", "tag": "1.7.1", "digest": "sha256:5c1d02d3cc1e1320f338b1e4dc7841b503d5498cc1b9e9d2161494436c6b1eb3", "created_at": "2026-10-30T10:23:47.753000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/sale-register:3.0.0", "repository_id": 226, "repository_path": "pdm/hub/pdm/sale-register", "repository_location": "docker.rtb-bl.de/pdm/hub/pdm/sale-register", "tag": "3.0.0", "digest": "sha256:571ad640abbf14cd5e8d212e7f76ad40a74b5e4f050e43c575fd48710d532ebd", "created_at": "2026-10-30T10:57:46.823000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/portainer/agent:2.45.0", "repository_id": 221, "repository_path": "pdm/hub/portainer/agent", "repository_location": "docker.rtb-bl.de/pdm/hub/portainer/agent", "tag": "2.45.0", "digest": "sha256:a02b76899fb49c6034ec1767b4218d06fef2081470707f8f298c6eb956bc1e2d", "created_at": "2026-10-30T10:37:18.981000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/portainer/portainer-ce:2.45.0", "repository_id": 227, "repository_path": "pdm/hub/portainer/portainer-ce", "repository_location": "docker.rtb-bl.de/pdm/hub/portainer/portainer-ce", "tag": "2.45.0", "digest": "sha256:0b0116995938b14493fff2001c2f48a268ab55a70b72448a3ed5a1159b1e9cfb", "created_at": "2026-10-30T10:59:28.640000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/prom/node-exporter:v1.12.1", "repository_id": 220, "repository_path": "pdm/hub/prom/node-exporter", "repository_location": "docker.rtb-bl.de/pdm/hub/prom/node-exporter", "tag": "v1.12.1", "digest": "sha256:da83fae85603c4e47e6c68369a7d746e2dda683dc35ea2e234b4f171e0d92798", "created_at": "2026-10-30T10:36:51.427000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/prom/prometheus:v3.14.0", "repository_id": 223, "repository_path": "pdm/hub/prom/prometheus", "repository_location": "docker.rtb-bl.de/pdm/hub/prom/prometheus", "tag": "v3.14.0", "digest": "sha256:e906cef998316bbe319f98711e1b4d8613ad37e14b08ff831d7036e77b7464f9", "created_at": "2026-10-30T10:42:04.953000+00:00" }, { "image": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12", "repository_id": 225, "repository_path": "pdm/hub/traefik", "repository_location": "docker.rtb-bl.de/pdm/hub/traefik", "tag": "v3.7.12", "digest": "sha256:7523e37d0694ff940ee9cefe2184c5869dd0c0db7d6c5ee78254f7d985deecc6", "created_at": "2026-10-30T10:42:40.682000+00:00" } ] }, "scanned_images": 36, "failed_scans": 0, "severity_counts": { "CRITICAL": 379, "HIGH": 1527, "MEDIUM": 2584, "LOW": 982, "UNKNOWN": 49 }, "top_vulnerabilities": [ { "vulnerability_id": "CVE-2020-12413", "severity": "LOW", "count": 42, "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "vulnerability_id": "CVE-2024-7531", "severity": "LOW", "count": 42, "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "vulnerability_id": "CVE-2026-89425", "severity": "HIGH", "count": 36, "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "vulnerability_id": "CVE-2026-68497", "severity": "HIGH", "count": 36, "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "vulnerability_id": "CVE-2026-91776", "severity": "HIGH", "count": 36, "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "vulnerability_id": "CVE-2026-91777", "severity": "HIGH", "count": 36, "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "vulnerability_id": "CVE-2026-19032", "severity": "MEDIUM", "count": 36, "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "vulnerability_id": "CVE-2026-83557", "severity": "MEDIUM", "count": 36, "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "vulnerability_id": "CVE-2026-63072", "severity": "MEDIUM", "count": 30, "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "vulnerability_id": "CVE-2026-63076", "severity": "MEDIUM", "count": 30, "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "vulnerability_id": "CVE-2026-63073", "severity": "LOW", "count": 30, "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "vulnerability_id": "CVE-2026-75803", "severity": "LOW", "count": 30, "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "vulnerability_id": "CVE-2026-40477", "severity": "CRITICAL", "count": 30, "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "vulnerability_id": "CVE-2026-40478", "severity": "CRITICAL", "count": 30, "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "vulnerability_id": "CVE-2026-41901", "severity": "CRITICAL", "count": 30, "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "vulnerability_id": "CVE-2023-42363", "severity": "MEDIUM", "count": 30, "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "vulnerability_id": "CVE-2023-42364", "severity": "MEDIUM", "count": 30, "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "vulnerability_id": "CVE-2023-42365", "severity": "MEDIUM", "count": 30, "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "vulnerability_id": "CVE-2023-42366", "severity": "MEDIUM", "count": 30, "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "vulnerability_id": "CVE-2026-54515", "severity": "MEDIUM", "count": 29, "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "vulnerability_id": "CVE-2026-59889", "severity": "MEDIUM", "count": 29, "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "vulnerability_id": "CVE-2026-77310", "severity": "MEDIUM", "count": 29, "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "vulnerability_id": "CVE-2026-68494", "severity": "HIGH", "count": 28, "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "vulnerability_id": "CVE-2026-54512", "severity": "HIGH", "count": 28, "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "vulnerability_id": "CVE-2026-54513", "severity": "HIGH", "count": 28, "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" } ], "images": [ { "image": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2", "vulnerability_count": 157, "highest_severity": "HIGH", "findings": [ { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-41567", "package": "github.com/docker/docker", "installed_version": "v28.5.2+incompatible", "fixed_version": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41567" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-42306", "package": "github.com/docker/docker", "installed_version": "v28.5.2+incompatible", "fixed_version": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42306" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-116587", "package": "github.com/go-jose/go-jose/v4", "installed_version": "v4.1.4", "fixed_version": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-116587" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78669", "package": "golang.org/x/net", "installed_version": "v0.58.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78669" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-84304", "package": "google.golang.org/grpc", "installed_version": "v1.83.0", "fixed_version": "1.83.1", "title": "google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84304" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-84445", "package": "google.golang.org/grpc", "installed_version": "v1.83.0", "fixed_version": "1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e", "title": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84445" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-84782", "package": "libssl3t64", "installed_version": "3.0.13-0ubuntu3.15", "fixed_version": "3.0.13-0ubuntu3.16", "title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84782" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-84782", "package": "openssl", "installed_version": "3.0.13-0ubuntu3.15", "fixed_version": "3.0.13-0ubuntu3.16", "title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84782" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-111943", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.10, 1.27.3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-111943" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78667", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78667" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78669", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78669" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-97031", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97031" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-13595", "package": "bsdutils", "installed_version": "1:2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: heap use-after-free in libblkid nested partition probing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13595" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-27456", "package": "bsdutils", "installed_version": "1:2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: TOCTOU in the mount program when setting up loop devices", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27456" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53612", "package": "bsdutils", "installed_version": "1:2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53612" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53613", "package": "bsdutils", "installed_version": "1:2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53613" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53614", "package": "bsdutils", "installed_version": "1:2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53614" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53615", "package": "bsdutils", "installed_version": "1:2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53615" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-102473", "package": "dash", "installed_version": "0.5.12-6ubuntu5", "fixed_version": null, "title": "dash: dash: Super-polynomial backtracking in pmatch when libc fnmatch is disabled", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102473" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-102474", "package": "dash", "installed_version": "0.5.12-6ubuntu5", "fixed_version": null, "title": "dash: dash: Heap out-of-bounds write in conv_escape via undersized Unicode escape reservation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102474" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53910", "package": "diffutils", "installed_version": "1:3.10-1build1", "fixed_version": "1:3.10-1ubuntu0.1", "title": "diffutils: heap\u2011based buffer overflow due to multiple signed integer overflows in line\u2011mapping calculations", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53910" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-33997", "package": "github.com/docker/docker", "installed_version": "v28.5.2+incompatible", "fixed_version": "29.3.1", "title": "moby: docker: github.com/moby/moby: Moby: Privilege validation bypass during plugin installation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33997" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41568", "package": "github.com/docker/docker", "installed_version": "v28.5.2+incompatible", "fixed_version": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41568" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-116585", "package": "github.com/go-jose/go-jose/v4", "installed_version": "v4.1.4", "fixed_version": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-116585" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-116586", "package": "github.com/go-jose/go-jose/v4", "installed_version": "v4.1.4", "fixed_version": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-116586" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86597", "package": "github.com/snowflakedb/gosnowflake", "installed_version": "v1.19.1", "fixed_version": null, "title": "Snowflake drivers writes sensitive information to logs", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86597" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-81871", "package": "go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc", "installed_version": "v0.20.0", "fixed_version": "0.21.0", "title": "go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81871" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-81872", "package": "go.opentelemetry.io/otel/sdk/log", "installed_version": "v0.20.0", "fixed_version": "0.21.0", "title": "go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81872" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56855", "package": "golang.org/x/crypto", "installed_version": "v0.55.0", "fixed_version": "0.56.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56855" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78662", "package": "golang.org/x/crypto", "installed_version": "v0.55.0", "fixed_version": "0.56.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via channel request flooding", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78662" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78659", "package": "golang.org/x/net", "installed_version": "v0.58.0", "fixed_version": "0.60.0", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78659" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78660", "package": "golang.org/x/net", "installed_version": "v0.58.0", "fixed_version": "0.60.0", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78660" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78663", "package": "golang.org/x/net", "installed_version": "v0.58.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78663" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97032", "package": "golang.org/x/net", "installed_version": "v0.58.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97032" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84303", "package": "google.golang.org/grpc", "installed_version": "v1.83.0", "fixed_version": "1.83.1", "title": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, th ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84303" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54371", "package": "libattr1", "installed_version": "1:2.5.2-1build1.1", "fixed_version": "1:2.5.2-1ubuntu0.1", "title": "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54371" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-13595", "package": "libblkid1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: heap use-after-free in libblkid nested partition probing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13595" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-27456", "package": "libblkid1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: TOCTOU in the mount program when setting up loop devices", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27456" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53612", "package": "libblkid1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53612" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53613", "package": "libblkid1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53613" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53614", "package": "libblkid1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53614" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53615", "package": "libblkid1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53615" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "libc-bin", "installed_version": "2.39-0ubuntu8.8", "fixed_version": null, "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19499", "package": "libc-bin", "installed_version": "2.39-0ubuntu8.8", "fixed_version": "2.39-0ubuntu8.9", "title": "glibc: Buffer Overflow in strfmon right-justification padding", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19499" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "libc-bin", "installed_version": "2.39-0ubuntu8.8", "fixed_version": "2.39-0ubuntu8.9", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "libc-bin", "installed_version": "2.39-0ubuntu8.8", "fixed_version": "2.39-0ubuntu8.9", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "libc-bin", "installed_version": "2.39-0ubuntu8.8", "fixed_version": "2.39-0ubuntu8.9", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "libc-bin", "installed_version": "2.39-0ubuntu8.8", "fixed_version": "2.39-0ubuntu8.9", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "libc-bin", "installed_version": "2.39-0ubuntu8.8", "fixed_version": "2.39-0ubuntu8.9", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "libc-bin", "installed_version": "2.39-0ubuntu8.8", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "libc6", "installed_version": "2.39-0ubuntu8.8", "fixed_version": null, "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19499", "package": "libc6", "installed_version": "2.39-0ubuntu8.8", "fixed_version": "2.39-0ubuntu8.9", "title": "glibc: Buffer Overflow in strfmon right-justification padding", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19499" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "libc6", "installed_version": "2.39-0ubuntu8.8", "fixed_version": "2.39-0ubuntu8.9", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "libc6", "installed_version": "2.39-0ubuntu8.8", "fixed_version": "2.39-0ubuntu8.9", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "libc6", "installed_version": "2.39-0ubuntu8.8", "fixed_version": "2.39-0ubuntu8.9", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "libc6", "installed_version": "2.39-0ubuntu8.8", "fixed_version": "2.39-0ubuntu8.9", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "libc6", "installed_version": "2.39-0ubuntu8.8", "fixed_version": "2.39-0ubuntu8.9", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "libc6", "installed_version": "2.39-0ubuntu8.8", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-67693", "package": "libgnutls30t64", "installed_version": "3.8.3-1.1ubuntu3.6", "fixed_version": null, "title": "gnutls: gnutls: Information disclosure via contradictory Key Usage and Extended Key Usage extensions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-67693" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-88647", "package": "libgnutls30t64", "installed_version": "3.8.3-1.1ubuntu3.6", "fixed_version": null, "title": "gnutls: gnutls: Information disclosure via hostname verification bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-88647" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-88648", "package": "libgnutls30t64", "installed_version": "3.8.3-1.1ubuntu3.6", "fixed_version": null, "title": "gnutls: gnutls: Cross-domain certificate restriction bypass via incomplete X.509 validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-88648" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95184", "package": "libgnutls30t64", "installed_version": "3.8.3-1.1ubuntu3.6", "fixed_version": null, "title": "gnutls: gnutls: legitimate user certificates incorrectly rejected causing denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95184" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95209", "package": "libgnutls30t64", "installed_version": "3.8.3-1.1ubuntu3.6", "fixed_version": null, "title": "gnutls: gnutls: legitimate CA certificates incorrectly rejected causing denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95209" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95210", "package": "libgnutls30t64", "installed_version": "3.8.3-1.1ubuntu3.6", "fixed_version": null, "title": "gnutls: gnutls: certificates with invalid extensions incorrectly accepted", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95210" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-13595", "package": "libmount1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: heap use-after-free in libblkid nested partition probing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13595" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-27456", "package": "libmount1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: TOCTOU in the mount program when setting up loop devices", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27456" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53612", "package": "libmount1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53612" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53613", "package": "libmount1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53613" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53614", "package": "libmount1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53614" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53615", "package": "libmount1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53615" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-13757", "package": "libp11-kit0", "installed_version": "0.25.3-4ubuntu2.1", "fixed_version": "0.25.3-4ubuntu2.2", "title": "p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13757" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18938", "package": "libp11-kit0", "installed_version": "0.25.3-4ubuntu2.1", "fixed_version": "0.25.3-4ubuntu2.2", "title": "p11-kit: Integer overflow in RPC attribute-array length calculation can under-allocate nested attribute storage on 32 bit systems", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18938" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-103111", "package": "libpcre2-8-0", "installed_version": "10.42-4ubuntu2.1", "fixed_version": null, "title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-103111" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86145", "package": "libpcre2-8-0", "installed_version": "10.42-4ubuntu2.1", "fixed_version": null, "title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86145" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89156", "package": "libpcre2-8-0", "installed_version": "10.42-4ubuntu2.1", "fixed_version": null, "title": "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89156" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89157", "package": "libpcre2-8-0", "installed_version": "10.42-4ubuntu2.1", "fixed_version": null, "title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89157" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89158", "package": "libpcre2-8-0", "installed_version": "10.42-4ubuntu2.1", "fixed_version": null, "title": "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89158" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89160", "package": "libpcre2-8-0", "installed_version": "10.42-4ubuntu2.1", "fixed_version": null, "title": "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89160" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89161", "package": "libpcre2-8-0", "installed_version": "10.42-4ubuntu2.1", "fixed_version": null, "title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89161" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-13595", "package": "libsmartcols1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: heap use-after-free in libblkid nested partition probing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13595" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-27456", "package": "libsmartcols1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: TOCTOU in the mount program when setting up loop devices", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27456" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53612", "package": "libsmartcols1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53612" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53613", "package": "libsmartcols1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53613" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53614", "package": "libsmartcols1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53614" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53615", "package": "libsmartcols1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53615" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-13595", "package": "libuuid1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: heap use-after-free in libblkid nested partition probing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13595" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-27456", "package": "libuuid1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: TOCTOU in the mount program when setting up loop devices", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27456" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53612", "package": "libuuid1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53612" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53613", "package": "libuuid1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53613" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53614", "package": "libuuid1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53614" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53615", "package": "libuuid1", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53615" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-13595", "package": "mount", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: heap use-after-free in libblkid nested partition probing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13595" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-27456", "package": "mount", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: TOCTOU in the mount program when setting up loop devices", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27456" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53612", "package": "mount", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53612" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53613", "package": "mount", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53613" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53614", "package": "mount", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53614" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53615", "package": "mount", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53615" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-15649", "package": "perl-base", "installed_version": "5.38.2-3.2ubuntu0.3", "fixed_version": "5.38.2-3.2ubuntu0.4", "title": "perl-IO-Compress: perl-IO-Compress: Denial of Service via malformed DOS date in zip header", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-15649" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-12087", "package": "perl-base", "installed_version": "5.38.2-3.2ubuntu0.3", "fixed_version": "5.38.2-3.2ubuntu0.4", "title": "perl-Socket: perl-Socket: Information Disclosure due to Out-of-Bounds Read", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-12087" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-13221", "package": "perl-base", "installed_version": "5.38.2-3.2ubuntu0.3", "fixed_version": "5.38.2-3.2ubuntu0.4", "title": "perl: Perl: Incorrect regular expression processing via large regular expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13221" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-15534", "package": "perl-base", "installed_version": "5.38.2-3.2ubuntu0.3", "fixed_version": "5.38.2-3.2ubuntu0.6", "title": "perl: Perl: Arbitrary code execution via out-of-bounds memory access in regular expression engine.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-15534" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19487", "package": "perl-base", "installed_version": "5.38.2-3.2ubuntu0.3", "fixed_version": "5.38.2-3.2ubuntu0.6", "title": "perl: Perl: Incorrect regular expression matching can lead to wrong access or filtering decisions.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19487" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-48959", "package": "perl-base", "installed_version": "5.38.2-3.2ubuntu0.3", "fixed_version": "5.38.2-3.2ubuntu0.4", "title": "perl-IO-Compress: perl-IO-Compress: CPU exhaustion via per-byte read loop in fastForward", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-48959" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-48962", "package": "perl-base", "installed_version": "5.38.2-3.2ubuntu0.3", "fixed_version": "5.38.2-3.2ubuntu0.4", "title": "perl-IO-Compress: perl-IO-Compress: Arbitrary code execution via attacker-controlled output glob", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-48962" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-57432", "package": "perl-base", "installed_version": "5.38.2-3.2ubuntu0.3", "fixed_version": "5.38.2-3.2ubuntu0.4", "title": "perl: Perl: Information disclosure via integer overflow in pack/unpack operations", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-57432" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-57433", "package": "perl-base", "installed_version": "5.38.2-3.2ubuntu0.3", "fixed_version": "5.38.2-3.2ubuntu0.4", "title": "Storable: Storable: Denial of Service via signed integer overflow in deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-57433" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-7017", "package": "perl-base", "installed_version": "5.38.2-3.2ubuntu0.3", "fixed_version": "5.38.2-3.2ubuntu0.4", "title": "HTTP::Tiny versions before 0.095 for Perl forward credential headers t ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-7017" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9538", "package": "perl-base", "installed_version": "5.38.2-3.2ubuntu0.3", "fixed_version": "5.38.2-3.2ubuntu0.4", "title": "perl-Archive-Tar: perl-Archive-Tar: Denial of Service via crafted tar header with large entry size", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9538" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56866", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56866" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78659", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78659" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78660", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78660" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78663", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78663" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94439", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94439" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94440", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94440" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94448", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94448" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97030", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97030" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97032", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97032" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18477", "package": "tar", "installed_version": "1.35+dfsg-3ubuntu0.4", "fixed_version": null, "title": "tar: tar: TOCTOU in incremental dumpdir 'X' rename handling allows restore path escape", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18477" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18508", "package": "tar", "installed_version": "1.35+dfsg-3ubuntu0.4", "fixed_version": null, "title": "tar: tar: --one-top-level hardlink targets not confined to top-level directory enabling arbitrary file overwrite", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18508" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-13595", "package": "util-linux", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: heap use-after-free in libblkid nested partition probing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13595" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-27456", "package": "util-linux", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: TOCTOU in the mount program when setting up loop devices", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27456" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53612", "package": "util-linux", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: TOCTOU in the mount program when applying post-mount ownership/mode changes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53612" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53613", "package": "util-linux", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: TOCTOU in the mount program via ancestor directory swap on target path", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53613" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53614", "package": "util-linux", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: SUID mount(8) allows nosuid/noexec bypass via LIBMOUNT_FORCE_MOUNT2", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53614" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53615", "package": "util-linux", "installed_version": "2.39.3-9ubuntu6.5", "fixed_version": "2.39.3-9ubuntu6.6", "title": "util-linux: util-linux: Partition metadata compromise via integer overflow in DOS partition parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53615" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-85091", "package": "zlib1g", "installed_version": "1:1.3.dfsg-3.1ubuntu2.1", "fixed_version": "1:1.3.dfsg-3.1ubuntu2.3", "title": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vul ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-85091" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-5278", "package": "coreutils", "installed_version": "9.4-3ubuntu6.2", "fixed_version": "9.4-3ubuntu6.3", "title": "coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-5278" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/exporters/otlp/otlptrace", "installed_version": "v1.44.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc", "installed_version": "v1.44.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp", "installed_version": "v1.44.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/sdk", "installed_version": "v1.44.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-57062", "package": "gpgv", "installed_version": "2.4.4-2ubuntu17.4", "fixed_version": "2.4.4-2ubuntu17.6", "title": "GnuPG: Incorrect cryptographic message parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-57062" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-42250", "package": "libbz2-1.0", "installed_version": "1.0.8-5.1build0.1", "fixed_version": "1.0.8-5.1ubuntu0.1", "title": "bzip2: bzip2: Denial of Service in bzip2recover via a specially crafted file", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42250" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-2236", "package": "libgcrypt20", "installed_version": "1.10.3-2ubuntu0.1", "fixed_version": "1.10.3-2ubuntu0.2", "title": "libgcrypt: vulnerable to Marvin Attack", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-2236" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-6141", "package": "libncursesw6", "installed_version": "6.4+20240113-1ubuntu2.1", "fixed_version": "6.4+20240113-1ubuntu2.2", "title": "gnu-ncurses: ncurses Stack Buffer Overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-6141" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-35189", "package": "libssl3t64", "installed_version": "3.0.13-0ubuntu3.15", "fixed_version": "3.0.13-0ubuntu3.16", "title": "openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-35189" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54872", "package": "libssl3t64", "installed_version": "3.0.13-0ubuntu3.15", "fixed_version": "3.0.13-0ubuntu3.16", "title": "openssl: OpenSSL: Private key recovery via timing side-channel in generic elliptic curve operations", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54872" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75805", "package": "libssl3t64", "installed_version": "3.0.13-0ubuntu3.15", "fixed_version": "3.0.13-0ubuntu3.16", "title": "openssl: openssl: Denial of Service via crafted CMP certificate revocation response", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75805" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75806", "package": "libssl3t64", "installed_version": "3.0.13-0ubuntu3.15", "fixed_version": "3.0.13-0ubuntu3.16", "title": "openssl: OpenSSL: Denial of Service via undersized DTLS record", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75806" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-77696", "package": "libssl3t64", "installed_version": "3.0.13-0ubuntu3.15", "fixed_version": "3.0.13-0ubuntu3.16", "title": "openssl: OpenSSL: Private key recovery via SM2 timing side-channel", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77696" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-40228", "package": "libsystemd0", "installed_version": "255.4-1ubuntu8.17", "fixed_version": null, "title": "systemd: systemd-journald: Unintended output to user terminals via logger command", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40228" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-6141", "package": "libtinfo6", "installed_version": "6.4+20240113-1ubuntu2.1", "fixed_version": "6.4+20240113-1ubuntu2.2", "title": "gnu-ncurses: ncurses Stack Buffer Overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-6141" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-40228", "package": "libudev1", "installed_version": "255.4-1ubuntu8.17", "fixed_version": null, "title": "systemd: systemd-journald: Unintended output to user terminals via logger command", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40228" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-56433", "package": "login", "installed_version": "1:4.13+dfsg1-4ubuntu3.2", "fixed_version": null, "title": "shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-56433" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-6141", "package": "ncurses-base", "installed_version": "6.4+20240113-1ubuntu2.1", "fixed_version": "6.4+20240113-1ubuntu2.2", "title": "gnu-ncurses: ncurses Stack Buffer Overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-6141" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-6141", "package": "ncurses-bin", "installed_version": "6.4+20240113-1ubuntu2.1", "fixed_version": "6.4+20240113-1ubuntu2.2", "title": "gnu-ncurses: ncurses Stack Buffer Overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-6141" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-35189", "package": "openssl", "installed_version": "3.0.13-0ubuntu3.15", "fixed_version": "3.0.13-0ubuntu3.16", "title": "openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-35189" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54872", "package": "openssl", "installed_version": "3.0.13-0ubuntu3.15", "fixed_version": "3.0.13-0ubuntu3.16", "title": "openssl: OpenSSL: Private key recovery via timing side-channel in generic elliptic curve operations", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54872" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75805", "package": "openssl", "installed_version": "3.0.13-0ubuntu3.15", "fixed_version": "3.0.13-0ubuntu3.16", "title": "openssl: openssl: Denial of Service via crafted CMP certificate revocation response", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75805" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75806", "package": "openssl", "installed_version": "3.0.13-0ubuntu3.15", "fixed_version": "3.0.13-0ubuntu3.16", "title": "openssl: OpenSSL: Denial of Service via undersized DTLS record", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75806" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-77696", "package": "openssl", "installed_version": "3.0.13-0ubuntu3.15", "fixed_version": "3.0.13-0ubuntu3.16", "title": "openssl: OpenSSL: Private key recovery via SM2 timing side-channel", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77696" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-56433", "package": "passwd", "installed_version": "1:4.13+dfsg1-4ubuntu3.2", "fixed_version": null, "title": "shadow-utils: Default subordinate ID configuration in /etc/login.defs could lead to compromise", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-56433" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-56857", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "os: golang: golang: Directory traversal via Windows junction handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56857" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/alloy:v1.19.2 (ubuntu 24.04)", "source_class": "os-pkgs", "source_type": "ubuntu", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-27171", "package": "zlib1g", "installed_version": "1:1.3.dfsg-3.1ubuntu2.1", "fixed_version": "1:1.3.dfsg-3.1ubuntu2.2", "title": "zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27171" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "GO-2026-5932", "package": "golang.org/x/crypto", "installed_version": "v0.55.0", "fixed_version": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "primary_url": null }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-78661", "package": "golang.org/x/net", "installed_version": "v0.58.0", "fixed_version": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78661" }, { "target": "usr/bin/alloy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-97045", "package": "golang.org/x/net", "installed_version": "v0.58.0", "fixed_version": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97045" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/grafana/loki:3.7.7", "vulnerability_count": 45, "highest_severity": "HIGH", "findings": [ { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-116587", "package": "github.com/go-jose/go-jose/v4", "installed_version": "v4.1.4", "fixed_version": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-116587" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78669", "package": "golang.org/x/net", "installed_version": "v0.58.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78669" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-84304", "package": "google.golang.org/grpc", "installed_version": "v1.82.1", "fixed_version": "1.83.1", "title": "google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84304" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-84445", "package": "google.golang.org/grpc", "installed_version": "v1.82.1", "fixed_version": "1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e", "title": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84445" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-111943", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.10, 1.27.3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-111943" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-33818", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.25.13, 1.26.6, 1.27.0-rc.3", "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33818" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-39821", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.25.13, 1.26.6, 1.27.0-rc.3", "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-39821" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-46600", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.6, 1.27.0-rc.3", "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-46600" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56853", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.25.13, 1.26.6, 1.27.0-rc.3", "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56853" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56858", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.25.13, 1.26.6, 1.27.0-rc.3", "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56858" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56859", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.25.13, 1.26.6, 1.27.0-rc.3", "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56859" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56860", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.25.13, 1.26.6, 1.27.0-rc.3", "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56860" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56862", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.25.13, 1.26.6, 1.27.0-rc.3", "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56862" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78667", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78667" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78669", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78669" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-97031", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97031" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-116585", "package": "github.com/go-jose/go-jose/v4", "installed_version": "v4.1.4", "fixed_version": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-116585" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-116586", "package": "github.com/go-jose/go-jose/v4", "installed_version": "v4.1.4", "fixed_version": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-116586" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-81871", "package": "go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc", "installed_version": "v0.19.0", "fixed_version": "0.21.0", "title": "go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81871" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-81872", "package": "go.opentelemetry.io/otel/sdk/log", "installed_version": "v0.19.0", "fixed_version": "0.21.0", "title": "go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81872" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56855", "package": "golang.org/x/crypto", "installed_version": "v0.55.0", "fixed_version": "0.56.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56855" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78662", "package": "golang.org/x/crypto", "installed_version": "v0.55.0", "fixed_version": "0.56.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via channel request flooding", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78662" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78659", "package": "golang.org/x/net", "installed_version": "v0.58.0", "fixed_version": "0.60.0", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78659" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78660", "package": "golang.org/x/net", "installed_version": "v0.58.0", "fixed_version": "0.60.0", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78660" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78663", "package": "golang.org/x/net", "installed_version": "v0.58.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78663" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97032", "package": "golang.org/x/net", "installed_version": "v0.58.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97032" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84303", "package": "google.golang.org/grpc", "installed_version": "v1.82.1", "fixed_version": "1.83.1", "title": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, th ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84303" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56866", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56866" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78659", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78659" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78660", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78660" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78663", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78663" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94439", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94439" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94440", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94440" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94448", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94448" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97030", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97030" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97032", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97032" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/exporters/otlp/otlptrace", "installed_version": "v1.44.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc", "installed_version": "v1.44.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp", "installed_version": "v1.44.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/sdk", "installed_version": "v1.44.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-56857", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "os: golang: golang: Directory traversal via Windows junction handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56857" }, { "target": "docker.rtb-bl.de/pdm/hub/grafana/loki:3.7.7 (debian 13.6)", "source_class": "os-pkgs", "source_type": "debian", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "DSA-6572-1", "package": "ca-certificates", "installed_version": "20250419", "fixed_version": "20250419+deb13u1", "title": "ca-certificates - security update", "primary_url": null }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "GO-2026-5932", "package": "golang.org/x/crypto", "installed_version": "v0.55.0", "fixed_version": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "primary_url": null }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-78661", "package": "golang.org/x/net", "installed_version": "v0.58.0", "fixed_version": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78661" }, { "target": "usr/bin/loki", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-97045", "package": "golang.org/x/net", "installed_version": "v0.58.0", "fixed_version": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97045" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/homer:26.08.3", "vulnerability_count": 32, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-111497", "package": "brotli-libs", "installed_version": "1.2.0-r0", "fixed_version": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-103111", "package": "pcre2", "installed_version": "10.47-r0", "fixed_version": "10.49-r0", "title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-103111" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-86145", "package": "pcre2", "installed_version": "10.47-r0", "fixed_version": "10.48-r0", "title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86145" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-89157", "package": "pcre2", "installed_version": "10.47-r0", "fixed_version": "10.48-r0", "title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89157" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-89161", "package": "pcre2", "installed_version": "10.47-r0", "fixed_version": "10.48-r0", "title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89161" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89156", "package": "pcre2", "installed_version": "10.47-r0", "fixed_version": "10.48-r0", "title": "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89156" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89158", "package": "pcre2", "installed_version": "10.47-r0", "fixed_version": "10.48-r0", "title": "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89158" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89160", "package": "pcre2", "installed_version": "10.47-r0", "fixed_version": "10.48-r0", "title": "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89160" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-85091", "package": "zlib", "installed_version": "1.3.2-r0", "fixed_version": "1.3.2-r1", "title": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vul ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-85091" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89162", "package": "pcre2", "installed_version": "10.47-r0", "fixed_version": "10.48-r0", "title": "pcre2: PCRE2: Information disclosure via pcre2_serialize_encode", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89162" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-107891", "package": "musl", "installed_version": "1.2.5-r23", "fixed_version": "1.2.5-r24", "title": "Title Not Available", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-107891" }, { "target": "docker.rtb-bl.de/pdm/hub/homer:26.08.3 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-107891", "package": "musl-utils", "installed_version": "1.2.5-r23", "fixed_version": "1.2.5-r24", "title": "Title Not Available", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-107891" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1", "vulnerability_count": 167, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-114406", "package": "ca-certificates", "installed_version": "2025.2.80_v9.0.305-91.el9", "fixed_version": "2026.2.92_v9.0.319-90.3.el9_8", "title": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-114406" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed_version": "4.1.136.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-8763", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.84", "fixed_version": "1.85", "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8763" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-8763", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.84", "fixed_version": "1.85", "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8763" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-84939", "package": "org.freemarker:freemarker", "installed_version": "2.3.32", "fixed_version": "2.3.35", "title": "org.apache.freemarker/freemarker: Apache FreeMarker: Path traversal via malformed locale identifier", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84939" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.5", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.5", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.5", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.5", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "33.5.0-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-59250", "package": "com.microsoft.sqlserver:mssql-jdbc", "installed_version": "13.2.1", "fixed_version": "10.2.4.jre11, 11.2.4.jre11, 12.2.1.jre11, 12.6.5.jre11, 12.8.2.jre11, 12.10.2.jre11, 13.2.1.jre11", "title": "JDBC Driver for SQL Server has improper input validation issue", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-59250" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-91403", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91403" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-91415", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance font rendering (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91415" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-13506", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.84", "fixed_version": "1.85", "title": "bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-13506", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.84", "fixed_version": "1.85", "title": "bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13506" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-103111", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-103111" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-86145", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86145" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-89161", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89161" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-103111", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-103111" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-86145", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86145" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-89161", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89161" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-119373", "package": "sqlite-libs", "installed_version": "3.34.1-11.el9_8", "fixed_version": null, "title": "sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119373" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-119586", "package": "sqlite-libs", "installed_version": "3.34.1-11.el9_8", "fixed_version": null, "title": "sqlite: sqlite: Arbitrary command execution via .recover command", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119586" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56391", "package": "coreutils-single", "installed_version": "8.32-41.el9_8", "fixed_version": null, "title": "coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56391" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56392", "package": "coreutils-single", "installed_version": "8.32-41.el9_8", "fixed_version": "8.32-41.el9_8.1", "title": "coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56392" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84243", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Arbitrary code execution via directory traversal in LANGUAGE environment variable", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84243" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8674", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86805", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95818", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84243", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Arbitrary code execution via directory traversal in LANGUAGE environment variable", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84243" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8674", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86805", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95818", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84243", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Arbitrary code execution via directory traversal in LANGUAGE environment variable", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84243" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8674", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86805", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95818", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59903", "package": "io.netty:netty-codec-http", "installed_version": "4.1.136.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59903" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75596", "package": "io.netty:netty-handler", "installed_version": "4.1.136.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "Netty is an asynchronous, event-driven network application framework. ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75596" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-118259", "package": "io.opentelemetry:opentelemetry-api", "installed_version": "1.57.0", "fixed_version": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-118259" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-45292", "package": "io.opentelemetry:opentelemetry-api", "installed_version": "1.57.0", "fixed_version": "1.62.0", "title": "opentelemetry-java: opentelemetry-api: opentelemetry-extension-trace-propagators: OpenTelemetry Java: Denial of Service due to unbounded memory allocation when parsing oversized baggage", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45292" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-28164", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "libpng: libpng: Denial of Service via buffer overflow in png_create_read_struct() function", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-28164" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-64505", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "libpng: LIBPNG heap buffer overflow via malformed palette index", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-64505" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-64506", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "libpng: LIBPNG heap buffer over-read", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-64506" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-101516", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-101516" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22693", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "harfbuzz: Null Pointer Dereference in harfbuzz", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22693" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-34757", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "libpng: libpng: Information disclosure and data corruption via use-after-free vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34757" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-40930", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "libpng: libpng: Data integrity and availability impact due to improper APNG chunk handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40930" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-46675", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "libpng: libpng: Use-after-free in sequential reader when png_read_end called without reading image rows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-46675" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49919", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "freetype: Integer overflow in FreeType tt_face_colr_blend_layer() leads to heap buffer overflow during COLR font rendering", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49919" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83374", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance PKCS5 padding (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83378", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Improve C2 loop transformations (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83378" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83380", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance LDAP logins (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83380" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83381", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance SASL Authentication (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83381" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83387", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance WebRowSets (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83387" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83395", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP Client Response Handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83395" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83400", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance XML Processing (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83400" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-87290", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance XPath Expressions (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87290" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-87291", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP Server (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87291" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-87294", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Certificate Name Checks (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87294" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91332", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP Client (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91332" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91373", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance TLS handshakes (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91373" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91374", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance jstatd (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91375", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance jmod handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91375" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91379", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance JShell (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91379" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91380", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Preferences (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91380" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91382", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "openjdk: Enhance Image Processing (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91382" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91394", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP client caching (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91394" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91398", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance SOCKS5 support (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91398" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91410", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance zipfs (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91410" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91418", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance GIF loading (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91418" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91451", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91451" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91452", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP server (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91452" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91453", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Improve HTTP headers (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91453" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91462", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance krb5 tokens (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91462" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91463", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance krb5 client (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91463" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91464", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Kerberos validation (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91464" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91487", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance C2 comparisons (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91487" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95512", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "freetype: FreeType: Denial of Service via repeated subroutine allocations in CID font loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95512" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-102010", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102010" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-114690", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: Confirmed out-of-bounds read/write in libstdc++ parallel `std", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-114690" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-114691", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: Integer wrap in `std", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-114691" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95619", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: libstdc++ integer overflow in `new` operator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95619" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119210", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.9", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119210" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119276", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.9", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119276" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119279", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.9", "fixed_version": "3.3.7, 3.4.5, 3.5.10", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119279" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119281", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.9", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119281" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89157", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89157" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89158", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89158" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89157", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89157" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89158", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89158" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5958", "package": "sed", "installed_version": "4.8-10.el9", "fixed_version": null, "title": "sed: GNU sed TOCTOU race condition", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5958" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119378", "package": "sqlite-libs", "installed_version": "3.34.1-11.el9_8", "fixed_version": null, "title": "sqlite: sqlite: Denial of Service via use-after-free in R-Tree extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119378" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119591", "package": "sqlite-libs", "installed_version": "3.34.1-11.el9_8", "fixed_version": null, "title": "sqlite: sqlite: Denial of Service via stack exhaustion in countOfViewOptimization()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119591" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50812", "package": "sqlite-libs", "installed_version": "3.34.1-11.el9_8", "fixed_version": null, "title": "sqlite: SQLite: Denial of Service via malformed changeset in Session Extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50812" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-97399", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-97399", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-97399", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-27171", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27171" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-83376", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance TLS certificate handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83376" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-87292", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Network Clients (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87292" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-87367", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Template Handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87367" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91333", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Improve ciphertext handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91333" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91334", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance JPEG loading (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91334" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91335", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Image Handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91335" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91397", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance diagnostic sessions (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91397" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91400", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91400" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91409", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "openjdk: Enhance QUIC connections (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91409" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91461", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance TLS Extensions (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91461" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2021-46195", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: uncontrolled recursion in libiberty/rust-demangle.c", "primary_url": "https://avd.aquasec.com/nvd/cve-2021-46195" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2022-27943", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-27943" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-115456", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: Out-of-bounds read in std::from_chars", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-115456" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-50495", "package": "ncurses-base", "installed_version": "6.2-12.20210508.el9", "fixed_version": null, "title": "ncurses: segmentation fault via _nc_wrap_entry()", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-50495" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-50495", "package": "ncurses-libs", "installed_version": "6.2-12.20210508.el9", "fixed_version": null, "title": "ncurses: segmentation fault via _nc_wrap_entry()", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-50495" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nspr", "installed_version": "4.39.0-5.el9_6", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nspr", "installed_version": "4.39.0-5.el9_6", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss", "installed_version": "3.124.0-5.el9_6", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss", "installed_version": "3.124.0-5.el9_6", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-softokn", "installed_version": "3.124.0-5.el9_6", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-softokn", "installed_version": "3.124.0-5.el9_6", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-softokn-freebl", "installed_version": "3.124.0-5.el9_6", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-softokn-freebl", "installed_version": "3.124.0-5.el9_6", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-sysinit", "installed_version": "3.124.0-5.el9_6", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-sysinit", "installed_version": "3.124.0-5.el9_6", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-util", "installed_version": "3.124.0-5.el9_6", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-util", "installed_version": "3.124.0-5.el9_6", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-119280", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.9", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119280" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2022-41409", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": null, "title": "pcre2: negative repeat value in a pcre2test subject line leads to inifinite loop", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-41409" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89156", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89156" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89160", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89160" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2022-41409", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": null, "title": "pcre2: negative repeat value in a pcre2test subject line leads to inifinite loop", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-41409" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89156", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89156" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89160", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89160" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-0232", "package": "sqlite-libs", "installed_version": "3.34.1-11.el9_8", "fixed_version": null, "title": "sqlite: use-after-free bug in jsonParseAddNodeArray", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-0232" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-70873", "package": "sqlite-libs", "installed_version": "3.34.1-11.el9_8", "fixed_version": null, "title": "sqlite: SQLite: Information Disclosure via Crafted ZIP File", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-70873" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-27171", "package": "zlib", "installed_version": "1.2.11-40.el9", "fixed_version": null, "title": "zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27171" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3", "vulnerability_count": 167, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-114406", "package": "ca-certificates", "installed_version": "2025.2.80_v9.0.305-91.el9", "fixed_version": "2026.2.92_v9.0.319-90.3.el9_8", "title": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-114406" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed_version": "4.1.136.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-8763", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.84", "fixed_version": "1.85", "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8763" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-8763", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.84", "fixed_version": "1.85", "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8763" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-84939", "package": "org.freemarker:freemarker", "installed_version": "2.3.32", "fixed_version": "2.3.35", "title": "org.apache.freemarker/freemarker: Apache FreeMarker: Path traversal via malformed locale identifier", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84939" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.5", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.5", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.5", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.5", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "33.5.0-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-59250", "package": "com.microsoft.sqlserver:mssql-jdbc", "installed_version": "13.2.1", "fixed_version": "10.2.4.jre11, 11.2.4.jre11, 12.2.1.jre11, 12.6.5.jre11, 12.8.2.jre11, 12.10.2.jre11, 13.2.1.jre11", "title": "JDBC Driver for SQL Server has improper input validation issue", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-59250" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-91403", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91403" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-91415", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance font rendering (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91415" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-13506", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.84", "fixed_version": "1.85", "title": "bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-13506", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.84", "fixed_version": "1.85", "title": "bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13506" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-103111", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-103111" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-86145", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86145" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-89161", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89161" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-103111", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-103111" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-86145", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86145" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-89161", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89161" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-119373", "package": "sqlite-libs", "installed_version": "3.34.1-11.el9_8", "fixed_version": null, "title": "sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119373" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-119586", "package": "sqlite-libs", "installed_version": "3.34.1-11.el9_8", "fixed_version": null, "title": "sqlite: sqlite: Arbitrary command execution via .recover command", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119586" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56391", "package": "coreutils-single", "installed_version": "8.32-41.el9_8", "fixed_version": null, "title": "coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56391" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56392", "package": "coreutils-single", "installed_version": "8.32-41.el9_8", "fixed_version": "8.32-41.el9_8.1", "title": "coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56392" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84243", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Arbitrary code execution via directory traversal in LANGUAGE environment variable", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84243" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8674", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86805", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95818", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84243", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Arbitrary code execution via directory traversal in LANGUAGE environment variable", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84243" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8674", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86805", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95818", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84243", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Arbitrary code execution via directory traversal in LANGUAGE environment variable", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84243" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8674", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86805", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95818", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59903", "package": "io.netty:netty-codec-http", "installed_version": "4.1.136.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59903" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75596", "package": "io.netty:netty-handler", "installed_version": "4.1.136.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "Netty is an asynchronous, event-driven network application framework. ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75596" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-118259", "package": "io.opentelemetry:opentelemetry-api", "installed_version": "1.57.0", "fixed_version": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-118259" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-45292", "package": "io.opentelemetry:opentelemetry-api", "installed_version": "1.57.0", "fixed_version": "1.62.0", "title": "opentelemetry-java: opentelemetry-api: opentelemetry-extension-trace-propagators: OpenTelemetry Java: Denial of Service due to unbounded memory allocation when parsing oversized baggage", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45292" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-28164", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "libpng: libpng: Denial of Service via buffer overflow in png_create_read_struct() function", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-28164" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-64505", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "libpng: LIBPNG heap buffer overflow via malformed palette index", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-64505" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-64506", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "libpng: LIBPNG heap buffer over-read", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-64506" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-101516", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-101516" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22693", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "harfbuzz: Null Pointer Dereference in harfbuzz", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22693" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-34757", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "libpng: libpng: Information disclosure and data corruption via use-after-free vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34757" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-40930", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "libpng: libpng: Data integrity and availability impact due to improper APNG chunk handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40930" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-46675", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "libpng: libpng: Use-after-free in sequential reader when png_read_end called without reading image rows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-46675" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49919", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "freetype: Integer overflow in FreeType tt_face_colr_blend_layer() leads to heap buffer overflow during COLR font rendering", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49919" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83374", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance PKCS5 padding (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83378", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Improve C2 loop transformations (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83378" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83380", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance LDAP logins (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83380" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83381", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance SASL Authentication (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83381" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83387", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance WebRowSets (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83387" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83395", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP Client Response Handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83395" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83400", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance XML Processing (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83400" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-87290", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance XPath Expressions (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87290" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-87291", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP Server (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87291" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-87294", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Certificate Name Checks (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87294" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91332", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP Client (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91332" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91373", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance TLS handshakes (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91373" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91374", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance jstatd (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91375", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance jmod handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91375" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91379", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance JShell (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91379" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91380", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Preferences (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91380" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91382", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "openjdk: Enhance Image Processing (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91382" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91394", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP client caching (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91394" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91398", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance SOCKS5 support (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91398" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91410", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance zipfs (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91410" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91418", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance GIF loading (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91418" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91451", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91451" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91452", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP server (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91452" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91453", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Improve HTTP headers (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91453" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91462", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance krb5 tokens (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91462" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91463", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance krb5 client (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91463" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91464", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Kerberos validation (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91464" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91487", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance C2 comparisons (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91487" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95512", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "freetype: FreeType: Denial of Service via repeated subroutine allocations in CID font loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95512" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-102010", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102010" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-114690", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: Confirmed out-of-bounds read/write in libstdc++ parallel `std", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-114690" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-114691", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: Integer wrap in `std", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-114691" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95619", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: libstdc++ integer overflow in `new` operator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95619" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119210", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.9", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119210" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119276", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.9", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119276" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119279", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.9", "fixed_version": "3.3.7, 3.4.5, 3.5.10", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119279" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119281", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.9", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119281" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89157", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89157" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89158", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89158" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89157", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89157" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89158", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89158" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5958", "package": "sed", "installed_version": "4.8-10.el9", "fixed_version": null, "title": "sed: GNU sed TOCTOU race condition", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5958" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119378", "package": "sqlite-libs", "installed_version": "3.34.1-11.el9_8", "fixed_version": null, "title": "sqlite: sqlite: Denial of Service via use-after-free in R-Tree extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119378" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119591", "package": "sqlite-libs", "installed_version": "3.34.1-11.el9_8", "fixed_version": null, "title": "sqlite: sqlite: Denial of Service via stack exhaustion in countOfViewOptimization()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119591" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50812", "package": "sqlite-libs", "installed_version": "3.34.1-11.el9_8", "fixed_version": null, "title": "sqlite: SQLite: Denial of Service via malformed changeset in Session Extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50812" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-97399", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-97399", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-97399", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-27171", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27171" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-83376", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance TLS certificate handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83376" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-87292", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Network Clients (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87292" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-87367", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Template Handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87367" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91333", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Improve ciphertext handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91333" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91334", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance JPEG loading (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91334" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91335", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Image Handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91335" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91397", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance diagnostic sessions (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91397" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91400", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91400" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91409", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": null, "title": "openjdk: Enhance QUIC connections (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91409" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91461", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.1.1-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance TLS Extensions (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91461" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2021-46195", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: uncontrolled recursion in libiberty/rust-demangle.c", "primary_url": "https://avd.aquasec.com/nvd/cve-2021-46195" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2022-27943", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-27943" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-115456", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: Out-of-bounds read in std::from_chars", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-115456" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-50495", "package": "ncurses-base", "installed_version": "6.2-12.20210508.el9", "fixed_version": null, "title": "ncurses: segmentation fault via _nc_wrap_entry()", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-50495" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-50495", "package": "ncurses-libs", "installed_version": "6.2-12.20210508.el9", "fixed_version": null, "title": "ncurses: segmentation fault via _nc_wrap_entry()", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-50495" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nspr", "installed_version": "4.39.0-5.el9_6", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nspr", "installed_version": "4.39.0-5.el9_6", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss", "installed_version": "3.124.0-5.el9_6", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss", "installed_version": "3.124.0-5.el9_6", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-softokn", "installed_version": "3.124.0-5.el9_6", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-softokn", "installed_version": "3.124.0-5.el9_6", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-softokn-freebl", "installed_version": "3.124.0-5.el9_6", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-softokn-freebl", "installed_version": "3.124.0-5.el9_6", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-sysinit", "installed_version": "3.124.0-5.el9_6", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-sysinit", "installed_version": "3.124.0-5.el9_6", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-util", "installed_version": "3.124.0-5.el9_6", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-util", "installed_version": "3.124.0-5.el9_6", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-119280", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.9", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119280" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2022-41409", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": null, "title": "pcre2: negative repeat value in a pcre2test subject line leads to inifinite loop", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-41409" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89156", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89156" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89160", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89160" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2022-41409", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": null, "title": "pcre2: negative repeat value in a pcre2test subject line leads to inifinite loop", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-41409" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89156", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89156" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89160", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89160" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-0232", "package": "sqlite-libs", "installed_version": "3.34.1-11.el9_8", "fixed_version": null, "title": "sqlite: use-after-free bug in jsonParseAddNodeArray", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-0232" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-70873", "package": "sqlite-libs", "installed_version": "3.34.1-11.el9_8", "fixed_version": null, "title": "sqlite: SQLite: Information Disclosure via Crafted ZIP File", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-70873" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.3 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-27171", "package": "zlib", "installed_version": "1.2.11-40.el9", "fixed_version": null, "title": "zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27171" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1", "vulnerability_count": 218, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-114406", "package": "ca-certificates", "installed_version": "2025.2.80_v9.0.305-91.el9", "fixed_version": "2026.2.92_v9.0.319-90.3.el9_8", "title": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-114406" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed_version": "4.1.135.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-8763", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.84", "fixed_version": "1.85", "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8763" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-8763", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.84", "fixed_version": "1.85", "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8763" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-84939", "package": "org.freemarker:freemarker", "installed_version": "2.3.32", "fixed_version": "2.3.35", "title": "org.apache.freemarker/freemarker: Apache FreeMarker: Path traversal via malformed locale identifier", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84939" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-18963", "package": "org.keycloak:keycloak-services", "installed_version": "26.7.1", "fixed_version": "26.4.15, 26.6.6, 26.7.2", "title": "keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18963" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "33.5.0-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-59250", "package": "com.microsoft.sqlserver:mssql-jdbc", "installed_version": "13.2.1", "fixed_version": "10.2.4.jre11, 11.2.4.jre11, 12.2.1.jre11, 12.6.5.jre11, 12.8.2.jre11, 12.10.2.jre11, 13.2.1.jre11", "title": "JDBC Driver for SQL Server has improper input validation issue", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-59250" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40983", "package": "io.micrometer:micrometer-core", "installed_version": "1.16.3", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40983" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.16.3", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-59901", "package": "io.netty:netty-codec", "installed_version": "4.1.135.Final", "fixed_version": "4.1.136.Final", "title": "io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55851", "package": "io.netty:netty-codec-haproxy", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55851" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55831", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55831" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55833", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55833" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56745", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56819", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56819" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-91403", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91403" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-91415", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance font rendering (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91415" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-13506", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.84", "fixed_version": "1.85", "title": "bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-13506", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.84", "fixed_version": "1.85", "title": "bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54291", "package": "org.postgresql:postgresql", "installed_version": "42.7.11", "fixed_version": "42.7.12", "title": "org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54291" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-103111", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-103111" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-86145", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86145" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-89161", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89161" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-103111", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-103111" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-86145", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86145" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-89161", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89161" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11822", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": "3.34.1-11.el9_8", "title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11822" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11824", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": "3.34.1-11.el9_8", "title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11824" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-119373", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": null, "title": "sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119373" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-119586", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": null, "title": "sqlite: sqlite: Arbitrary command execution via .recover command", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119586" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54516", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Security bypass due to improper handling of renamed properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54516" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54516", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Security bypass due to improper handling of renamed properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54516" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54517", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information disclosure via improper JsonView filter application", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54517" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54517", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information disclosure via improper JsonView filter application", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54517" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54518", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4", "title": "jackson-databind: jackson-databind: Information disclosure and data manipulation via view-based access control bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54518" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54518", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4", "title": "jackson-databind: jackson-databind: Information disclosure and data manipulation via view-based access control bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54518" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59888", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59888", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "GHSA-mhm7-754m-9p8w", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.9, 2.21.5", "title": "jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`", "primary_url": "https://github.com/advisories/GHSA-mhm7-754m-9p8w" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "GHSA-mhm7-754m-9p8w", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.9, 2.21.5", "title": "jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`", "primary_url": "https://github.com/advisories/GHSA-mhm7-754m-9p8w" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56391", "package": "coreutils-single", "installed_version": "8.32-41.el9_8", "fixed_version": null, "title": "coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56391" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56392", "package": "coreutils-single", "installed_version": "8.32-41.el9_8", "fixed_version": "8.32-41.el9_8.1", "title": "coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56392" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84243", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Arbitrary code execution via directory traversal in LANGUAGE environment variable", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84243" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8674", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86805", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95818", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84243", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Arbitrary code execution via directory traversal in LANGUAGE environment variable", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84243" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8674", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86805", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95818", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84243", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Arbitrary code execution via directory traversal in LANGUAGE environment variable", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84243" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8674", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86805", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95818", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-73508", "package": "io.netty:netty-codec-dns", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-73508" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59919", "package": "io.netty:netty-codec-haproxy", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-haproxy: Netty: Improper CR/LF neutralization in netty-codec-haproxy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59919" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56746", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56746" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59898", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59898" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59899", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59899" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59903", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59903" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59921", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59921" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59900", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59900" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75596", "package": "io.netty:netty-handler", "installed_version": "4.1.135.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "Netty is an asynchronous, event-driven network application framework. ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75596" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-118259", "package": "io.opentelemetry:opentelemetry-api", "installed_version": "1.57.0", "fixed_version": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-118259" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-45292", "package": "io.opentelemetry:opentelemetry-api", "installed_version": "1.57.0", "fixed_version": "1.62.0", "title": "opentelemetry-java: opentelemetry-api: opentelemetry-extension-trace-propagators: OpenTelemetry Java: Denial of Service due to unbounded memory allocation when parsing oversized baggage", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45292" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-28164", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "libpng: libpng: Denial of Service via buffer overflow in png_create_read_struct() function", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-28164" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-64505", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "libpng: LIBPNG heap buffer overflow via malformed palette index", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-64505" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-64506", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "libpng: LIBPNG heap buffer over-read", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-64506" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-101516", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-101516" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22693", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "harfbuzz: Null Pointer Dereference in harfbuzz", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22693" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-34757", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "libpng: libpng: Information disclosure and data corruption via use-after-free vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34757" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-40930", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "libpng: libpng: Data integrity and availability impact due to improper APNG chunk handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40930" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-46675", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "libpng: libpng: Use-after-free in sequential reader when png_read_end called without reading image rows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-46675" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49919", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "freetype: Integer overflow in FreeType tt_face_colr_blend_layer() leads to heap buffer overflow during COLR font rendering", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49919" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-60589", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.12.1.1-1.2.el9", "title": "OpenJDK: Improve Resource Resolving (2026-08 Security Update)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-60589" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-61308", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.12.1.1-1.2.el9", "title": "OpenJDK: Enhance HTTP Connections (2026-08 Security Update)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-61308" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-70907", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.12.1.1-1.2.el9", "title": "OpenJDK: Enhance TLS server (2026-08 Security Update)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-70907" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83374", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance PKCS5 padding (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83378", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Improve C2 loop transformations (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83378" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83380", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance LDAP logins (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83380" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83381", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance SASL Authentication (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83381" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83387", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance WebRowSets (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83387" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83395", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP Client Response Handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83395" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83400", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance XML Processing (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83400" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-87290", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance XPath Expressions (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87290" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-87291", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP Server (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87291" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-87294", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Certificate Name Checks (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87294" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91332", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP Client (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91332" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91373", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance TLS handshakes (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91373" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91374", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance jstatd (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91375", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance jmod handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91375" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91379", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance JShell (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91379" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91380", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Preferences (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91380" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91382", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "openjdk: Enhance Image Processing (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91382" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91394", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP client caching (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91394" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91398", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance SOCKS5 support (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91398" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91410", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance zipfs (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91410" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91418", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance GIF loading (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91418" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91451", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91451" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91452", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP server (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91452" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91453", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Improve HTTP headers (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91453" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91462", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance krb5 tokens (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91462" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91463", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance krb5 client (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91463" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91464", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Kerberos validation (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91464" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91487", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance C2 comparisons (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91487" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95512", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "freetype: FreeType: Denial of Service via repeated subroutine allocations in CID font loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95512" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54371", "package": "libattr", "installed_version": "2.5.1-3.el9", "fixed_version": "2.6.0-1.el9_8", "title": "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54371" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-102010", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102010" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-114690", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: Confirmed out-of-bounds read/write in libstdc++ parallel `std", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-114690" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-114691", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: Integer wrap in `std", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-114691" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95619", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: libstdc++ integer overflow in `new` operator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95619" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119210", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119210" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119276", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119276" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119279", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "3.3.7, 3.4.5, 3.5.10", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119279" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119281", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119281" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-55856", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "2.7.14, 3.3.5, 3.4.3, 3.5.9", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Cleartext password disclosure via man-in-the-middle during initial handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55856" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-55857", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "2.7.14, 3.3.5, 3.4.3, 3.5.9", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Information Disclosure via Insecure PAM Dialog Authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55857" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-55858", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "2.7.14, 3.3.5, 3.4.3, 3.5.9", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Silent data corruption due to character set mismatch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55858" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89157", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89157" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89158", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89158" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89157", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89157" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89158", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89158" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5958", "package": "sed", "installed_version": "4.8-10.el9", "fixed_version": null, "title": "sed: GNU sed TOCTOU race condition", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5958" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119378", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": null, "title": "sqlite: sqlite: Denial of Service via use-after-free in R-Tree extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119378" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119591", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": null, "title": "sqlite: sqlite: Denial of Service via stack exhaustion in countOfViewOptimization()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119591" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50812", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": null, "title": "sqlite: SQLite: Denial of Service via malformed changeset in Session Extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50812" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-97399", "package": "glibc", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-97399", "package": "glibc-common", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-97399", "package": "glibc-langpack-en", "installed_version": "2.34-275.el9_8", "fixed_version": null, "title": "glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-27171", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27171" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-83376", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance TLS certificate handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83376" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-87292", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Network Clients (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87292" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-87367", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Template Handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87367" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91333", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Improve ciphertext handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91333" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91334", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance JPEG loading (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91334" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91335", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Image Handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91335" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91397", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance diagnostic sessions (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91397" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91400", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91400" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91409", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "openjdk: Enhance QUIC connections (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91409" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91461", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance TLS Extensions (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91461" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2021-46195", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: uncontrolled recursion in libiberty/rust-demangle.c", "primary_url": "https://avd.aquasec.com/nvd/cve-2021-46195" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2022-27943", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-27943" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-115456", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: Out-of-bounds read in std::from_chars", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-115456" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-50495", "package": "ncurses-base", "installed_version": "6.2-12.20210508.el9", "fixed_version": null, "title": "ncurses: segmentation fault via _nc_wrap_entry()", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-50495" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-50495", "package": "ncurses-libs", "installed_version": "6.2-12.20210508.el9", "fixed_version": null, "title": "ncurses: segmentation fault via _nc_wrap_entry()", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-50495" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nspr", "installed_version": "4.36.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nspr", "installed_version": "4.36.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-softokn", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-softokn", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-softokn-freebl", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-softokn-freebl", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-sysinit", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-sysinit", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-util", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-util", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-119280", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119280" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-61700", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "2.7.14, 3.3.5, 3.4.3, 3.5.9", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Information disclosure via server-initiated LOCAL INFILE requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-61700" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2022-41409", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": null, "title": "pcre2: negative repeat value in a pcre2test subject line leads to inifinite loop", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-41409" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89156", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89156" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89160", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89160" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2022-41409", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": null, "title": "pcre2: negative repeat value in a pcre2test subject line leads to inifinite loop", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-41409" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89156", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89156" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89160", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89160" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-0232", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": null, "title": "sqlite: use-after-free bug in jsonParseAddNodeArray", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-0232" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-70873", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": null, "title": "sqlite: SQLite: Information Disclosure via Crafted ZIP File", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-70873" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-27171", "package": "zlib", "installed_version": "1.2.11-40.el9", "fixed_version": null, "title": "zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27171" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1", "vulnerability_count": 219, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-114406", "package": "ca-certificates", "installed_version": "2025.2.80_v9.0.305-91.el9", "fixed_version": "2026.2.92_v9.0.319-90.3.el9_8", "title": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-114406" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed_version": "4.1.135.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-8763", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.84", "fixed_version": "1.85", "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8763" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-8763", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.84", "fixed_version": "1.85", "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8763" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-84939", "package": "org.freemarker:freemarker", "installed_version": "2.3.32", "fixed_version": "2.3.35", "title": "org.apache.freemarker/freemarker: Apache FreeMarker: Path traversal via malformed locale identifier", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84939" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-18963", "package": "org.keycloak:keycloak-services", "installed_version": "26.7.0", "fixed_version": "26.4.15, 26.6.6, 26.7.2", "title": "keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18963" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "33.5.0-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-59250", "package": "com.microsoft.sqlserver:mssql-jdbc", "installed_version": "13.2.1", "fixed_version": "10.2.4.jre11, 11.2.4.jre11, 12.2.1.jre11, 12.6.5.jre11, 12.8.2.jre11, 12.10.2.jre11, 13.2.1.jre11", "title": "JDBC Driver for SQL Server has improper input validation issue", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-59250" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40983", "package": "io.micrometer:micrometer-core", "installed_version": "1.16.3", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40983" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.16.3", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-59901", "package": "io.netty:netty-codec", "installed_version": "4.1.135.Final", "fixed_version": "4.1.136.Final", "title": "io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55851", "package": "io.netty:netty-codec-haproxy", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55851" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55831", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55831" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55833", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55833" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56745", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56819", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56819" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-91403", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91403" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-91415", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance font rendering (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91415" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-13506", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.84", "fixed_version": "1.85", "title": "bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-13506", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.84", "fixed_version": "1.85", "title": "bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54291", "package": "org.postgresql:postgresql", "installed_version": "42.7.11", "fixed_version": "42.7.12", "title": "org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54291" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-103111", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-103111" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-86145", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86145" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-89161", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89161" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-103111", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-103111" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-86145", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86145" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-89161", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89161" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11822", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": "3.34.1-11.el9_8", "title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11822" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11824", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": "3.34.1-11.el9_8", "title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11824" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-119373", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": null, "title": "sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119373" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-119586", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": null, "title": "sqlite: sqlite: Arbitrary command execution via .recover command", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119586" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54516", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Security bypass due to improper handling of renamed properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54516" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54516", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Security bypass due to improper handling of renamed properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54516" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54517", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information disclosure via improper JsonView filter application", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54517" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54517", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information disclosure via improper JsonView filter application", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54517" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54518", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4", "title": "jackson-databind: jackson-databind: Information disclosure and data manipulation via view-based access control bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54518" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54518", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4", "title": "jackson-databind: jackson-databind: Information disclosure and data manipulation via view-based access control bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54518" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59888", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59888", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "GHSA-mhm7-754m-9p8w", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.9, 2.21.5", "title": "jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`", "primary_url": "https://github.com/advisories/GHSA-mhm7-754m-9p8w" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "GHSA-mhm7-754m-9p8w", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.9, 2.21.5", "title": "jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`", "primary_url": "https://github.com/advisories/GHSA-mhm7-754m-9p8w" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56391", "package": "coreutils-single", "installed_version": "8.32-41.el9_8", "fixed_version": null, "title": "coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56391" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56392", "package": "coreutils-single", "installed_version": "8.32-41.el9_8", "fixed_version": "8.32-41.el9_8.1", "title": "coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56392" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84243", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Arbitrary code execution via directory traversal in LANGUAGE environment variable", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84243" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8674", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86805", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95818", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84243", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Arbitrary code execution via directory traversal in LANGUAGE environment variable", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84243" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8674", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86805", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95818", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84243", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Arbitrary code execution via directory traversal in LANGUAGE environment variable", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84243" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8674", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86805", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95818", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-73508", "package": "io.netty:netty-codec-dns", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-73508" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59919", "package": "io.netty:netty-codec-haproxy", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-haproxy: Netty: Improper CR/LF neutralization in netty-codec-haproxy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59919" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56746", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56746" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59898", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59898" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59899", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59899" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59903", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59903" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59921", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59921" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59900", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59900" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75596", "package": "io.netty:netty-handler", "installed_version": "4.1.135.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "Netty is an asynchronous, event-driven network application framework. ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75596" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-118259", "package": "io.opentelemetry:opentelemetry-api", "installed_version": "1.57.0", "fixed_version": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-118259" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-45292", "package": "io.opentelemetry:opentelemetry-api", "installed_version": "1.57.0", "fixed_version": "1.62.0", "title": "opentelemetry-java: opentelemetry-api: opentelemetry-extension-trace-propagators: OpenTelemetry Java: Denial of Service due to unbounded memory allocation when parsing oversized baggage", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45292" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-28164", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "libpng: libpng: Denial of Service via buffer overflow in png_create_read_struct() function", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-28164" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-64505", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "libpng: LIBPNG heap buffer overflow via malformed palette index", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-64505" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-64506", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "libpng: LIBPNG heap buffer over-read", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-64506" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-101516", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-101516" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22693", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "harfbuzz: Null Pointer Dereference in harfbuzz", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22693" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-34757", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "libpng: libpng: Information disclosure and data corruption via use-after-free vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34757" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-40930", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "libpng: libpng: Data integrity and availability impact due to improper APNG chunk handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40930" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-46675", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "libpng: libpng: Use-after-free in sequential reader when png_read_end called without reading image rows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-46675" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49919", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "freetype: Integer overflow in FreeType tt_face_colr_blend_layer() leads to heap buffer overflow during COLR font rendering", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49919" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-60589", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.12.1.1-1.2.el9", "title": "OpenJDK: Improve Resource Resolving (2026-08 Security Update)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-60589" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-61308", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.12.1.1-1.2.el9", "title": "OpenJDK: Enhance HTTP Connections (2026-08 Security Update)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-61308" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-70907", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.12.1.1-1.2.el9", "title": "OpenJDK: Enhance TLS server (2026-08 Security Update)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-70907" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83374", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance PKCS5 padding (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83378", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Improve C2 loop transformations (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83378" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83380", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance LDAP logins (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83380" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83381", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance SASL Authentication (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83381" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83387", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance WebRowSets (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83387" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83395", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP Client Response Handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83395" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83400", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance XML Processing (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83400" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-87290", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance XPath Expressions (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87290" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-87291", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP Server (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87291" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-87294", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Certificate Name Checks (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87294" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91332", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP Client (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91332" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91373", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance TLS handshakes (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91373" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91374", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance jstatd (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91375", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance jmod handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91375" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91379", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance JShell (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91379" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91380", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Preferences (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91380" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91382", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "openjdk: Enhance Image Processing (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91382" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91394", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP client caching (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91394" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91398", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance SOCKS5 support (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91398" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91410", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance zipfs (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91410" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91418", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance GIF loading (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91418" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91451", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91451" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91452", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP server (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91452" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91453", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Improve HTTP headers (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91453" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91462", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance krb5 tokens (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91462" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91463", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance krb5 client (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91463" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91464", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Kerberos validation (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91464" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91487", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance C2 comparisons (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91487" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95512", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "freetype: FreeType: Denial of Service via repeated subroutine allocations in CID font loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95512" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54371", "package": "libattr", "installed_version": "2.5.1-3.el9", "fixed_version": "2.6.0-1.el9_8", "title": "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54371" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-102010", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102010" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-114690", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: Confirmed out-of-bounds read/write in libstdc++ parallel `std", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-114690" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-114691", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: Integer wrap in `std", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-114691" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95619", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: libstdc++ integer overflow in `new` operator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95619" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119210", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119210" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119276", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119276" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119279", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "3.3.7, 3.4.5, 3.5.10", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119279" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119281", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119281" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-55856", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "2.7.14, 3.3.5, 3.4.3, 3.5.9", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Cleartext password disclosure via man-in-the-middle during initial handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55856" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-55857", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "2.7.14, 3.3.5, 3.4.3, 3.5.9", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Information Disclosure via Insecure PAM Dialog Authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55857" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-55858", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "2.7.14, 3.3.5, 3.4.3, 3.5.9", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Silent data corruption due to character set mismatch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55858" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-13757", "package": "p11-kit-trust", "installed_version": "0.26.2-1.el9", "fixed_version": "0.26.4-1.el9_8", "title": "p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13757" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89157", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89157" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89158", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89158" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89157", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89157" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89158", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89158" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5958", "package": "sed", "installed_version": "4.8-10.el9", "fixed_version": null, "title": "sed: GNU sed TOCTOU race condition", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5958" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119378", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": null, "title": "sqlite: sqlite: Denial of Service via use-after-free in R-Tree extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119378" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119591", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": null, "title": "sqlite: sqlite: Denial of Service via stack exhaustion in countOfViewOptimization()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119591" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50812", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": null, "title": "sqlite: SQLite: Denial of Service via malformed changeset in Session Extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50812" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-97399", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-97399", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-97399", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-27171", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27171" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-83376", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance TLS certificate handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83376" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-87292", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Network Clients (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87292" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-87367", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Template Handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87367" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91333", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Improve ciphertext handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91333" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91334", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance JPEG loading (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91334" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91335", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Image Handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91335" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91397", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance diagnostic sessions (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91397" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91400", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91400" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91409", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "openjdk: Enhance QUIC connections (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91409" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91461", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance TLS Extensions (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91461" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2021-46195", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: uncontrolled recursion in libiberty/rust-demangle.c", "primary_url": "https://avd.aquasec.com/nvd/cve-2021-46195" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2022-27943", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-27943" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-115456", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: Out-of-bounds read in std::from_chars", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-115456" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-50495", "package": "ncurses-base", "installed_version": "6.2-12.20210508.el9", "fixed_version": null, "title": "ncurses: segmentation fault via _nc_wrap_entry()", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-50495" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-50495", "package": "ncurses-libs", "installed_version": "6.2-12.20210508.el9", "fixed_version": null, "title": "ncurses: segmentation fault via _nc_wrap_entry()", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-50495" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nspr", "installed_version": "4.36.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nspr", "installed_version": "4.36.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-softokn", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-softokn", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-softokn-freebl", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-softokn-freebl", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-sysinit", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-sysinit", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-util", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-util", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-119280", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119280" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-61700", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "2.7.14, 3.3.5, 3.4.3, 3.5.9", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Information disclosure via server-initiated LOCAL INFILE requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-61700" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2022-41409", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": null, "title": "pcre2: negative repeat value in a pcre2test subject line leads to inifinite loop", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-41409" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89156", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89156" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89160", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89160" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2022-41409", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": null, "title": "pcre2: negative repeat value in a pcre2test subject line leads to inifinite loop", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-41409" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89156", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89156" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89160", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89160" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-0232", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": null, "title": "sqlite: use-after-free bug in jsonParseAddNodeArray", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-0232" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-70873", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": null, "title": "sqlite: SQLite: Information Disclosure via Crafted ZIP File", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-70873" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0-1 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-27171", "package": "zlib", "installed_version": "1.2.11-40.el9", "fixed_version": null, "title": "zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27171" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0", "vulnerability_count": 219, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-114406", "package": "ca-certificates", "installed_version": "2025.2.80_v9.0.305-91.el9", "fixed_version": "2026.2.92_v9.0.319-90.3.el9_8", "title": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-114406" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed_version": "4.1.135.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-8763", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.84", "fixed_version": "1.85", "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8763" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-8763", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.84", "fixed_version": "1.85", "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8763" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-84939", "package": "org.freemarker:freemarker", "installed_version": "2.3.32", "fixed_version": "2.3.35", "title": "org.apache.freemarker/freemarker: Apache FreeMarker: Path traversal via malformed locale identifier", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84939" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-18963", "package": "org.keycloak:keycloak-services", "installed_version": "26.7.0", "fixed_version": "26.4.15, 26.6.6, 26.7.2", "title": "keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18963" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "33.5.0-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-59250", "package": "com.microsoft.sqlserver:mssql-jdbc", "installed_version": "13.2.1", "fixed_version": "10.2.4.jre11, 11.2.4.jre11, 12.2.1.jre11, 12.6.5.jre11, 12.8.2.jre11, 12.10.2.jre11, 13.2.1.jre11", "title": "JDBC Driver for SQL Server has improper input validation issue", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-59250" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40983", "package": "io.micrometer:micrometer-core", "installed_version": "1.16.3", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40983" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.16.3", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-59901", "package": "io.netty:netty-codec", "installed_version": "4.1.135.Final", "fixed_version": "4.1.136.Final", "title": "io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55851", "package": "io.netty:netty-codec-haproxy", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55851" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55831", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55831" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55833", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55833" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56745", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56819", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56819" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-91403", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91403" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-91415", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance font rendering (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91415" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-13506", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.84", "fixed_version": "1.85", "title": "bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-13506", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.84", "fixed_version": "1.85", "title": "bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54291", "package": "org.postgresql:postgresql", "installed_version": "42.7.11", "fixed_version": "42.7.12", "title": "org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54291" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-103111", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-103111" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-86145", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86145" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-89161", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89161" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-103111", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-103111" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-86145", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86145" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-89161", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89161" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11822", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": "3.34.1-11.el9_8", "title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11822" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11824", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": "3.34.1-11.el9_8", "title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11824" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-119373", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": null, "title": "sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119373" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-119586", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": null, "title": "sqlite: sqlite: Arbitrary command execution via .recover command", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119586" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54516", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Security bypass due to improper handling of renamed properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54516" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54516", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Security bypass due to improper handling of renamed properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54516" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54517", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information disclosure via improper JsonView filter application", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54517" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54517", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information disclosure via improper JsonView filter application", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54517" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54518", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4", "title": "jackson-databind: jackson-databind: Information disclosure and data manipulation via view-based access control bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54518" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54518", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4", "title": "jackson-databind: jackson-databind: Information disclosure and data manipulation via view-based access control bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54518" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59888", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59888", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "GHSA-mhm7-754m-9p8w", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.9, 2.21.5", "title": "jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`", "primary_url": "https://github.com/advisories/GHSA-mhm7-754m-9p8w" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "GHSA-mhm7-754m-9p8w", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.9, 2.21.5", "title": "jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`", "primary_url": "https://github.com/advisories/GHSA-mhm7-754m-9p8w" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56391", "package": "coreutils-single", "installed_version": "8.32-41.el9_8", "fixed_version": null, "title": "coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56391" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56392", "package": "coreutils-single", "installed_version": "8.32-41.el9_8", "fixed_version": "8.32-41.el9_8.1", "title": "coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56392" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84243", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Arbitrary code execution via directory traversal in LANGUAGE environment variable", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84243" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8674", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86805", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95818", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84243", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Arbitrary code execution via directory traversal in LANGUAGE environment variable", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84243" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8674", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86805", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95818", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84243", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Arbitrary code execution via directory traversal in LANGUAGE environment variable", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84243" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8674", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86805", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95818", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-73508", "package": "io.netty:netty-codec-dns", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-73508" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59919", "package": "io.netty:netty-codec-haproxy", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-haproxy: Netty: Improper CR/LF neutralization in netty-codec-haproxy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59919" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56746", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56746" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59898", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59898" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59899", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59899" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59903", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59903" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59921", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59921" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59900", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59900" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75596", "package": "io.netty:netty-handler", "installed_version": "4.1.135.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "Netty is an asynchronous, event-driven network application framework. ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75596" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-118259", "package": "io.opentelemetry:opentelemetry-api", "installed_version": "1.57.0", "fixed_version": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-118259" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-45292", "package": "io.opentelemetry:opentelemetry-api", "installed_version": "1.57.0", "fixed_version": "1.62.0", "title": "opentelemetry-java: opentelemetry-api: opentelemetry-extension-trace-propagators: OpenTelemetry Java: Denial of Service due to unbounded memory allocation when parsing oversized baggage", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45292" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-28164", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "libpng: libpng: Denial of Service via buffer overflow in png_create_read_struct() function", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-28164" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-64505", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "libpng: LIBPNG heap buffer overflow via malformed palette index", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-64505" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-64506", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "libpng: LIBPNG heap buffer over-read", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-64506" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-101516", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-101516" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22693", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "harfbuzz: Null Pointer Dereference in harfbuzz", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22693" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-34757", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "libpng: libpng: Information disclosure and data corruption via use-after-free vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34757" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-40930", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "libpng: libpng: Data integrity and availability impact due to improper APNG chunk handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40930" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-46675", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "libpng: libpng: Use-after-free in sequential reader when png_read_end called without reading image rows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-46675" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49919", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "freetype: Integer overflow in FreeType tt_face_colr_blend_layer() leads to heap buffer overflow during COLR font rendering", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49919" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-60589", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.12.1.1-1.2.el9", "title": "OpenJDK: Improve Resource Resolving (2026-08 Security Update)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-60589" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-61308", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.12.1.1-1.2.el9", "title": "OpenJDK: Enhance HTTP Connections (2026-08 Security Update)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-61308" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-70907", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.12.1.1-1.2.el9", "title": "OpenJDK: Enhance TLS server (2026-08 Security Update)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-70907" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83374", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance PKCS5 padding (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83378", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Improve C2 loop transformations (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83378" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83380", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance LDAP logins (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83380" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83381", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance SASL Authentication (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83381" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83387", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance WebRowSets (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83387" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83395", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP Client Response Handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83395" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83400", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance XML Processing (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83400" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-87290", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance XPath Expressions (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87290" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-87291", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP Server (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87291" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-87294", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Certificate Name Checks (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87294" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91332", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP Client (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91332" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91373", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance TLS handshakes (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91373" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91374", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance jstatd (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91375", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance jmod handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91375" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91379", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance JShell (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91379" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91380", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Preferences (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91380" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91382", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "openjdk: Enhance Image Processing (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91382" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91394", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP client caching (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91394" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91398", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance SOCKS5 support (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91398" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91410", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance zipfs (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91410" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91418", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance GIF loading (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91418" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91451", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91451" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91452", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP server (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91452" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91453", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Improve HTTP headers (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91453" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91462", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance krb5 tokens (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91462" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91463", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance krb5 client (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91463" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91464", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Kerberos validation (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91464" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91487", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance C2 comparisons (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91487" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95512", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "freetype: FreeType: Denial of Service via repeated subroutine allocations in CID font loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95512" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54371", "package": "libattr", "installed_version": "2.5.1-3.el9", "fixed_version": "2.6.0-1.el9_8", "title": "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54371" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-102010", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102010" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-114690", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: Confirmed out-of-bounds read/write in libstdc++ parallel `std", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-114690" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-114691", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: Integer wrap in `std", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-114691" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95619", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: libstdc++ integer overflow in `new` operator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95619" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119210", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119210" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119276", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119276" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119279", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "3.3.7, 3.4.5, 3.5.10", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119279" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119281", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119281" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-55856", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "2.7.14, 3.3.5, 3.4.3, 3.5.9", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Cleartext password disclosure via man-in-the-middle during initial handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55856" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-55857", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "2.7.14, 3.3.5, 3.4.3, 3.5.9", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Information Disclosure via Insecure PAM Dialog Authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55857" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-55858", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "2.7.14, 3.3.5, 3.4.3, 3.5.9", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Silent data corruption due to character set mismatch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55858" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-13757", "package": "p11-kit-trust", "installed_version": "0.26.2-1.el9", "fixed_version": "0.26.4-1.el9_8", "title": "p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13757" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89157", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89157" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89158", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89158" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89157", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89157" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89158", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89158" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5958", "package": "sed", "installed_version": "4.8-10.el9", "fixed_version": null, "title": "sed: GNU sed TOCTOU race condition", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5958" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119378", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": null, "title": "sqlite: sqlite: Denial of Service via use-after-free in R-Tree extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119378" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119591", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": null, "title": "sqlite: sqlite: Denial of Service via stack exhaustion in countOfViewOptimization()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119591" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50812", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": null, "title": "sqlite: SQLite: Denial of Service via malformed changeset in Session Extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50812" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-97399", "package": "glibc", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-97399", "package": "glibc-common", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-97399", "package": "glibc-langpack-en", "installed_version": "2.34-274.el9_8", "fixed_version": null, "title": "glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-27171", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27171" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-83376", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance TLS certificate handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83376" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-87292", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Network Clients (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87292" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-87367", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Template Handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87367" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91333", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Improve ciphertext handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91333" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91334", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance JPEG loading (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91334" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91335", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Image Handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91335" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91397", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance diagnostic sessions (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91397" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91400", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91400" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91409", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": null, "title": "openjdk: Enhance QUIC connections (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91409" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91461", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.12.0.8-1.2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance TLS Extensions (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91461" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2021-46195", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: uncontrolled recursion in libiberty/rust-demangle.c", "primary_url": "https://avd.aquasec.com/nvd/cve-2021-46195" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2022-27943", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-27943" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-115456", "package": "libgcc", "installed_version": "11.5.0-14.el9", "fixed_version": null, "title": "gcc: Out-of-bounds read in std::from_chars", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-115456" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-50495", "package": "ncurses-base", "installed_version": "6.2-12.20210508.el9", "fixed_version": null, "title": "ncurses: segmentation fault via _nc_wrap_entry()", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-50495" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-50495", "package": "ncurses-libs", "installed_version": "6.2-12.20210508.el9", "fixed_version": null, "title": "ncurses: segmentation fault via _nc_wrap_entry()", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-50495" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nspr", "installed_version": "4.36.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nspr", "installed_version": "4.36.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-softokn", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-softokn", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-softokn-freebl", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-softokn-freebl", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-sysinit", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-sysinit", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-util", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-util", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-119280", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119280" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-61700", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "2.7.14, 3.3.5, 3.4.3, 3.5.9", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Information disclosure via server-initiated LOCAL INFILE requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-61700" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2022-41409", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": null, "title": "pcre2: negative repeat value in a pcre2test subject line leads to inifinite loop", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-41409" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89156", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89156" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89160", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89160" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2022-41409", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": null, "title": "pcre2: negative repeat value in a pcre2test subject line leads to inifinite loop", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-41409" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89156", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89156" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89160", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89160" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-0232", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": null, "title": "sqlite: use-after-free bug in jsonParseAddNodeArray", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-0232" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-70873", "package": "sqlite-libs", "installed_version": "3.34.1-10.el9_8", "fixed_version": null, "title": "sqlite: SQLite: Information Disclosure via Crafted ZIP File", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-70873" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.7.0 (redhat 9.8)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-27171", "package": "zlib", "installed_version": "1.2.11-40.el9", "fixed_version": null, "title": "zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27171" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1", "vulnerability_count": 327, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-114406", "package": "ca-certificates", "installed_version": "2025.2.80_v9.0.305-91.el9", "fixed_version": "2026.2.92_v9.0.319-90.3.el9_8", "title": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-114406" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2025-14813", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.83", "fixed_version": "1.80.2, 1.81.1, 1.84", "title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-14813" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2025-14813", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.83", "fixed_version": "1.80.2, 1.81.1, 1.84", "title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-14813" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-8763", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.83", "fixed_version": "1.85", "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8763" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-8763", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.83", "fixed_version": "1.85", "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8763" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-84939", "package": "org.freemarker:freemarker", "installed_version": "2.3.32", "fixed_version": "2.3.35", "title": "org.apache.freemarker/freemarker: Apache FreeMarker: Path traversal via malformed locale identifier", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84939" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-18963", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.4.15, 26.6.6, 26.7.2", "title": "keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18963" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "33.5.0-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-59250", "package": "com.microsoft.sqlserver:mssql-jdbc", "installed_version": "13.2.1", "fixed_version": "10.2.4.jre11, 11.2.4.jre11, 12.2.1.jre11, 12.6.5.jre11, 12.8.2.jre11, 12.10.2.jre11, 13.2.1.jre11", "title": "JDBC Driver for SQL Server has improper input validation issue", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-59250" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40983", "package": "io.micrometer:micrometer-core", "installed_version": "1.16.3", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40983" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.16.3", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42583", "package": "io.netty:netty-codec", "installed_version": "4.1.130.Final", "fixed_version": "4.1.133.Final", "title": "netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42583" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-59901", "package": "io.netty:netty-codec", "installed_version": "4.1.130.Final", "fixed_version": "4.1.136.Final", "title": "io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42579", "package": "io.netty:netty-codec-dns", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42579" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-44893", "package": "io.netty:netty-codec-haproxy", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-44893" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-48059", "package": "io.netty:netty-codec-haproxy", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-48059" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55851", "package": "io.netty:netty-codec-haproxy", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55851" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-33870", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.1.132.Final, 4.2.10.Final", "title": "io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33870" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42584", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42584" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42587", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42587" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55831", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55831" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55833", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55833" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56745", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-33871", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.1.132.Final, 4.2.11.Final", "title": "netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33871" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42587", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42587" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56819", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56819" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-44249", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-44249" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-45416", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45416" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-50010", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50010" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-45674", "package": "io.netty:netty-resolver-dns", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45674" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-47691", "package": "io.netty:netty-resolver-dns", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47691" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-39852", "package": "io.quarkus:quarkus-vertx-http", "installed_version": "3.33.1", "fixed_version": "3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1", "title": "io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-39852" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-50559", "package": "io.quarkus:quarkus-vertx-http", "installed_version": "3.33.1", "fixed_version": "3.20.6.2, 3.27.4.1, 3.33.2.1, 3.36.3, 3.37.0", "title": "io.quarkus/quarkus-vertx-http: Quarkus: Authorization bypass in HTTP path-based policies via encoded characters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50559" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-47063", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.12.0.8-1.2.el9", "title": "openjdk: Enhance Jar handling (Oracle CPU 2026-07)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47063" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-91403", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": null, "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91403" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-91415", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance font rendering (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91415" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-54369", "package": "libacl", "installed_version": "2.3.1-4.el9", "fixed_version": "2.4.0-1.el9_8", "title": "acl: Symlink traversal privilege escalation via libacl functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54369" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-4878", "package": "libcap", "installed_version": "2.48-10.el9_7.1", "fixed_version": "2.48-10.el9_8.1", "title": "libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4878" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-13506", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.83", "fixed_version": "1.85", "title": "bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-13506", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.83", "fixed_version": "1.85", "title": "bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-5598", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.83", "fixed_version": "1.84", "title": "bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5598" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-5598", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.83", "fixed_version": "1.84", "title": "bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5598" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-7307", "package": "org.keycloak:keycloak-saml-core", "installed_version": "26.6.1", "fixed_version": "26.6.2", "title": "keycloak: Keycloak: Denial of Service via specially crafted SAML input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-7307" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-7504", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.6.2", "title": "org.keycloak/keycloak-services: Open redirect when using wildcard valid redirect URIs in Keycloak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-7504" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-7507", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.6.2", "title": "org.keycloak/keycloak-services: Session fixation in OIDC login flow that can lead to account takeover", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-7507" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-7571", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.6.2", "title": "keycloak: Keycloak: Access token disclosure and implicit flow bypass via forged client data", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-7571" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-9086", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.6.4", "title": "keycloak: Keycloak: Cross-site scripting (XSS) via case-insensitive URI validation bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9086" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-9795", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.6.4", "title": "keycloak: Keycloak: Privilege escalation via improper scope mapping enforcement", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9795" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-9800", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.6.4", "title": "keycloak-policy-enforcer: Keycloak Policy Enforcer: Authorization bypass via incorrect URI comparison", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9800" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42198", "package": "org.postgresql:postgresql", "installed_version": "42.7.10", "fixed_version": "42.7.11", "title": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42198" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54291", "package": "org.postgresql:postgresql", "installed_version": "42.7.10", "fixed_version": "42.7.12", "title": "org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54291" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-103111", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-103111" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-86145", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86145" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-89161", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89161" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-103111", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-103111" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-86145", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86145" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-89161", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89161" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11822", "package": "sqlite-libs", "installed_version": "3.34.1-9.el9_7", "fixed_version": "3.34.1-11.el9_8", "title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11822" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11824", "package": "sqlite-libs", "installed_version": "3.34.1-9.el9_7", "fixed_version": "3.34.1-11.el9_8", "title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11824" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-119373", "package": "sqlite-libs", "installed_version": "3.34.1-9.el9_7", "fixed_version": null, "title": "sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119373" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-119586", "package": "sqlite-libs", "installed_version": "3.34.1-9.el9_7", "fixed_version": null, "title": "sqlite: sqlite: Arbitrary command execution via .recover command", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119586" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54516", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Security bypass due to improper handling of renamed properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54516" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54516", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Security bypass due to improper handling of renamed properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54516" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54517", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information disclosure via improper JsonView filter application", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54517" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54517", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information disclosure via improper JsonView filter application", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54517" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54518", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4", "title": "jackson-databind: jackson-databind: Information disclosure and data manipulation via view-based access control bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54518" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54518", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4", "title": "jackson-databind: jackson-databind: Information disclosure and data manipulation via view-based access control bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54518" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59888", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59888", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "GHSA-mhm7-754m-9p8w", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.9, 2.21.5", "title": "jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`", "primary_url": "https://github.com/advisories/GHSA-mhm7-754m-9p8w" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "GHSA-mhm7-754m-9p8w", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.9, 2.21.5", "title": "jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`", "primary_url": "https://github.com/advisories/GHSA-mhm7-754m-9p8w" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-5278", "package": "coreutils-single", "installed_version": "8.32-39.el9", "fixed_version": "8.32-41.el9_8", "title": "coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-5278" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56391", "package": "coreutils-single", "installed_version": "8.32-39.el9", "fixed_version": null, "title": "coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56391" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56392", "package": "coreutils-single", "installed_version": "8.32-39.el9", "fixed_version": "8.32-41.el9_8.1", "title": "coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56392" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-4046", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-270.el9_8", "title": "glibc: glibc: Denial of Service via iconv() function with specific character sets", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4046" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-4437", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-270.el9_8", "title": "glibc: glibc: Incorrect DNS response parsing via crafted DNS server response", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4437" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5435", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-274.el9_8", "title": "glibc: glibc: Out-of-bounds write via TSIG record processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5435" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5450", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-272.el9_8", "title": "glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5450" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5928", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-274.el9_8", "title": "glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5928" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6238", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-274.el9_8", "title": "glibc: glibc: Application crash or uninitialized memory read via crafted DNS response", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6238" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84243", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Arbitrary code execution via directory traversal in LANGUAGE environment variable", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84243" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8674", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86805", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95818", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-4046", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-270.el9_8", "title": "glibc: glibc: Denial of Service via iconv() function with specific character sets", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4046" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-4437", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-270.el9_8", "title": "glibc: glibc: Incorrect DNS response parsing via crafted DNS server response", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4437" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5435", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-274.el9_8", "title": "glibc: glibc: Out-of-bounds write via TSIG record processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5435" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5450", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-272.el9_8", "title": "glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5450" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5928", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-274.el9_8", "title": "glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5928" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6238", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-274.el9_8", "title": "glibc: glibc: Application crash or uninitialized memory read via crafted DNS response", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6238" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84243", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Arbitrary code execution via directory traversal in LANGUAGE environment variable", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84243" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8674", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86805", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95818", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-4046", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-270.el9_8", "title": "glibc: glibc: Denial of Service via iconv() function with specific character sets", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4046" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-4437", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-270.el9_8", "title": "glibc: glibc: Incorrect DNS response parsing via crafted DNS server response", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4437" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5435", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-274.el9_8", "title": "glibc: glibc: Out-of-bounds write via TSIG record processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5435" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5450", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-272.el9_8", "title": "glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5450" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5928", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-274.el9_8", "title": "glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5928" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6238", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-274.el9_8", "title": "glibc: glibc: Application crash or uninitialized memory read via crafted DNS response", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6238" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84243", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Arbitrary code execution via directory traversal in LANGUAGE environment variable", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84243" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8674", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86805", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95818", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-73508", "package": "io.netty:netty-codec-dns", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-73508" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59919", "package": "io.netty:netty-codec-haproxy", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-haproxy: Netty: Improper CR/LF neutralization in netty-codec-haproxy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59919" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41417", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.1.133.Final, 4.2.13.Final", "title": "netty: Netty: HTTP request smuggling via URI manipulation and CRLF injection", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41417" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42580", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: Netty: Request smuggling via chunk size parser integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42580" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42581", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42581" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42585", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42585" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50020", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http: Netty: Data manipulation via request-boundary confusion in HttpObjectDecoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50020" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56746", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56746" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59898", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59898" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59899", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59899" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59903", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59903" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59921", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59921" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47244", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47244" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-48043", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.1.135.Final, 4.2.15.Final", "title": "netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-48043" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50560", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http2: Netty: Denial of Service due to HTTP/2 max header size handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50560" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59900", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59900" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75596", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "Netty is an asynchronous, event-driven network application framework. ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75596" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-45673", "package": "io.netty:netty-resolver-dns", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-resolver-dns: Netty DNS resolver: DNS Cache Poisoning via predictable transaction IDs", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45673" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-45536", "package": "io.netty:netty-transport-native-epoll", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-transport-native-epoll: netty-transport-native-kqueue: Netty: Denial of Service due to file descriptor leak in SCM_RIGHTS message handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45536" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-45536", "package": "io.netty:netty-transport-native-epoll", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-transport-native-epoll: netty-transport-native-kqueue: Netty: Denial of Service due to file descriptor leak in SCM_RIGHTS message handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45536" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-118259", "package": "io.opentelemetry:opentelemetry-api", "installed_version": "1.57.0", "fixed_version": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-118259" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-45292", "package": "io.opentelemetry:opentelemetry-api", "installed_version": "1.57.0", "fixed_version": "1.62.0", "title": "opentelemetry-java: opentelemetry-api: opentelemetry-extension-trace-propagators: OpenTelemetry Java: Denial of Service due to unbounded memory allocation when parsing oversized baggage", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45292" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6860", "package": "io.vertx:vertx-core", "installed_version": "4.5.25", "fixed_version": "4.5.27, 5.0.12", "title": "eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6860" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-28164", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": null, "title": "libpng: libpng: Denial of Service via buffer overflow in png_create_read_struct() function", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-28164" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-64505", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": null, "title": "libpng: LIBPNG heap buffer overflow via malformed palette index", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-64505" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-64506", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": null, "title": "libpng: LIBPNG heap buffer over-read", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-64506" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-101516", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-101516" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22693", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": null, "title": "harfbuzz: Null Pointer Dereference in harfbuzz", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22693" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-34757", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": null, "title": "libpng: libpng: Information disclosure and data corruption via use-after-free vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34757" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-40930", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": null, "title": "libpng: libpng: Data integrity and availability impact due to improper APNG chunk handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40930" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41254", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.12.0.8-1.2.el9", "title": "Little CMS: lcms2: mm2/Little-CMS: Little CMS: Information disclosure or denial of service via integer overflow in CubeSize", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41254" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-46675", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": null, "title": "libpng: libpng: Use-after-free in sequential reader when png_read_end called without reading image rows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-46675" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-46917", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.12.0.8-1.2.el9", "title": "openjdk: Improve DTLS handshaking (Oracle CPU 2026-07)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-46917" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-46968", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.12.0.8-1.2.el9", "title": "openjdk: Enhance TLS certificate handling (Oracle CPU 2026-07)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-46968" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47021", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.12.0.8-1.2.el9", "title": "openjdk: Enhance XBM image support (Oracle CPU 2026-07)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47021" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47027", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.12.0.8-1.2.el9", "title": "openjdk: Enhance Jar file processing (Oracle CPU 2026-07)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47027" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49919", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": null, "title": "freetype: Integer overflow in FreeType tt_face_colr_blend_layer() leads to heap buffer overflow during COLR font rendering", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49919" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-60147", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.12.0.8-1.2.el9", "title": "openjdk: Improve certification checking (Oracle CPU 2026-07)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-60147" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-60589", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.12.1.1-1.2.el9", "title": "OpenJDK: Improve Resource Resolving (2026-08 Security Update)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-60589" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-61308", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.12.1.1-1.2.el9", "title": "OpenJDK: Enhance HTTP Connections (2026-08 Security Update)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-61308" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-70907", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.12.1.1-1.2.el9", "title": "OpenJDK: Enhance TLS server (2026-08 Security Update)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-70907" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83374", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance PKCS5 padding (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83378", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Improve C2 loop transformations (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83378" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83380", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance LDAP logins (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83380" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83381", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance SASL Authentication (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83381" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83387", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance WebRowSets (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83387" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83395", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP Client Response Handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83395" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83400", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance XML Processing (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83400" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-87290", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance XPath Expressions (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87290" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-87291", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP Server (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87291" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-87294", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Certificate Name Checks (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87294" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91332", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP Client (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91332" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91373", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance TLS handshakes (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91373" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91374", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance jstatd (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91375", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance jmod handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91375" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91379", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance JShell (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91379" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91380", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Preferences (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91380" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91382", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": null, "title": "openjdk: Enhance Image Processing (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91382" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91394", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP client caching (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91394" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91398", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance SOCKS5 support (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91398" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91410", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance zipfs (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91410" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91418", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance GIF loading (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91418" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91451", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91451" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91452", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP server (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91452" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91453", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Improve HTTP headers (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91453" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91462", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance krb5 tokens (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91462" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91463", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance krb5 client (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91463" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91464", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Kerberos validation (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91464" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91487", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance C2 comparisons (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91487" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95512", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": null, "title": "freetype: FreeType: Denial of Service via repeated subroutine allocations in CID font loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95512" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54370", "package": "libacl", "installed_version": "2.3.1-4.el9", "fixed_version": "2.4.0-1.el9_8", "title": "acl: TOCTOU Symlink Traversal via getfacl/setfacl", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54370" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54371", "package": "libattr", "installed_version": "2.5.1-3.el9", "fixed_version": "2.6.0-1.el9_8", "title": "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54371" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-102010", "package": "libgcc", "installed_version": "11.5.0-11.el9", "fixed_version": null, "title": "gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102010" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-114690", "package": "libgcc", "installed_version": "11.5.0-11.el9", "fixed_version": null, "title": "gcc: Confirmed out-of-bounds read/write in libstdc++ parallel `std", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-114690" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-114691", "package": "libgcc", "installed_version": "11.5.0-11.el9", "fixed_version": null, "title": "gcc: Integer wrap in `std", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-114691" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95619", "package": "libgcc", "installed_version": "11.5.0-11.el9", "fixed_version": null, "title": "gcc: libstdc++ integer overflow in `new` operator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95619" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5588", "package": "org.bouncycastle:bcpkix-jdk18on", "installed_version": "1.83", "fixed_version": "1.84", "title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5588" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-0636", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.83", "fixed_version": "1.84", "title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-0636" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-0636", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.83", "fixed_version": "1.84", "title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-0636" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9801", "package": "org.keycloak:keycloak-ldap-federation", "installed_version": "26.6.1", "fixed_version": "26.6.3", "title": "keycloak: Keycloak: Denial of Service via malformed LDAP password policy response", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9801" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-11986", "package": "org.keycloak:keycloak-rest-admin-ui-ext", "installed_version": "26.6.1", "fixed_version": "26.7.0", "title": "keycloak-rest-admin-ui-ext: Authorization Bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of Keycloak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11986" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9704", "package": "org.keycloak:keycloak-server-spi-private", "installed_version": "26.6.1", "fixed_version": "26.6.3", "title": "keycloak: Keycloak: Privilege escalation due to oversized subject_token JWT", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9704" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9791", "package": "org.keycloak:keycloak-server-spi-private", "installed_version": "26.6.1", "fixed_version": "26.6.3", "title": "keycloak-rhel9: Organization Data Leak After Feature Disabled in Keycloak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9791" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-37978", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.6.2", "title": "keycloak: org.keycloak.services: Keycloak: Information Disclosure via evaluate-scopes Admin API", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-37978" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-37979", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.6.2", "title": "keycloak: Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-37979" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-37981", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.4.12, 26.6.2", "title": "keycloak: org.keycloak.authorization: Keycloak: Information disclosure via broken access control in user lookup endpoint", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-37981" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-37982", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.6.2", "title": "keycloak: org.keycloak.authentication: Keycloak: Unauthorized account takeover via WebAuthn token replay", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-37982" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-4630", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.6.2", "title": "keycloak: Keycloak: Unauthorized resource access and data modification via Insecure Direct Object Reference", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4630" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-7500", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": null, "title": "org.keycloak.keycloak-services: Improper Access Control on Keycloak Server when the account Account API feature is disabled", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-7500" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8830", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.6.3", "title": "keycloak: org.keycloak/keycloak-services: Keycloak: Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8830" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8922", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": null, "title": "org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: Security flaw in org.keycloak/keycloak-services", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8922" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9083", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.6.4", "title": "keycloak: Keycloak: Information disclosure through arbitrary filesystem path probing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9083" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9087", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.6.3", "title": "keycloak: Cross-Session Email Verification Proof Not Bound to Upstream Identity in First-Broker-Login", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9087" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9689", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": null, "title": "keycloak: org.keycloak.protocol.oidc: HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication - #GHI-604", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9689" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9704", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.6.3", "title": "keycloak: Keycloak: Privilege escalation due to oversized subject_token JWT", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9704" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9705", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.6.4", "title": "keycloak: Keycloak: Attacker can re-enable and take over disabled clients via Registration Access Token", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9705" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9791", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.6.3", "title": "keycloak-rhel9: Organization Data Leak After Feature Disabled in Keycloak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9791" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9792", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.6.3", "title": "keycloak: Keycloak: Security restriction bypass allows unauthorized ROPC token acquisition", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9792" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9793", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": null, "title": "keycloak: Keycloak: Security policy bypass in JWE-encrypted request object processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9793" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9794", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.6.3", "title": "keycloak: Keycloak: Information disclosure via SAML ECP endpoint", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9794" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9798", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": null, "title": "keycloak: Keycloak: Brute-force protection bypass in CIBA flow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9798" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9799", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.6.4", "title": "keycloak: Keycloak: Unauthorized access to resources via UMA permission ticket bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9799" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9802", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.6.3", "title": "keycloak: Keycloak: Unauthorized account access via replayed refresh tokens after cluster restart", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9802" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9803", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.6.3", "title": "keycloak: Keycloak: Denial of Service via malformed Authorization header", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9803" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119210", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119210" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119276", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119276" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119279", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "3.3.7, 3.4.5, 3.5.10", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119279" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119281", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119281" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-55856", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "2.7.14, 3.3.5, 3.4.3, 3.5.9", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Cleartext password disclosure via man-in-the-middle during initial handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55856" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-55857", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "2.7.14, 3.3.5, 3.4.3, 3.5.9", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Information Disclosure via Insecure PAM Dialog Authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55857" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-55858", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "2.7.14, 3.3.5, 3.4.3, 3.5.9", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Silent data corruption due to character set mismatch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55858" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-13757", "package": "p11-kit-trust", "installed_version": "0.25.3-3.el9_5", "fixed_version": "0.26.4-1.el9_8", "title": "p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13757" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-2100", "package": "p11-kit-trust", "installed_version": "0.25.3-3.el9_5", "fixed_version": "0.26.2-1.el9", "title": "p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2100" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89157", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89157" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89158", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89158" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89157", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89157" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89158", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89158" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5958", "package": "sed", "installed_version": "4.8-9.el9", "fixed_version": null, "title": "sed: GNU sed TOCTOU race condition", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5958" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119378", "package": "sqlite-libs", "installed_version": "3.34.1-9.el9_7", "fixed_version": null, "title": "sqlite: sqlite: Denial of Service via use-after-free in R-Tree extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119378" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119591", "package": "sqlite-libs", "installed_version": "3.34.1-9.el9_7", "fixed_version": null, "title": "sqlite: sqlite: Denial of Service via stack exhaustion in countOfViewOptimization()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119591" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50812", "package": "sqlite-libs", "installed_version": "3.34.1-9.el9_7", "fixed_version": null, "title": "sqlite: SQLite: Denial of Service via malformed changeset in Session Extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50812" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-4438", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-270.el9_8", "title": "glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4438" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-97399", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-4438", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-270.el9_8", "title": "glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4438" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-97399", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-4438", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-270.el9_8", "title": "glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4438" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-97399", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-42578", "package": "io.netty:netty-handler-proxy", "installed_version": "4.1.130.Final", "fixed_version": "4.1.133.Final, 4.2.13.Final", "title": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42578" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-27171", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": null, "title": "zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27171" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-47010", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.12.0.8-1.2.el9", "title": "openjdk: Enhance JPEG handling (Oracle CPU 2026-07)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47010" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-47059", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.12.0.8-1.2.el9", "title": "openjdk: Enhance AWT ImagingLib (Oracle CPU 2026-07)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47059" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-83376", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance TLS certificate handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83376" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-87292", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Network Clients (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87292" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-87367", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Template Handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87367" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91333", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Improve ciphertext handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91333" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91334", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance JPEG loading (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91334" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91335", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Image Handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91335" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91397", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance diagnostic sessions (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91397" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91400", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91400" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91409", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": null, "title": "openjdk: Enhance QUIC connections (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91409" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91461", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.11.0.10-2.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance TLS Extensions (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91461" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2021-46195", "package": "libgcc", "installed_version": "11.5.0-11.el9", "fixed_version": null, "title": "gcc: uncontrolled recursion in libiberty/rust-demangle.c", "primary_url": "https://avd.aquasec.com/nvd/cve-2021-46195" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2022-27943", "package": "libgcc", "installed_version": "11.5.0-11.el9", "fixed_version": null, "title": "binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-27943" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-115456", "package": "libgcc", "installed_version": "11.5.0-11.el9", "fixed_version": null, "title": "gcc: Out-of-bounds read in std::from_chars", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-115456" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-13151", "package": "libtasn1", "installed_version": "4.16.0-9.el9", "fixed_version": "4.16.0-10.el9_8", "title": "libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-13151" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-50495", "package": "ncurses-base", "installed_version": "6.2-12.20210508.el9", "fixed_version": null, "title": "ncurses: segmentation fault via _nc_wrap_entry()", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-50495" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-50495", "package": "ncurses-libs", "installed_version": "6.2-12.20210508.el9", "fixed_version": null, "title": "ncurses: segmentation fault via _nc_wrap_entry()", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-50495" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nspr", "installed_version": "4.36.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nspr", "installed_version": "4.36.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-softokn", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-softokn", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-softokn-freebl", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-softokn-freebl", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-sysinit", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-sysinit", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-util", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-util", "installed_version": "3.112.0-8.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-37977", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.4.13, 26.6.3", "title": "keycloak: org.keycloak.protocol.oidc.grants.ciba: Keycloak: Information disclosure via CORS header injection due to unvalidated JWT azp claim", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-37977" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-4874", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.6.3, 26.4.13", "title": "org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: Keycloak: Server-Side Request Forgery via OIDC token endpoint manipulation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4874" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-9088", "package": "org.keycloak:keycloak-services", "installed_version": "26.6.1", "fixed_version": "26.7.0", "title": "keycloak: Keycloak: Information disclosure due to user profile permission bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9088" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-119280", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119280" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-61700", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.7", "fixed_version": "2.7.14, 3.3.5, 3.4.3, 3.5.9", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Information disclosure via server-initiated LOCAL INFILE requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-61700" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2022-41409", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": null, "title": "pcre2: negative repeat value in a pcre2test subject line leads to inifinite loop", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-41409" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89156", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89156" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89160", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89160" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2022-41409", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": null, "title": "pcre2: negative repeat value in a pcre2test subject line leads to inifinite loop", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-41409" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89156", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89156" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89160", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89160" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-0232", "package": "sqlite-libs", "installed_version": "3.34.1-9.el9_7", "fixed_version": null, "title": "sqlite: use-after-free bug in jsonParseAddNodeArray", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-0232" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-70873", "package": "sqlite-libs", "installed_version": "3.34.1-9.el9_7", "fixed_version": null, "title": "sqlite: SQLite: Information Disclosure via Crafted ZIP File", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-70873" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.6.1 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-27171", "package": "zlib", "installed_version": "1.2.11-40.el9", "fixed_version": null, "title": "zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27171" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4", "vulnerability_count": 353, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-114406", "package": "ca-certificates", "installed_version": "2025.2.80_v9.0.305-91.el9", "fixed_version": "2026.2.92_v9.0.319-90.3.el9_8", "title": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-114406" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2025-14813", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.82", "fixed_version": "1.80.2, 1.81.1, 1.84", "title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-14813" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2025-14813", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.82", "fixed_version": "1.80.2, 1.81.1, 1.84", "title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-14813" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-8763", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.82", "fixed_version": "1.85", "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8763" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-8763", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.82", "fixed_version": "1.85", "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8763" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-84939", "package": "org.freemarker:freemarker", "installed_version": "2.3.32", "fixed_version": "2.3.35", "title": "org.apache.freemarker/freemarker: Apache FreeMarker: Path traversal via malformed locale identifier", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84939" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-18963", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.4.15, 26.6.6, 26.7.2", "title": "keycloak-services: keycloak-services: Unauthenticated account takeover via reset-credentials flow bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18963" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.2", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.2", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "33.4.8-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-59250", "package": "com.microsoft.sqlserver:mssql-jdbc", "installed_version": "13.2.1", "fixed_version": "10.2.4.jre11, 11.2.4.jre11, 12.2.1.jre11, 12.6.5.jre11, 12.8.2.jre11, 12.10.2.jre11, 13.2.1.jre11", "title": "JDBC Driver for SQL Server has improper input validation issue", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-59250" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.14.7", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42583", "package": "io.netty:netty-codec", "installed_version": "4.1.130.Final", "fixed_version": "4.1.133.Final", "title": "netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42583" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-59901", "package": "io.netty:netty-codec", "installed_version": "4.1.130.Final", "fixed_version": "4.1.136.Final", "title": "io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42579", "package": "io.netty:netty-codec-dns", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: Netty: High integrity impact due to improper DNS domain name constraint enforcement", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42579" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-44893", "package": "io.netty:netty-codec-haproxy", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-haproxy: Netty-codec-haproxy: Denial of Service via malformed HAProxy message", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-44893" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-48059", "package": "io.netty:netty-codec-haproxy", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-haproxy: Netty HAProxy PROXY protocol v2 codec: Denial of Service via memory leak from crafted PROXY protocol headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-48059" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55851", "package": "io.netty:netty-codec-haproxy", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-haproxy: Netty codec-haproxy: Denial of Service via crafted PROXY protocol v2 message", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55851" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-33870", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.1.132.Final, 4.2.10.Final", "title": "io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33870" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42584", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42584" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42587", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42587" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55831", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55831" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55833", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55833" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56745", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-33871", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.1.132.Final, 4.2.11.Final", "title": "netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33871" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42587", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42587" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56819", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56819" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-44249", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-44249" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-45416", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45416" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-50010", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50010" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-45674", "package": "io.netty:netty-resolver-dns", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-resolver-dns: Netty: Information disclosure and data manipulation due to improper CNAME record validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45674" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-47691", "package": "io.netty:netty-resolver-dns", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "io.netty/netty-resolver-dns: Netty has Insufficient Bailiwick Validation for NS Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47691" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-39852", "package": "io.quarkus:quarkus-vertx-http", "installed_version": "3.27.2", "fixed_version": "3.20.6.1, 3.27.3.1, 3.33.1.1, 3.35.1.1", "title": "io.quarkus:quarkus-vertx-http: io.quarkus:quarkus-vertx-http: Authorization bypass via semicolons in HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-39852" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-50559", "package": "io.quarkus:quarkus-vertx-http", "installed_version": "3.27.2", "fixed_version": "3.20.6.2, 3.27.4.1, 3.33.2.1, 3.36.3, 3.37.0", "title": "io.quarkus/quarkus-vertx-http: Quarkus: Authorization bypass in HTTP path-based policies via encoded characters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50559" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-22016", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.11.0.10-2.el9", "title": "openjdk: Enhance Path Factories Redux (Oracle CPU 2026-04)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22016" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-26740", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.11.0.10-2.el9", "title": "giflib: giflib: Denial of Service via buffer overflow in EGifGCBToExtension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-26740" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-34282", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.11.0.10-2.el9", "title": "openjdk: Enhance TLS connection handling (Oracle CPU 2026-04)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34282" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-47063", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.12.0.8-1.2.el9", "title": "openjdk: Enhance Jar handling (Oracle CPU 2026-07)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47063" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-91403", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": null, "title": "OpenJDK: Distrust eMudhra intermediate CA certificates due to security concerns", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91403" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-91415", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance font rendering (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91415" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-54369", "package": "libacl", "installed_version": "2.3.1-4.el9", "fixed_version": "2.4.0-1.el9_8", "title": "acl: Symlink traversal privilege escalation via libacl functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54369" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-4878", "package": "libcap", "installed_version": "2.48-10.el9", "fixed_version": "2.48-10.el9_8.1", "title": "libcap: libcap: Privilege escalation via TOCTOU race condition in cap_set_file()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4878" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-13506", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.82", "fixed_version": "1.85", "title": "bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-13506", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.82", "fixed_version": "1.85", "title": "bouncycastle: Bouncy Castle for Java: Denial of Service via lazy ASN.1 sequence processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-5598", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.82", "fixed_version": "1.84", "title": "bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5598" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-5598", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.82", "fixed_version": "1.84", "title": "bouncycastle: BC-JAVA: private key leakage via non-constant time comparisons", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5598" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-7307", "package": "org.keycloak:keycloak-saml-core", "installed_version": "26.5.4", "fixed_version": "26.6.2", "title": "keycloak: Keycloak: Denial of Service via specially crafted SAML input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-7307" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-2603", "package": "org.keycloak:keycloak-server-spi-private", "installed_version": "26.5.4", "fixed_version": "26.5.5", "title": "keycloak: Keycloak: Unauthorized authentication via disabled SAML Identity Provider", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2603" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-2092", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.5.5", "title": "keycloak-services: Keycloak: Unauthorized access via improper validation of encrypted SAML assertions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2092" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-2603", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.5.5", "title": "keycloak: Keycloak: Unauthorized authentication via disabled SAML Identity Provider", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2603" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-3009", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.5.5", "title": "org.keycloak/keycloak-services: Improper Enforcement of Disabled Identity Provider in IdentityBrokerService (Authentication Bypass)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-3009" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-3872", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.5.7", "title": "keycloak: Keycloak: Information disclosure due to redirect_uri validation bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-3872" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-4282", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.5.7", "title": "keycloak: Keycloak: Privilege escalation via forged authorization codes due to SingleUseObjectProvider isolation flaw", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4282" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-4634", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.5.7", "title": "keycloak: Keycloak: Denial of Service via excessive processing of OpenID Connect scope parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4634" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-4636", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.5.7", "title": "keycloak: Keycloak: UMA policy bypass allows authenticated users to gain unauthorized access to victim-owned resources.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4636" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-7504", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.2", "title": "org.keycloak/keycloak-services: Open redirect when using wildcard valid redirect URIs in Keycloak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-7504" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-7507", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.2", "title": "org.keycloak/keycloak-services: Session fixation in OIDC login flow that can lead to account takeover", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-7507" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-7571", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.2", "title": "keycloak: Keycloak: Access token disclosure and implicit flow bypass via forged client data", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-7571" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-9086", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.4", "title": "keycloak: Keycloak: Cross-site scripting (XSS) via case-insensitive URI validation bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9086" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-9795", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.4", "title": "keycloak: Keycloak: Privilege escalation via improper scope mapping enforcement", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9795" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-9800", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.4", "title": "keycloak-policy-enforcer: Keycloak Policy Enforcer: Authorization bypass via incorrect URI comparison", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9800" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42198", "package": "org.postgresql:postgresql", "installed_version": "42.7.7", "fixed_version": "42.7.11", "title": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42198" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54291", "package": "org.postgresql:postgresql", "installed_version": "42.7.7", "fixed_version": "42.7.12", "title": "org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54291" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-103111", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-103111" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-86145", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86145" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-89161", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89161" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-103111", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: pcre2: Out-of-bounds write via crafted regular expression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-103111" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-86145", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write allows arbitrary code execution via crafted regular expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86145" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-89161", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Memory corruption vulnerability in pcre2_jit_match", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89161" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11822", "package": "sqlite-libs", "installed_version": "3.34.1-9.el9_7", "fixed_version": "3.34.1-11.el9_8", "title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11822" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11824", "package": "sqlite-libs", "installed_version": "3.34.1-9.el9_7", "fixed_version": "3.34.1-11.el9_8", "title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11824" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-119373", "package": "sqlite-libs", "installed_version": "3.34.1-9.el9_7", "fixed_version": null, "title": "sqlite: sqlite: Denial of service via heap-based buffer overflow in FTS5", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119373" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-119586", "package": "sqlite-libs", "installed_version": "3.34.1-9.el9_7", "fixed_version": null, "title": "sqlite: sqlite: Arbitrary command execution via .recover command", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119586" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18401", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.2", "fixed_version": "2.21.1, 2.18.6", "title": "tools.jackson.core/jackson-core: com.fasterxml.jackson.core/jackson-core: jackson-core: Denial of Service due to number length bypass in asynchronous JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18401" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18401", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.2", "fixed_version": "2.21.1, 2.18.6", "title": "tools.jackson.core/jackson-core: com.fasterxml.jackson.core/jackson-core: jackson-core: Denial of Service due to number length bypass in asynchronous JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18401" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59888", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59888", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-5278", "package": "coreutils-single", "installed_version": "8.32-39.el9", "fixed_version": "8.32-41.el9_8", "title": "coreutils: Heap Buffer Under-Read in GNU Coreutils sort via Key Specification", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-5278" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56391", "package": "coreutils-single", "installed_version": "8.32-39.el9", "fixed_version": null, "title": "coreutils: GNU coreutils uniq: Denial of Service and information disclosure via out-of-bounds read with multibyte input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56391" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56392", "package": "coreutils-single", "installed_version": "8.32-39.el9", "fixed_version": "8.32-41.el9_8.1", "title": "coreutils: GNU coreutils unexpand: Denial of Service via crafted tab stop values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56392" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-4046", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-270.el9_8", "title": "glibc: glibc: Denial of Service via iconv() function with specific character sets", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4046" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-4437", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-270.el9_8", "title": "glibc: glibc: Incorrect DNS response parsing via crafted DNS server response", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4437" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5435", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-274.el9_8", "title": "glibc: glibc: Out-of-bounds write via TSIG record processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5435" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5450", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-272.el9_8", "title": "glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5450" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5928", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-274.el9_8", "title": "glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5928" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6238", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-274.el9_8", "title": "glibc: glibc: Application crash or uninitialized memory read via crafted DNS response", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6238" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84243", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Arbitrary code execution via directory traversal in LANGUAGE environment variable", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84243" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8674", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86805", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95818", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-4046", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-270.el9_8", "title": "glibc: glibc: Denial of Service via iconv() function with specific character sets", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4046" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-4437", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-270.el9_8", "title": "glibc: glibc: Incorrect DNS response parsing via crafted DNS server response", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4437" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5435", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-274.el9_8", "title": "glibc: glibc: Out-of-bounds write via TSIG record processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5435" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5450", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-272.el9_8", "title": "glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5450" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5928", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-274.el9_8", "title": "glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5928" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6238", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-274.el9_8", "title": "glibc: glibc: Application crash or uninitialized memory read via crafted DNS response", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6238" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84243", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Arbitrary code execution via directory traversal in LANGUAGE environment variable", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84243" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8674", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86805", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95818", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18374", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Heap buffer overflow via attacker-controlled fopen mode string", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19542", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Fix out-of-bounds array write in tdelete", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19542" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-4046", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-270.el9_8", "title": "glibc: glibc: Denial of Service via iconv() function with specific character sets", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4046" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-4437", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-270.el9_8", "title": "glibc: glibc: Incorrect DNS response parsing via crafted DNS server response", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4437" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5435", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-274.el9_8", "title": "glibc: glibc: Out-of-bounds write via TSIG record processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5435" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5450", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-272.el9_8", "title": "glibc: glibc: Heap Buffer Overflow in `scanf` with `%mc` format specifier and large width", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5450" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5928", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-274.el9_8", "title": "glibc: glibc: Information disclosure or denial of service via ungetwc function with specific wide character encodings", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5928" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6238", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-274.el9_8", "title": "glibc: glibc: Application crash or uninitialized memory read via crafted DNS response", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6238" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6368", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: glibc: Process abort due to invalid memory in wordexp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6368" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6791", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Glibc: Denial of Service via stack exhaustion during tilde expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6791" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77117", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in SHIFT_JISX0213 ->", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77117" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-80489", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-283.el9_8", "title": "glibc: Non-progress DoS in EUC_JISX0213 -> UCS-4 conversion state", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-80489" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84243", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Arbitrary code execution via directory traversal in LANGUAGE environment variable", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84243" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8674", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc DNS stub resolver: Denial of Service via long search domain in configuration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8674" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-86805", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Privilege escalation and arbitrary code execution via TOCTOU race condition in dynamic loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-86805" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89092", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: nscd stack overflow leads to degraded DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89092" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95818", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Local attacker can cause denial of service and information disclosure via stack-based buffer overflow.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95818" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-73508", "package": "io.netty:netty-codec-dns", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-dns: Netty: Denial of Service via Memory Leak in DNS Record Decoder with Malformed Domain Names", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-73508" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59919", "package": "io.netty:netty-codec-haproxy", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-haproxy: Netty: Improper CR/LF neutralization in netty-codec-haproxy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59919" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41417", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.1.133.Final, 4.2.13.Final", "title": "netty: Netty: HTTP request smuggling via URI manipulation and CRLF injection", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41417" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42580", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: Netty: Request smuggling via chunk size parser integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42580" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42581", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42581" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42585", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42585" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50020", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http: Netty: Data manipulation via request-boundary confusion in HttpObjectDecoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50020" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56746", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56746" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59898", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59898" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59899", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59899" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59903", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59903" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59921", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59921" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47244", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47244" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-48043", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.1.135.Final, 4.2.15.Final", "title": "netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-48043" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50560", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http2: Netty: Denial of Service due to HTTP/2 max header size handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50560" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59900", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59900" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75596", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "Netty is an asynchronous, event-driven network application framework. ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75596" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-45673", "package": "io.netty:netty-resolver-dns", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-resolver-dns: Netty DNS resolver: DNS Cache Poisoning via predictable transaction IDs", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45673" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-45536", "package": "io.netty:netty-transport-native-epoll", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-transport-native-epoll: netty-transport-native-kqueue: Netty: Denial of Service due to file descriptor leak in SCM_RIGHTS message handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45536" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-45536", "package": "io.netty:netty-transport-native-epoll", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-transport-native-epoll: netty-transport-native-kqueue: Netty: Denial of Service due to file descriptor leak in SCM_RIGHTS message handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45536" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-118259", "package": "io.opentelemetry:opentelemetry-api", "installed_version": "1.44.1", "fixed_version": "1.67.0", "title": "opentelemetry-java: Quadratic CPU consumption in W3C tracestate parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-118259" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-45292", "package": "io.opentelemetry:opentelemetry-api", "installed_version": "1.44.1", "fixed_version": "1.62.0", "title": "opentelemetry-java: opentelemetry-api: opentelemetry-extension-trace-propagators: OpenTelemetry Java: Denial of Service due to unbounded memory allocation when parsing oversized baggage", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45292" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-1002", "package": "io.vertx:vertx-core", "installed_version": "4.5.23", "fixed_version": "4.5.24, 5.0.7", "title": "io.vertx/vertx-core: static handler component cache can be manipulated to deny the access to static files", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-1002" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6860", "package": "io.vertx:vertx-core", "installed_version": "4.5.23", "fixed_version": "4.5.27, 5.0.12", "title": "eclipse-vertx/vert.x: eclipse-vertx/vert.x: Denial of Service via TLS handshake with wildcard server name", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6860" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-28164", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": null, "title": "libpng: libpng: Denial of Service via buffer overflow in png_create_read_struct() function", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-28164" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-64505", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": null, "title": "libpng: LIBPNG heap buffer overflow via malformed palette index", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-64505" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-64506", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": null, "title": "libpng: LIBPNG heap buffer over-read", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-64506" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-101516", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Certificate Constraint Checking (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-101516" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22013", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.11.0.10-2.el9", "title": "openjdk: Improve Kerberos credentialing (Oracle CPU 2026-04)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22013" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22021", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.11.0.10-2.el9", "title": "openjdk: Enhance certificate chain validation (Oracle CPU 2026-04)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22021" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22693", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": null, "title": "harfbuzz: Null Pointer Dereference in harfbuzz", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22693" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22695", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.11.0.10-2.el9", "title": "libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22695" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22801", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.11.0.10-2.el9", "title": "libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22801" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-23865", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.11.0.10-2.el9", "title": "freetype: Information disclosure or denial of service via specially crafted font files", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-23865" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-33416", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.11.0.10-2.el9", "title": "libpng: libpng: Arbitrary code execution due to use-after-free vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33416" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-33636", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.11.0.10-2.el9", "title": "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33636" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-34757", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": null, "title": "libpng: libpng: Information disclosure and data corruption via use-after-free vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34757" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-40930", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": null, "title": "libpng: libpng: Data integrity and availability impact due to improper APNG chunk handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40930" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41254", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.12.0.8-1.2.el9", "title": "Little CMS: lcms2: mm2/Little-CMS: Little CMS: Information disclosure or denial of service via integer overflow in CubeSize", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41254" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-46675", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": null, "title": "libpng: libpng: Use-after-free in sequential reader when png_read_end called without reading image rows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-46675" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-46917", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.12.0.8-1.2.el9", "title": "openjdk: Improve DTLS handshaking (Oracle CPU 2026-07)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-46917" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-46968", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.12.0.8-1.2.el9", "title": "openjdk: Enhance TLS certificate handling (Oracle CPU 2026-07)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-46968" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47021", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.12.0.8-1.2.el9", "title": "openjdk: Enhance XBM image support (Oracle CPU 2026-07)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47021" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47027", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.12.0.8-1.2.el9", "title": "openjdk: Enhance Jar file processing (Oracle CPU 2026-07)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47027" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49919", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": null, "title": "freetype: Integer overflow in FreeType tt_face_colr_blend_layer() leads to heap buffer overflow during COLR font rendering", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49919" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-60147", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.12.0.8-1.2.el9", "title": "openjdk: Improve certification checking (Oracle CPU 2026-07)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-60147" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-60589", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.12.1.1-1.2.el9", "title": "OpenJDK: Improve Resource Resolving (2026-08 Security Update)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-60589" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-61308", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.12.1.1-1.2.el9", "title": "OpenJDK: Enhance HTTP Connections (2026-08 Security Update)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-61308" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-70907", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.12.1.1-1.2.el9", "title": "OpenJDK: Enhance TLS server (2026-08 Security Update)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-70907" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83374", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance PKCS5 padding (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83378", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Improve C2 loop transformations (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83378" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83380", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance LDAP logins (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83380" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83381", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance SASL Authentication (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83381" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83387", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance WebRowSets (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83387" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83395", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP Client Response Handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83395" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83400", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance XML Processing (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83400" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-87290", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance XPath Expressions (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87290" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-87291", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP Server (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87291" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-87294", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Certificate Name Checks (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87294" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91332", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP Client (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91332" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91373", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance TLS handshakes (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91373" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91374", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance jstatd (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91374" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91375", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance jmod handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91375" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91379", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance JShell (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91379" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91380", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Preferences (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91380" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91382", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": null, "title": "openjdk: Enhance Image Processing (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91382" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91394", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP client caching (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91394" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91398", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance SOCKS5 support (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91398" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91410", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance zipfs (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91410" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91418", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance GIF loading (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91418" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91451", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP server parsing (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91451" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91452", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance HTTP server (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91452" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91453", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Improve HTTP headers (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91453" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91462", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance krb5 tokens (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91462" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91463", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance krb5 client (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91463" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91464", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Kerberos validation (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91464" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-91487", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance C2 comparisons (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91487" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95512", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": null, "title": "freetype: FreeType: Denial of Service via repeated subroutine allocations in CID font loader", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95512" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54370", "package": "libacl", "installed_version": "2.3.1-4.el9", "fixed_version": "2.4.0-1.el9_8", "title": "acl: TOCTOU Symlink Traversal via getfacl/setfacl", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54370" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54371", "package": "libattr", "installed_version": "2.5.1-3.el9", "fixed_version": "2.6.0-1.el9_8", "title": "attr: attr: Symlink Traversal Privilege Escalation via getfattr and setfattr", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54371" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-102010", "package": "libgcc", "installed_version": "11.5.0-11.el9", "fixed_version": null, "title": "gcc-toolset-15-gcc: gcc: gcc-toolset-16: gcc: Denial of Service via use-after-free in binary heap erase_if", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102010" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-114690", "package": "libgcc", "installed_version": "11.5.0-11.el9", "fixed_version": null, "title": "gcc: Confirmed out-of-bounds read/write in libstdc++ parallel `std", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-114690" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-114691", "package": "libgcc", "installed_version": "11.5.0-11.el9", "fixed_version": null, "title": "gcc: Integer wrap in `std", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-114691" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95619", "package": "libgcc", "installed_version": "11.5.0-11.el9", "fixed_version": null, "title": "gcc: libstdc++ integer overflow in `new` operator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95619" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5588", "package": "org.bouncycastle:bcpkix-jdk18on", "installed_version": "1.82", "fixed_version": "1.84", "title": "bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5588" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-0636", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.82", "fixed_version": "1.84", "title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-0636" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-0636", "package": "org.bouncycastle:bcprov-jdk18on", "installed_version": "1.82", "fixed_version": "1.84", "title": "bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-0636" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9801", "package": "org.keycloak:keycloak-ldap-federation", "installed_version": "26.5.4", "fixed_version": "26.6.3", "title": "keycloak: Keycloak: Denial of Service via malformed LDAP password policy response", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9801" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-3190", "package": "org.keycloak:keycloak-model-jpa", "installed_version": "26.5.4", "fixed_version": "26.5.6", "title": "keycloak: Keycloak: Information Disclosure via improper role enforcement in UMA 2.0 Protection API", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-3190" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-11537", "package": "org.keycloak:keycloak-quarkus-server", "installed_version": "26.5.4", "fixed_version": "26.5.6", "title": "keycloak-services: Sensitive headers shown in the HTTP access logs", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-11537" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-11986", "package": "org.keycloak:keycloak-rest-admin-ui-ext", "installed_version": "26.5.4", "fixed_version": "26.7.0", "title": "keycloak-rest-admin-ui-ext: Authorization Bypass vulnerability in the admin-ui-ext bulk role-mapping-delete endpoints of Keycloak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11986" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-3190", "package": "org.keycloak:keycloak-server-spi-private", "installed_version": "26.5.4", "fixed_version": "26.5.6", "title": "keycloak: Keycloak: Information Disclosure via improper role enforcement in UMA 2.0 Protection API", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-3190" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9704", "package": "org.keycloak:keycloak-server-spi-private", "installed_version": "26.5.4", "fixed_version": "26.6.3", "title": "keycloak: Keycloak: Privilege escalation due to oversized subject_token JWT", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9704" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9791", "package": "org.keycloak:keycloak-server-spi-private", "installed_version": "26.5.4", "fixed_version": "26.6.3", "title": "keycloak-rhel9: Organization Data Leak After Feature Disabled in Keycloak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9791" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-3121", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.5.6", "title": "keycloak: org.keycloak/keycloak-services: Keycloak: Privilege escalation via manage-clients permission", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-3121" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-3190", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.5.6", "title": "keycloak: Keycloak: Information Disclosure via improper role enforcement in UMA 2.0 Protection API", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-3190" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-3429", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": null, "title": "org.keycloak.services.resources.account: Improper Access Control Leading to MFA Deletion and Account Takeover in Keycloak Account REST API", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-3429" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-37978", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.2", "title": "keycloak: org.keycloak.services: Keycloak: Information Disclosure via evaluate-scopes Admin API", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-37978" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-37979", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.2", "title": "keycloak: Keycloak: Information disclosure via OIDC token introspection endpoint audience bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-37979" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-37980", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": null, "title": "org.keycloak.forms.login: keycloak: Keycloak: Arbitrary code execution via Stored Cross-Site Scripting (XSS) in organization selection login page", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-37980" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-37981", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.4.12, 26.6.2", "title": "keycloak: org.keycloak.authorization: Keycloak: Information disclosure via broken access control in user lookup endpoint", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-37981" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-37982", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.2", "title": "keycloak: org.keycloak.authentication: Keycloak: Unauthorized account takeover via WebAuthn token replay", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-37982" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-4325", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.5.7", "title": "keycloak: Keycloak: Replay of action tokens via improper handling of single-use entries", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4325" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-4628", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": null, "title": "keycloak: org.keycloak.authorization: Keycloak: Unauthorized resource modification due to improper access control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4628" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-4630", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.2", "title": "keycloak: Keycloak: Unauthorized resource access and data modification via Insecure Direct Object Reference", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4630" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-7500", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": null, "title": "org.keycloak.keycloak-services: Improper Access Control on Keycloak Server when the account Account API feature is disabled", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-7500" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8830", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.3", "title": "keycloak: org.keycloak/keycloak-services: Keycloak: Policy bypass during WebAuthn credential registration via client-side JavaScript manipulation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8830" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-8922", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": null, "title": "org.keycloak/keycloak-services: keycloak: org.keycloak.protocol.oidc: Security flaw in org.keycloak/keycloak-services", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-8922" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9083", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.4", "title": "keycloak: Keycloak: Information disclosure through arbitrary filesystem path probing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9083" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9087", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.3", "title": "keycloak: Cross-Session Email Verification Proof Not Bound to Upstream Identity in First-Broker-Login", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9087" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9689", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": null, "title": "keycloak: org.keycloak.protocol.oidc: HTTP Parameter Pollution in OIDC redirect URI allows response parameter duplication - #GHI-604", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9689" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9704", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.3", "title": "keycloak: Keycloak: Privilege escalation due to oversized subject_token JWT", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9704" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9705", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.4", "title": "keycloak: Keycloak: Attacker can re-enable and take over disabled clients via Registration Access Token", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9705" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9791", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.3", "title": "keycloak-rhel9: Organization Data Leak After Feature Disabled in Keycloak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9791" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9792", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.3", "title": "keycloak: Keycloak: Security restriction bypass allows unauthorized ROPC token acquisition", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9792" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9793", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": null, "title": "keycloak: Keycloak: Security policy bypass in JWE-encrypted request object processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9793" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9794", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.3", "title": "keycloak: Keycloak: Information disclosure via SAML ECP endpoint", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9794" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9798", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": null, "title": "keycloak: Keycloak: Brute-force protection bypass in CIBA flow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9798" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9799", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.4", "title": "keycloak: Keycloak: Unauthorized access to resources via UMA permission ticket bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9799" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9802", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.3", "title": "keycloak: Keycloak: Unauthorized account access via replayed refresh tokens after cluster restart", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9802" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-9803", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.3", "title": "keycloak: Keycloak: Denial of Service via malformed Authorization header", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9803" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119210", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.6", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119210" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119276", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.6", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119276" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119279", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.6", "fixed_version": "3.3.7, 3.4.5, 3.5.10", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119279" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119281", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.6", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "MariaDB Connector/J is used to connect applications developed in Java ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119281" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-55856", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.6", "fixed_version": "2.7.14, 3.3.5, 3.4.3, 3.5.9", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Cleartext password disclosure via man-in-the-middle during initial handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55856" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-55857", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.6", "fixed_version": "2.7.14, 3.3.5, 3.4.3, 3.5.9", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Information Disclosure via Insecure PAM Dialog Authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55857" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-55858", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.6", "fixed_version": "2.7.14, 3.3.5, 3.4.3, 3.5.9", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Silent data corruption due to character set mismatch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55858" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-13757", "package": "p11-kit-trust", "installed_version": "0.25.3-3.el9_5", "fixed_version": "0.26.4-1.el9_8", "title": "p11-kit: Stack exhaustion via unbounded recursion in RPC attribute parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-13757" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-2100", "package": "p11-kit-trust", "installed_version": "0.25.3-3.el9_5", "fixed_version": "0.26.2-1.el9", "title": "p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2100" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89157", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89157" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89158", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89158" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89157", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Out-of-bounds write via large pattern input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89157" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-89158", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds write via integer overflow on 32-bit platforms", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89158" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5958", "package": "sed", "installed_version": "4.8-9.el9", "fixed_version": null, "title": "sed: GNU sed TOCTOU race condition", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5958" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119378", "package": "sqlite-libs", "installed_version": "3.34.1-9.el9_7", "fixed_version": null, "title": "sqlite: sqlite: Denial of Service via use-after-free in R-Tree extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119378" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-119591", "package": "sqlite-libs", "installed_version": "3.34.1-9.el9_7", "fixed_version": null, "title": "sqlite: sqlite: Denial of Service via stack exhaustion in countOfViewOptimization()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119591" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50812", "package": "sqlite-libs", "installed_version": "3.34.1-9.el9_7", "fixed_version": null, "title": "sqlite: SQLite: Denial of Service via malformed changeset in Session Extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50812" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-4438", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-270.el9_8", "title": "glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4438" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-97399", "package": "glibc", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-4438", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-270.el9_8", "title": "glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4438" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-97399", "package": "glibc-common", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-4438", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": "2.34-270.el9_8", "title": "glibc: glibc: Invalid DNS hostname returned via gethostbyaddr functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4438" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-97399", "package": "glibc-langpack-en", "installed_version": "2.34-231.el9_7.10", "fixed_version": null, "title": "glibc: glibc: Denial of Service via out-of-bounds read in strncasecmp", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97399" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-42578", "package": "io.netty:netty-handler-proxy", "installed_version": "4.1.130.Final", "fixed_version": "4.1.133.Final, 4.2.13.Final", "title": "netty: io.netty/netty-handler-proxy: Netty: HTTP Header Injection via HttpProxyHandler Disabled Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42578" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-22007", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.11.0.10-2.el9", "title": "openjdk: Enhance crypto algorithm support (Oracle CPU 2026-04)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22007" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-22018", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.11.0.10-2.el9", "title": "openjdk: Enhance Zip file reading (Oracle CPU 2026-04)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22018" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-27171", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": null, "title": "zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27171" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-34268", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.11.0.10-2.el9", "title": "openjdk: Enhance key generation (Oracle CPU 2026-04)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34268" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-47010", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.12.0.8-1.2.el9", "title": "openjdk: Enhance JPEG handling (Oracle CPU 2026-07)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47010" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-47059", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.12.0.8-1.2.el9", "title": "openjdk: Enhance AWT ImagingLib (Oracle CPU 2026-07)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47059" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-83376", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance TLS certificate handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83376" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-87292", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Network Clients (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87292" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-87367", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Template Handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-87367" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91333", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Improve ciphertext handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91333" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91334", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance JPEG loading (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91334" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91335", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance Image Handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91335" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91397", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance diagnostic sessions (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91397" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91400", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance MIDI file handling (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91400" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91409", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": null, "title": "openjdk: Enhance QUIC connections (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91409" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-91461", "package": "java-21-openjdk-headless", "installed_version": "1:21.0.10.0.7-1.el9", "fixed_version": "1:21.0.13.0.9-1.2.el9", "title": "openjdk: Enhance TLS Extensions (Oracle CPU 2026-10)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91461" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2021-46195", "package": "libgcc", "installed_version": "11.5.0-11.el9", "fixed_version": null, "title": "gcc: uncontrolled recursion in libiberty/rust-demangle.c", "primary_url": "https://avd.aquasec.com/nvd/cve-2021-46195" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2022-27943", "package": "libgcc", "installed_version": "11.5.0-11.el9", "fixed_version": null, "title": "binutils: libiberty/rust-demangle.c in GNU GCC 11.2 allows stack exhaustion in demangle_const", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-27943" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-115456", "package": "libgcc", "installed_version": "11.5.0-11.el9", "fixed_version": null, "title": "gcc: Out-of-bounds read in std::from_chars", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-115456" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-13151", "package": "libtasn1", "installed_version": "4.16.0-9.el9", "fixed_version": "4.16.0-10.el9_8", "title": "libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-13151" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-50495", "package": "ncurses-base", "installed_version": "6.2-12.20210508.el9", "fixed_version": null, "title": "ncurses: segmentation fault via _nc_wrap_entry()", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-50495" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-50495", "package": "ncurses-libs", "installed_version": "6.2-12.20210508.el9", "fixed_version": null, "title": "ncurses: segmentation fault via _nc_wrap_entry()", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-50495" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nspr", "installed_version": "4.36.0-4.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nspr", "installed_version": "4.36.0-4.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss", "installed_version": "3.112.0-4.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss", "installed_version": "3.112.0-4.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-softokn", "installed_version": "3.112.0-4.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-softokn", "installed_version": "3.112.0-4.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-softokn-freebl", "installed_version": "3.112.0-4.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-softokn-freebl", "installed_version": "3.112.0-4.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-sysinit", "installed_version": "3.112.0-4.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-sysinit", "installed_version": "3.112.0-4.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2020-12413", "package": "nss-util", "installed_version": "3.112.0-4.el9_4", "fixed_version": null, "title": "nss: Information exposure when DH secret are reused across multiple TLS connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-12413" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-7531", "package": "nss-util", "installed_version": "3.112.0-4.el9_4", "fixed_version": null, "title": "mozilla: nss: PK11_Encrypt using CKM_CHACHA20 can reveal plaintext on Intel Sandy Bridge machines", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-7531" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-37977", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.4.13, 26.6.3", "title": "keycloak: org.keycloak.protocol.oidc.grants.ciba: Keycloak: Information disclosure via CORS header injection due to unvalidated JWT azp claim", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-37977" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-3911", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": null, "title": "org.keycloak.services.resources.admin.UserResource: Keycloak: Information disclosure of disabled user attributes via administrative endpoint", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-3911" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-4633", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.1, 26.4.12", "title": "keycloak: Keycloak: User enumeration via differential error messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4633" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-4874", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.6.3, 26.4.13", "title": "org.keycloak.protocol.oidc.grants: org.keycloak.services.managers: Keycloak: Server-Side Request Forgery via OIDC token endpoint manipulation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-4874" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-9088", "package": "org.keycloak:keycloak-services", "installed_version": "26.5.4", "fixed_version": "26.7.0", "title": "keycloak: Keycloak: Information disclosure due to user profile permission bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9088" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-119280", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.6", "fixed_version": "3.3.7, 3.4.5, 3.5.11", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Denial of Service via unvalidated lengths during XA recovery", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-119280" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-61700", "package": "org.mariadb.jdbc:mariadb-java-client", "installed_version": "3.5.6", "fixed_version": "2.7.14, 3.3.5, 3.4.3, 3.5.9", "title": "org.mariadb.jdbc/mariadb-java-client: MariaDB Connector/J: Information disclosure via server-initiated LOCAL INFILE requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-61700" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2022-41409", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": null, "title": "pcre2: negative repeat value in a pcre2test subject line leads to inifinite loop", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-41409" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89156", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89156" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89160", "package": "pcre2", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89160" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2022-41409", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": null, "title": "pcre2: negative repeat value in a pcre2test subject line leads to inifinite loop", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-41409" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89156", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "PCRE2: PCRE2: Out-of-bounds read via invalid UTF data during JIT fallback", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89156" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-89160", "package": "pcre2-syntax", "installed_version": "10.40-6.el9", "fixed_version": "10.40-7.el9_8", "title": "pcre2: PCRE2: Denial of Service via out-of-bounds read during invalid UTF matching", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89160" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-0232", "package": "sqlite-libs", "installed_version": "3.34.1-9.el9_7", "fixed_version": null, "title": "sqlite: use-after-free bug in jsonParseAddNodeArray", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-0232" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-70873", "package": "sqlite-libs", "installed_version": "3.34.1-9.el9_7", "fixed_version": null, "title": "sqlite: SQLite: Information Disclosure via Crafted ZIP File", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-70873" }, { "target": "docker.rtb-bl.de/pdm/hub/keycloak:26.5.4 (redhat 9.7)", "source_class": "os-pkgs", "source_type": "redhat", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-27171", "package": "zlib", "installed_version": "1.2.11-40.el9", "fixed_version": null, "title": "zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27171" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:26.0.0", "vulnerability_count": 19, "highest_severity": "CRITICAL", "findings": [ { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "11.0.24", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "11.0.24", "fixed_version": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "11.0.24", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "11.0.24", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.5", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.5", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "33.7.1-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "tools.jackson.core:jackson-core", "installed_version": "3.1.5", "fixed_version": "3.1.7, 3.2.2", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "tools.jackson.core:jackson-core", "installed_version": "3.1.5", "fixed_version": "3.1.7, 3.2.3", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "tools.jackson.core:jackson-databind", "installed_version": "3.1.5", "fixed_version": "3.2.2, 3.1.6", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "tools.jackson.core:jackson-databind", "installed_version": "3.1.5", "fixed_version": "3.1.7, 3.2.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "tools.jackson.core:jackson-databind", "installed_version": "3.1.5", "fixed_version": "3.1.7, 3.2.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.5", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "tools.jackson.core:jackson-databind", "installed_version": "3.1.5", "fixed_version": "3.1.6, 3.2.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "tools.jackson.core:jackson-databind", "installed_version": "3.1.5", "fixed_version": "3.1.6, 3.2.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0", "vulnerability_count": 95, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-111497", "package": "brotli-libs", "installed_version": "1.2.0-r0", "fixed_version": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed_version": "4.1.135.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.55", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.55", "fixed_version": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.55", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.55", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.19", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.19", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.4", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.4", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.4", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.4", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.4", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "33.5.0-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-59901", "package": "io.netty:netty-codec", "installed_version": "4.1.135.Final", "fixed_version": "4.1.136.Final", "title": "io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55831", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55831" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55833", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55833" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56745", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56819", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56819" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-66046", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "expat: Expat: Denial of Service via quadratic complexity in attribute processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-66046" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76641", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "expat: Expat: Denial of Service via XML external entity parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76641" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76956", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "libexpat: libexpat: Denial of Service via hash flooding attack with crafted XML", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76956" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76957", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76957" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-77214", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.9.0-r0", "title": "expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77214" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-93990", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.5-r0", "title": "expat: Expat: XML Injection via Malformed UTF-16 Input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-93990" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-75140", "package": "org.jsoup:jsoup", "installed_version": "1.21.2", "fixed_version": "1.23.2", "title": "org.jsoup/jsoup: jsoup: Denial of Service via deeply nested XML documents", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75140" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54291", "package": "org.postgresql:postgresql", "installed_version": "42.7.11", "fixed_version": "42.7.12", "title": "org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54291" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-2100", "package": "p11-kit", "installed_version": "0.25.5-r2", "fixed_version": "0.26.2-r0", "title": "p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2100" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-2100", "package": "p11-kit-trust", "installed_version": "0.25.5-r2", "fixed_version": "0.26.2-r0", "title": "p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2100" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11822", "package": "sqlite-libs", "installed_version": "3.51.2-r0", "fixed_version": "3.53.4-r0", "title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11822" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11824", "package": "sqlite-libs", "installed_version": "3.51.2-r0", "fixed_version": "3.53.4-r0", "title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11824" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.4", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.4", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.4", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.4", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.4", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "GHSA-mhm7-754m-9p8w", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.4", "fixed_version": "2.18.9, 2.21.5", "title": "jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`", "primary_url": "https://github.com/advisories/GHSA-mhm7-754m-9p8w" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56746", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56746" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59898", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59898" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59899", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59899" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59903", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59903" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59921", "package": "io.netty:netty-codec-http", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59921" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59900", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.135.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59900" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75596", "package": "io.netty:netty-handler", "installed_version": "4.1.135.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "Netty is an asynchronous, event-driven network application framework. ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75596" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-102633", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.9.0-r0", "title": "expat: expat: Denial of Service via integer overflow in expat_realloc", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102633" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50219", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50219" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56131", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56131" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56132", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56132" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56403", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution due to integer overflow in storeAtts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56403" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56404", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary Code Execution via integer overflow in addBinding", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56404" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56405", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Information disclosure and arbitrary code execution via integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56405" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56406", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution via integer overflow in XML_ParseBuffer", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56406" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56407", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution due to integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56407" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56408", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Information disclosure and arbitrary code execution via integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56408" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56409", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Integer overflow in xmlwf may lead to information disclosure or arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56409" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56410", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Integer overflow in xmlwf can lead to information disclosure and arbitrary code execution.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56410" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56411", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Integer Overflow Vulnerability Leading to Information Disclosure or Code Execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56411" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56412", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Use-after-free vulnerability due to improper handling of XML CDATA sections", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56412" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-46675", "package": "libpng", "installed_version": "1.6.58-r1", "fixed_version": "1.6.59-r0", "title": "libpng: libpng: Use-after-free in sequential reader when png_read_end called without reading image rows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-46675" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-48924", "package": "org.apache.commons:commons-lang3", "installed_version": "3.17.0", "fixed_version": "3.18.0", "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48924" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49844", "package": "org.apache.logging.log4j:log4j-api", "installed_version": "2.24.3", "fixed_version": "2.25.5, 2.26.1", "title": "org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-71497", "package": "org.jsoup:jsoup", "installed_version": "1.21.2", "fixed_version": "1.23.1", "title": "org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-71497" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-85091", "package": "zlib", "installed_version": "1.3.2-r0", "fixed_version": "1.3.2-r1", "title": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vul ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-85091" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-107891", "package": "musl", "installed_version": "1.2.5-r23", "fixed_version": "1.2.5-r24", "title": "Title Not Available", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-107891" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.3.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-107891", "package": "musl-utils", "installed_version": "1.2.5-r23", "fixed_version": "1.2.5-r24", "title": "Title Not Available", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-107891" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2", "vulnerability_count": 152, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-111497", "package": "brotli-libs", "installed_version": "1.2.0-r0", "fixed_version": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed_version": "4.1.132.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.54", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.54", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.54", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.54", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.54", "fixed_version": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.54", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.54", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.18", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.18", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "33.5.0-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40983", "package": "io.micrometer:micrometer-core", "installed_version": "1.15.11", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40983" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.15.11", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42583", "package": "io.netty:netty-codec", "installed_version": "4.1.132.Final", "fixed_version": "4.1.133.Final", "title": "netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42583" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-59901", "package": "io.netty:netty-codec", "installed_version": "4.1.132.Final", "fixed_version": "4.1.136.Final", "title": "io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42584", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42584" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42587", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42587" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55831", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55831" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55833", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55833" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56745", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42587", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.132.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42587" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56819", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56819" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-44249", "package": "io.netty:netty-handler", "installed_version": "4.1.132.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-44249" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-45416", "package": "io.netty:netty-handler", "installed_version": "4.1.132.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45416" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-50010", "package": "io.netty:netty-handler", "installed_version": "4.1.132.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50010" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-66046", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "expat: Expat: Denial of Service via quadratic complexity in attribute processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-66046" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76641", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "expat: Expat: Denial of Service via XML external entity parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76641" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76956", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "libexpat: libexpat: Denial of Service via hash flooding attack with crafted XML", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76956" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76957", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76957" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-77214", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.9.0-r0", "title": "expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77214" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-93990", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.5-r0", "title": "expat: Expat: XML Injection via Malformed UTF-16 Input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-93990" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41284", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.54", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41284" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42498", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.54", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42498" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-43513", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.54", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-75140", "package": "org.jsoup:jsoup", "installed_version": "1.21.2", "fixed_version": "1.23.2", "title": "org.jsoup/jsoup: jsoup: Denial of Service via deeply nested XML documents", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75140" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42198", "package": "org.postgresql:postgresql", "installed_version": "42.7.10", "fixed_version": "42.7.11", "title": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42198" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54291", "package": "org.postgresql:postgresql", "installed_version": "42.7.10", "fixed_version": "42.7.12", "title": "org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54291" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41695", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.11", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via crafted property path strings", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41695" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41716", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.11", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service due to cache exhaustion via attacker-supplied strings", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41716" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40999", "package": "org.springframework.ws:spring-ws-core", "installed_version": "4.1.3", "fixed_version": "5.0.2, 4.1.4", "title": "Spring Web Services: SSRF via unvalidated WS-Addressing reply destinations", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40999" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40998", "package": "org.springframework.ws:spring-xml", "installed_version": "4.1.3", "fixed_version": "5.0.2, 4.1.4", "title": "org.springframework.ws/spring-xml: Spring Web Services: XML External Entity (XXE) attack via untrusted XML payloads", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40998" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41850", "package": "org.springframework:spring-expression", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service via specially crafted SpEL expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41850" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41842", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service when resolving static resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41842" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41845", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "org.springframework: Spring Framework: Cross-site scripting (XSS) via incorrect JavaScript escaping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41845" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-2100", "package": "p11-kit", "installed_version": "0.25.5-r2", "fixed_version": "0.26.2-r0", "title": "p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2100" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-2100", "package": "p11-kit-trust", "installed_version": "0.25.5-r2", "fixed_version": "0.26.2-r0", "title": "p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2100" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11822", "package": "sqlite-libs", "installed_version": "3.51.2-r0", "fixed_version": "3.53.4-r0", "title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11822" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11824", "package": "sqlite-libs", "installed_version": "3.51.2-r0", "fixed_version": "3.53.4-r0", "title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11824" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54516", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Security bypass due to improper handling of renamed properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54516" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54517", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information disclosure via improper JsonView filter application", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54517" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54518", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4", "title": "jackson-databind: jackson-databind: Information disclosure and data manipulation via view-based access control bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54518" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59888", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "GHSA-mhm7-754m-9p8w", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.9, 2.21.5", "title": "jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`", "primary_url": "https://github.com/advisories/GHSA-mhm7-754m-9p8w" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41417", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.1.133.Final, 4.2.13.Final", "title": "netty: Netty: HTTP request smuggling via URI manipulation and CRLF injection", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41417" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42580", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: Netty: Request smuggling via chunk size parser integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42580" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42581", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42581" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42585", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42585" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50020", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http: Netty: Data manipulation via request-boundary confusion in HttpObjectDecoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50020" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56746", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56746" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59898", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59898" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59899", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59899" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59903", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59903" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59921", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59921" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47244", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.132.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47244" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-48043", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.132.Final", "fixed_version": "4.1.135.Final, 4.2.15.Final", "title": "netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-48043" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50560", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.132.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http2: Netty: Denial of Service due to HTTP/2 max header size handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50560" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59900", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59900" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75596", "package": "io.netty:netty-handler", "installed_version": "4.1.132.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "Netty is an asynchronous, event-driven network application framework. ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75596" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-102633", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.9.0-r0", "title": "expat: expat: Denial of Service via integer overflow in expat_realloc", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102633" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50219", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50219" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56131", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56131" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56132", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56132" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56403", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution due to integer overflow in storeAtts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56403" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56404", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary Code Execution via integer overflow in addBinding", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56404" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56405", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Information disclosure and arbitrary code execution via integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56405" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56406", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution via integer overflow in XML_ParseBuffer", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56406" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56407", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution due to integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56407" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56408", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Information disclosure and arbitrary code execution via integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56408" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56409", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Integer overflow in xmlwf may lead to information disclosure or arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56409" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56410", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Integer overflow in xmlwf can lead to information disclosure and arbitrary code execution.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56410" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56411", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Integer Overflow Vulnerability Leading to Information Disclosure or Code Execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56411" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56412", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Use-after-free vulnerability due to improper handling of XML CDATA sections", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56412" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-46675", "package": "libpng", "installed_version": "1.6.58-r1", "fixed_version": "1.6.59-r0", "title": "libpng: libpng: Use-after-free in sequential reader when png_read_end called without reading image rows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-46675" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-48924", "package": "org.apache.commons:commons-lang3", "installed_version": "3.17.0", "fixed_version": "3.18.0", "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48924" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49844", "package": "org.apache.logging.log4j:log4j-api", "installed_version": "2.24.3", "fixed_version": "2.25.5, 2.26.1", "title": "org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-71497", "package": "org.jsoup:jsoup", "installed_version": "1.21.2", "fixed_version": "1.23.1", "title": "org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-71497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41001", "package": "org.springframework.boot:spring-boot-autoconfigure", "installed_version": "3.5.14", "fixed_version": "4.0.7, 3.5.15", "title": "spring-boot: Spring Boot: Local attacker can manipulate data directory due to predictable path", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41001" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41711", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.11", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via parsing Sort parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41711" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41721", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.11", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via specially crafted HTTP request with @ProjectedPayload", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41721" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41710", "package": "org.springframework.retry:spring-retry", "installed_version": "2.0.12", "fixed_version": "2.0.13", "title": "spring-retry: Spring Retry: Denial of Service via cache exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41706", "package": "org.springframework.security:spring-security-web", "installed_version": "6.5.10", "fixed_version": "7.0.6, 6.5.11", "title": "Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41706" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47838", "package": "org.springframework.security:spring-security-web", "installed_version": "6.5.10", "fixed_version": "6.5.11", "title": "Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47838" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41851", "package": "org.springframework:spring-expression", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Denial of Service via unbounded cache growth in SpEL evaluation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41851" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41854", "package": "org.springframework:spring-web", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Server-Side Request Forgery via incorrect host parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41841", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring MVC and WebFlux applications: Information Disclosure via static resource resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41841" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41843", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "spring-webflux: spring-webmvc: Spring Framework: Information Disclosure via Path Traversal", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41843" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41844", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Open Redirect via crafted link", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41846", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Cross-site scripting (XSS) via user-supplied values in JSP form tags", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41846" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41853", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Request smuggling vulnerability in Spring MVC and WebFlux", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41853" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-85091", "package": "zlib", "installed_version": "1.3.2-r0", "fixed_version": "1.3.2-r1", "title": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vul ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-85091" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-10532", "package": "ch.qos.logback:logback-core", "installed_version": "1.5.32", "fixed_version": "1.5.34", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-10532" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-9828", "package": "ch.qos.logback:logback-core", "installed_version": "1.5.32", "fixed_version": "1.5.33", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9828" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-43514", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.54", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41848", "package": "org.springframework:spring-core", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Regular Expression Denial of Service in AntPathMatcher", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41848" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41852", "package": "org.springframework:spring-expression", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: org.springframework/spring-expression: Spring Framework: SpEL vulnerability allows unintended application logic invocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41852" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-107891", "package": "musl", "installed_version": "1.2.5-r23", "fixed_version": "1.2.5-r24", "title": "Title Not Available", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-107891" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.2 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-107891", "package": "musl-utils", "installed_version": "1.2.5-r23", "fixed_version": "1.2.5-r24", "title": "Title Not Available", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-107891" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1", "vulnerability_count": 152, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-111497", "package": "brotli-libs", "installed_version": "1.2.0-r0", "fixed_version": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed_version": "4.1.132.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.54", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.54", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.54", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.54", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.54", "fixed_version": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.54", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.54", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.18", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.18", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "33.5.0-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40983", "package": "io.micrometer:micrometer-core", "installed_version": "1.15.11", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40983" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.15.11", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42583", "package": "io.netty:netty-codec", "installed_version": "4.1.132.Final", "fixed_version": "4.1.133.Final", "title": "netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42583" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-59901", "package": "io.netty:netty-codec", "installed_version": "4.1.132.Final", "fixed_version": "4.1.136.Final", "title": "io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42584", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42584" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42587", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42587" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55831", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55831" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55833", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55833" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56745", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42587", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.132.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42587" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56819", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56819" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-44249", "package": "io.netty:netty-handler", "installed_version": "4.1.132.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-44249" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-45416", "package": "io.netty:netty-handler", "installed_version": "4.1.132.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45416" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-50010", "package": "io.netty:netty-handler", "installed_version": "4.1.132.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50010" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-66046", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "expat: Expat: Denial of Service via quadratic complexity in attribute processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-66046" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76641", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "expat: Expat: Denial of Service via XML external entity parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76641" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76956", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "libexpat: libexpat: Denial of Service via hash flooding attack with crafted XML", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76956" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76957", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76957" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-77214", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.9.0-r0", "title": "expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77214" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-93990", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.5-r0", "title": "expat: Expat: XML Injection via Malformed UTF-16 Input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-93990" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41284", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.54", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41284" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42498", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.54", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42498" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-43513", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.54", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-75140", "package": "org.jsoup:jsoup", "installed_version": "1.21.2", "fixed_version": "1.23.2", "title": "org.jsoup/jsoup: jsoup: Denial of Service via deeply nested XML documents", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75140" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42198", "package": "org.postgresql:postgresql", "installed_version": "42.7.10", "fixed_version": "42.7.11", "title": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42198" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54291", "package": "org.postgresql:postgresql", "installed_version": "42.7.10", "fixed_version": "42.7.12", "title": "org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54291" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41695", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.11", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via crafted property path strings", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41695" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41716", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.11", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service due to cache exhaustion via attacker-supplied strings", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41716" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40999", "package": "org.springframework.ws:spring-ws-core", "installed_version": "4.1.3", "fixed_version": "5.0.2, 4.1.4", "title": "Spring Web Services: SSRF via unvalidated WS-Addressing reply destinations", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40999" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40998", "package": "org.springframework.ws:spring-xml", "installed_version": "4.1.3", "fixed_version": "5.0.2, 4.1.4", "title": "org.springframework.ws/spring-xml: Spring Web Services: XML External Entity (XXE) attack via untrusted XML payloads", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40998" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41850", "package": "org.springframework:spring-expression", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service via specially crafted SpEL expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41850" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41842", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service when resolving static resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41842" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41845", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "org.springframework: Spring Framework: Cross-site scripting (XSS) via incorrect JavaScript escaping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41845" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-2100", "package": "p11-kit", "installed_version": "0.25.5-r2", "fixed_version": "0.26.2-r0", "title": "p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2100" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-2100", "package": "p11-kit-trust", "installed_version": "0.25.5-r2", "fixed_version": "0.26.2-r0", "title": "p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2100" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11822", "package": "sqlite-libs", "installed_version": "3.51.2-r0", "fixed_version": "3.53.4-r0", "title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11822" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11824", "package": "sqlite-libs", "installed_version": "3.51.2-r0", "fixed_version": "3.53.4-r0", "title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11824" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54516", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Security bypass due to improper handling of renamed properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54516" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54517", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information disclosure via improper JsonView filter application", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54517" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54518", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4", "title": "jackson-databind: jackson-databind: Information disclosure and data manipulation via view-based access control bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54518" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59888", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "GHSA-mhm7-754m-9p8w", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.9, 2.21.5", "title": "jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`", "primary_url": "https://github.com/advisories/GHSA-mhm7-754m-9p8w" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41417", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.1.133.Final, 4.2.13.Final", "title": "netty: Netty: HTTP request smuggling via URI manipulation and CRLF injection", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41417" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42580", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: Netty: Request smuggling via chunk size parser integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42580" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42581", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42581" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42585", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42585" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50020", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http: Netty: Data manipulation via request-boundary confusion in HttpObjectDecoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50020" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56746", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56746" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59898", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59898" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59899", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59899" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59903", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59903" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59921", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59921" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47244", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.132.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47244" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-48043", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.132.Final", "fixed_version": "4.1.135.Final, 4.2.15.Final", "title": "netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-48043" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50560", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.132.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http2: Netty: Denial of Service due to HTTP/2 max header size handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50560" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59900", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59900" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75596", "package": "io.netty:netty-handler", "installed_version": "4.1.132.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "Netty is an asynchronous, event-driven network application framework. ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75596" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-102633", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.9.0-r0", "title": "expat: expat: Denial of Service via integer overflow in expat_realloc", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102633" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50219", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50219" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56131", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56131" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56132", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56132" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56403", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution due to integer overflow in storeAtts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56403" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56404", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary Code Execution via integer overflow in addBinding", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56404" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56405", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Information disclosure and arbitrary code execution via integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56405" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56406", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution via integer overflow in XML_ParseBuffer", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56406" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56407", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution due to integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56407" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56408", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Information disclosure and arbitrary code execution via integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56408" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56409", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Integer overflow in xmlwf may lead to information disclosure or arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56409" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56410", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Integer overflow in xmlwf can lead to information disclosure and arbitrary code execution.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56410" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56411", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Integer Overflow Vulnerability Leading to Information Disclosure or Code Execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56411" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56412", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Use-after-free vulnerability due to improper handling of XML CDATA sections", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56412" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-46675", "package": "libpng", "installed_version": "1.6.58-r1", "fixed_version": "1.6.59-r0", "title": "libpng: libpng: Use-after-free in sequential reader when png_read_end called without reading image rows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-46675" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-48924", "package": "org.apache.commons:commons-lang3", "installed_version": "3.17.0", "fixed_version": "3.18.0", "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48924" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49844", "package": "org.apache.logging.log4j:log4j-api", "installed_version": "2.24.3", "fixed_version": "2.25.5, 2.26.1", "title": "org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-71497", "package": "org.jsoup:jsoup", "installed_version": "1.21.2", "fixed_version": "1.23.1", "title": "org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-71497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41001", "package": "org.springframework.boot:spring-boot-autoconfigure", "installed_version": "3.5.14", "fixed_version": "4.0.7, 3.5.15", "title": "spring-boot: Spring Boot: Local attacker can manipulate data directory due to predictable path", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41001" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41711", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.11", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via parsing Sort parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41711" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41721", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.11", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via specially crafted HTTP request with @ProjectedPayload", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41721" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41710", "package": "org.springframework.retry:spring-retry", "installed_version": "2.0.12", "fixed_version": "2.0.13", "title": "spring-retry: Spring Retry: Denial of Service via cache exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41706", "package": "org.springframework.security:spring-security-web", "installed_version": "6.5.10", "fixed_version": "7.0.6, 6.5.11", "title": "Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41706" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47838", "package": "org.springframework.security:spring-security-web", "installed_version": "6.5.10", "fixed_version": "6.5.11", "title": "Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47838" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41851", "package": "org.springframework:spring-expression", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Denial of Service via unbounded cache growth in SpEL evaluation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41851" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41854", "package": "org.springframework:spring-web", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Server-Side Request Forgery via incorrect host parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41841", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring MVC and WebFlux applications: Information Disclosure via static resource resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41841" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41843", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "spring-webflux: spring-webmvc: Spring Framework: Information Disclosure via Path Traversal", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41843" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41844", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Open Redirect via crafted link", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41846", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Cross-site scripting (XSS) via user-supplied values in JSP form tags", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41846" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41853", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Request smuggling vulnerability in Spring MVC and WebFlux", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41853" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-85091", "package": "zlib", "installed_version": "1.3.2-r0", "fixed_version": "1.3.2-r1", "title": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vul ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-85091" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-10532", "package": "ch.qos.logback:logback-core", "installed_version": "1.5.32", "fixed_version": "1.5.34", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-10532" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-9828", "package": "ch.qos.logback:logback-core", "installed_version": "1.5.32", "fixed_version": "1.5.33", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9828" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-43514", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.54", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41848", "package": "org.springframework:spring-core", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Regular Expression Denial of Service in AntPathMatcher", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41848" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41852", "package": "org.springframework:spring-expression", "installed_version": "6.2.18", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: org.springframework/spring-expression: Spring Framework: SpEL vulnerability allows unintended application logic invocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41852" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-107891", "package": "musl", "installed_version": "1.2.5-r23", "fixed_version": "1.2.5-r24", "title": "Title Not Available", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-107891" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-107891", "package": "musl-utils", "installed_version": "1.2.5-r23", "fixed_version": "1.2.5-r24", "title": "Title Not Available", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-107891" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0", "vulnerability_count": 165, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-111497", "package": "brotli-libs", "installed_version": "1.2.0-r0", "fixed_version": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed_version": "4.1.132.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.53", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.53", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.53", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.53", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.53", "fixed_version": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.53", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.53", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.17", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.17", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.21.2", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "33.5.0-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40983", "package": "io.micrometer:micrometer-core", "installed_version": "1.15.10", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40983" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.15.10", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42583", "package": "io.netty:netty-codec", "installed_version": "4.1.132.Final", "fixed_version": "4.1.133.Final", "title": "netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42583" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-59901", "package": "io.netty:netty-codec", "installed_version": "4.1.132.Final", "fixed_version": "4.1.136.Final", "title": "io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42584", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42584" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42587", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42587" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55831", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55831" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55833", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55833" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56745", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42587", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.132.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42587" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56819", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56819" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-44249", "package": "io.netty:netty-handler", "installed_version": "4.1.132.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-44249" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-45416", "package": "io.netty:netty-handler", "installed_version": "4.1.132.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45416" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-50010", "package": "io.netty:netty-handler", "installed_version": "4.1.132.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50010" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-66046", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "expat: Expat: Denial of Service via quadratic complexity in attribute processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-66046" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76641", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "expat: Expat: Denial of Service via XML external entity parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76641" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76956", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "libexpat: libexpat: Denial of Service via hash flooding attack with crafted XML", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76956" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76957", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76957" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-77214", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.9.0-r0", "title": "expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77214" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-93990", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.5-r0", "title": "expat: Expat: XML Injection via Malformed UTF-16 Input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-93990" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34483", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.53", "fixed_version": "9.0.116, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34483" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34487", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.53", "fixed_version": "9.0.117, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34487" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41284", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.53", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41284" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42498", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.53", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42498" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-43513", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.53", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-75140", "package": "org.jsoup:jsoup", "installed_version": "1.21.2", "fixed_version": "1.23.2", "title": "org.jsoup/jsoup: jsoup: Denial of Service via deeply nested XML documents", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75140" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42198", "package": "org.postgresql:postgresql", "installed_version": "42.7.10", "fixed_version": "42.7.11", "title": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42198" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54291", "package": "org.postgresql:postgresql", "installed_version": "42.7.10", "fixed_version": "42.7.12", "title": "org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54291" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40973", "package": "org.springframework.boot:spring-boot", "installed_version": "3.5.13", "fixed_version": "4.0.6, 3.5.14", "title": "Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40973" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41695", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.10", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via crafted property path strings", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41695" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41716", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.10", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service due to cache exhaustion via attacker-supplied strings", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41716" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40999", "package": "org.springframework.ws:spring-ws-core", "installed_version": "4.1.3", "fixed_version": "5.0.2, 4.1.4", "title": "Spring Web Services: SSRF via unvalidated WS-Addressing reply destinations", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40999" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40998", "package": "org.springframework.ws:spring-xml", "installed_version": "4.1.3", "fixed_version": "5.0.2, 4.1.4", "title": "org.springframework.ws/spring-xml: Spring Web Services: XML External Entity (XXE) attack via untrusted XML payloads", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40998" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41850", "package": "org.springframework:spring-expression", "installed_version": "6.2.17", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service via specially crafted SpEL expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41850" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41842", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.17", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service when resolving static resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41842" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41845", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.17", "fixed_version": "7.0.8, 6.2.19", "title": "org.springframework: Spring Framework: Cross-site scripting (XSS) via incorrect JavaScript escaping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41845" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-2100", "package": "p11-kit", "installed_version": "0.25.5-r2", "fixed_version": "0.26.2-r0", "title": "p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2100" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-2100", "package": "p11-kit-trust", "installed_version": "0.25.5-r2", "fixed_version": "0.26.2-r0", "title": "p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2100" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11822", "package": "sqlite-libs", "installed_version": "3.51.2-r0", "fixed_version": "3.53.4-r0", "title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11822" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11824", "package": "sqlite-libs", "installed_version": "3.51.2-r0", "fixed_version": "3.53.4-r0", "title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11824" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54516", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Security bypass due to improper handling of renamed properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54516" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54517", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information disclosure via improper JsonView filter application", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54517" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54518", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.4", "title": "jackson-databind: jackson-databind: Information disclosure and data manipulation via view-based access control bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54518" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59888", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "GHSA-mhm7-754m-9p8w", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.21.2", "fixed_version": "2.18.9, 2.21.5", "title": "jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`", "primary_url": "https://github.com/advisories/GHSA-mhm7-754m-9p8w" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41417", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.1.133.Final, 4.2.13.Final", "title": "netty: Netty: HTTP request smuggling via URI manipulation and CRLF injection", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41417" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42580", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: Netty: Request smuggling via chunk size parser integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42580" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42581", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42581" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42585", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42585" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50020", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http: Netty: Data manipulation via request-boundary confusion in HttpObjectDecoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50020" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56746", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56746" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59898", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59898" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59899", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59899" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59903", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59903" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59921", "package": "io.netty:netty-codec-http", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59921" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47244", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.132.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47244" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-48043", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.132.Final", "fixed_version": "4.1.135.Final, 4.2.15.Final", "title": "netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-48043" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50560", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.132.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http2: Netty: Denial of Service due to HTTP/2 max header size handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50560" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59900", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.132.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59900" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75596", "package": "io.netty:netty-handler", "installed_version": "4.1.132.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "Netty is an asynchronous, event-driven network application framework. ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75596" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-102633", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.9.0-r0", "title": "expat: expat: Denial of Service via integer overflow in expat_realloc", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102633" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50219", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50219" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56131", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56131" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56132", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56132" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56403", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution due to integer overflow in storeAtts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56403" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56404", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary Code Execution via integer overflow in addBinding", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56404" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56405", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Information disclosure and arbitrary code execution via integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56405" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56406", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution via integer overflow in XML_ParseBuffer", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56406" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56407", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution due to integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56407" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56408", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Information disclosure and arbitrary code execution via integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56408" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56409", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Integer overflow in xmlwf may lead to information disclosure or arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56409" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56410", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Integer overflow in xmlwf can lead to information disclosure and arbitrary code execution.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56410" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56411", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Integer Overflow Vulnerability Leading to Information Disclosure or Code Execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56411" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56412", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Use-after-free vulnerability due to improper handling of XML CDATA sections", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56412" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-46675", "package": "libpng", "installed_version": "1.6.58-r1", "fixed_version": "1.6.59-r0", "title": "libpng: libpng: Use-after-free in sequential reader when png_read_end called without reading image rows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-46675" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-48924", "package": "org.apache.commons:commons-lang3", "installed_version": "3.17.0", "fixed_version": "3.18.0", "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48924" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49844", "package": "org.apache.logging.log4j:log4j-api", "installed_version": "2.24.3", "fixed_version": "2.25.5, 2.26.1", "title": "org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-71497", "package": "org.jsoup:jsoup", "installed_version": "1.21.2", "fixed_version": "1.23.1", "title": "org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-71497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41001", "package": "org.springframework.boot:spring-boot-autoconfigure", "installed_version": "3.5.13", "fixed_version": "4.0.7, 3.5.15", "title": "spring-boot: Spring Boot: Local attacker can manipulate data directory due to predictable path", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41001" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41711", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.10", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via parsing Sort parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41711" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41721", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.10", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via specially crafted HTTP request with @ProjectedPayload", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41721" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41710", "package": "org.springframework.retry:spring-retry", "installed_version": "2.0.12", "fixed_version": "2.0.13", "title": "spring-retry: Spring Retry: Denial of Service via cache exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22751", "package": "org.springframework.security:spring-security-core", "installed_version": "6.5.9", "fixed_version": "6.5.10, 7.0.5", "title": "Spring Security: JdbcOneTimeTokenService: Spring Security: Authentication bypass due to race condition in One-Time Token login", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22751" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41706", "package": "org.springframework.security:spring-security-web", "installed_version": "6.5.9", "fixed_version": "7.0.6, 6.5.11", "title": "Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41706" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47838", "package": "org.springframework.security:spring-security-web", "installed_version": "6.5.9", "fixed_version": "6.5.11", "title": "Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47838" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41851", "package": "org.springframework:spring-expression", "installed_version": "6.2.17", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Denial of Service via unbounded cache growth in SpEL evaluation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41851" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41854", "package": "org.springframework:spring-web", "installed_version": "6.2.17", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Server-Side Request Forgery via incorrect host parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22745", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.17", "fixed_version": "7.0.7, 6.2.18", "title": "spring-webflux: Spring MVC and Spring WebFlux: Denial of Service via slow static resource resolution on Windows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41841", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.17", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring MVC and WebFlux applications: Information Disclosure via static resource resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41841" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41843", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.17", "fixed_version": "7.0.8, 6.2.19", "title": "spring-webflux: spring-webmvc: Spring Framework: Information Disclosure via Path Traversal", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41843" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41844", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.17", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Open Redirect via crafted link", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41846", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.17", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Cross-site scripting (XSS) via user-supplied values in JSP form tags", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41846" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41853", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.17", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Request smuggling vulnerability in Spring MVC and WebFlux", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41853" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-85091", "package": "zlib", "installed_version": "1.3.2-r0", "fixed_version": "1.3.2-r1", "title": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vul ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-85091" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-10532", "package": "ch.qos.logback:logback-core", "installed_version": "1.5.32", "fixed_version": "1.5.34", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-10532" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-9828", "package": "ch.qos.logback:logback-core", "installed_version": "1.5.32", "fixed_version": "1.5.33", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9828" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-43514", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.53", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22746", "package": "org.springframework.security:spring-security-core", "installed_version": "6.5.9", "fixed_version": "6.5.10, 7.0.5", "title": "Spring Security: Spring Security: Timing attack defense bypass allows information disclosure", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22746" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41848", "package": "org.springframework:spring-core", "installed_version": "6.2.17", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Regular Expression Denial of Service in AntPathMatcher", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41848" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41852", "package": "org.springframework:spring-expression", "installed_version": "6.2.17", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: org.springframework/spring-expression: Spring Framework: SpEL vulnerability allows unintended application logic invocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41852" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22741", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.17", "fixed_version": "7.0.7, 6.2.18", "title": "Spring MVC: Spring WebFlux: Spring MVC and Spring WebFlux: Denial of Service via cache poisoning", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-107891", "package": "musl", "installed_version": "1.2.5-r23", "fixed_version": "1.2.5-r24", "title": "Title Not Available", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-107891" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.2.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-107891", "package": "musl-utils", "installed_version": "1.2.5-r23", "fixed_version": "1.2.5-r24", "title": "Title Not Available", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-107891" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0", "vulnerability_count": 171, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-111497", "package": "brotli-libs", "installed_version": "1.2.0-r0", "fixed_version": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-22732", "package": "org.springframework.security:spring-security-web", "installed_version": "6.5.7", "fixed_version": "6.5.9, 7.0.4", "title": "Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22732" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.4", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.4", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.4", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "33.5.0-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40983", "package": "io.micrometer:micrometer-core", "installed_version": "1.15.7", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40983" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.15.7", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42583", "package": "io.netty:netty-codec", "installed_version": "4.1.130.Final", "fixed_version": "4.1.133.Final", "title": "netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42583" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-59901", "package": "io.netty:netty-codec", "installed_version": "4.1.130.Final", "fixed_version": "4.1.136.Final", "title": "io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-33870", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.1.132.Final, 4.2.10.Final", "title": "io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33870" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42584", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42584" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42587", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42587" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55831", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55831" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55833", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55833" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56745", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-33871", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.1.132.Final, 4.2.11.Final", "title": "netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33871" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42587", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42587" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56819", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56819" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-44249", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-44249" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-45416", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45416" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-50010", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50010" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-66046", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "expat: Expat: Denial of Service via quadratic complexity in attribute processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-66046" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76641", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "expat: Expat: Denial of Service via XML external entity parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76641" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76956", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "libexpat: libexpat: Denial of Service via hash flooding attack with crafted XML", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76956" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76957", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76957" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-77214", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.9.0-r0", "title": "expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77214" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-93990", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.5-r0", "title": "expat: Expat: XML Injection via Malformed UTF-16 Input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-93990" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24734", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "11.0.18, 10.1.52, 9.0.115", "title": "tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24880", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.116, 10.1.52, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24880" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34483", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.116, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34483" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34487", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.117, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34487" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41284", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41284" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42498", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42498" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-43513", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-75140", "package": "org.jsoup:jsoup", "installed_version": "1.21.2", "fixed_version": "1.23.2", "title": "org.jsoup/jsoup: jsoup: Denial of Service via deeply nested XML documents", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75140" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42198", "package": "org.postgresql:postgresql", "installed_version": "42.7.8", "fixed_version": "42.7.11", "title": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42198" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54291", "package": "org.postgresql:postgresql", "installed_version": "42.7.8", "fixed_version": "42.7.12", "title": "org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54291" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40973", "package": "org.springframework.boot:spring-boot", "installed_version": "3.5.9", "fixed_version": "4.0.6, 3.5.14", "title": "Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40973" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41695", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.7", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via crafted property path strings", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41695" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41716", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.7", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service due to cache exhaustion via attacker-supplied strings", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41716" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40999", "package": "org.springframework.ws:spring-ws-core", "installed_version": "4.1.2", "fixed_version": "5.0.2, 4.1.4", "title": "Spring Web Services: SSRF via unvalidated WS-Addressing reply destinations", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40999" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40998", "package": "org.springframework.ws:spring-xml", "installed_version": "4.1.2", "fixed_version": "5.0.2, 4.1.4", "title": "org.springframework.ws/spring-xml: Spring Web Services: XML External Entity (XXE) attack via untrusted XML payloads", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40998" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41850", "package": "org.springframework:spring-expression", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service via specially crafted SpEL expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41850" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41842", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service when resolving static resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41842" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41845", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "org.springframework: Spring Framework: Cross-site scripting (XSS) via incorrect JavaScript escaping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41845" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-2100", "package": "p11-kit", "installed_version": "0.25.5-r2", "fixed_version": "0.26.2-r0", "title": "p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2100" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-2100", "package": "p11-kit-trust", "installed_version": "0.25.5-r2", "fixed_version": "0.26.2-r0", "title": "p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2100" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11822", "package": "sqlite-libs", "installed_version": "3.51.2-r0", "fixed_version": "3.53.4-r0", "title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11822" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11824", "package": "sqlite-libs", "installed_version": "3.51.2-r0", "fixed_version": "3.53.4-r0", "title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11824" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18401", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.4", "fixed_version": "2.21.1, 2.18.6", "title": "tools.jackson.core/jackson-core: com.fasterxml.jackson.core/jackson-core: jackson-core: Denial of Service due to number length bypass in asynchronous JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18401" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59888", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41417", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.1.133.Final, 4.2.13.Final", "title": "netty: Netty: HTTP request smuggling via URI manipulation and CRLF injection", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41417" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42580", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: Netty: Request smuggling via chunk size parser integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42580" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42581", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42581" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42585", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42585" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50020", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http: Netty: Data manipulation via request-boundary confusion in HttpObjectDecoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50020" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56746", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56746" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59898", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59898" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59899", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59899" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59903", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59903" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59921", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59921" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47244", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47244" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-48043", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.1.135.Final, 4.2.15.Final", "title": "netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-48043" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50560", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http2: Netty: Denial of Service due to HTTP/2 max header size handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50560" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59900", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59900" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75596", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "Netty is an asynchronous, event-driven network application framework. ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75596" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-102633", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.9.0-r0", "title": "expat: expat: Denial of Service via integer overflow in expat_realloc", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102633" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50219", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50219" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56131", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56131" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56132", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56132" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56403", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution due to integer overflow in storeAtts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56403" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56404", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary Code Execution via integer overflow in addBinding", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56404" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56405", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Information disclosure and arbitrary code execution via integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56405" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56406", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution via integer overflow in XML_ParseBuffer", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56406" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56407", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution due to integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56407" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56408", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Information disclosure and arbitrary code execution via integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56408" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56409", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Integer overflow in xmlwf may lead to information disclosure or arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56409" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56410", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Integer overflow in xmlwf can lead to information disclosure and arbitrary code execution.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56410" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56411", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Integer Overflow Vulnerability Leading to Information Disclosure or Code Execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56411" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56412", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Use-after-free vulnerability due to improper handling of XML CDATA sections", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56412" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-46675", "package": "libpng", "installed_version": "1.6.58-r1", "fixed_version": "1.6.59-r0", "title": "libpng: libpng: Use-after-free in sequential reader when png_read_end called without reading image rows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-46675" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-48924", "package": "org.apache.commons:commons-lang3", "installed_version": "3.17.0", "fixed_version": "3.18.0", "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48924" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49844", "package": "org.apache.logging.log4j:log4j-api", "installed_version": "2.24.3", "fixed_version": "2.25.5, 2.26.1", "title": "org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-25854", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.116, 10.1.53, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-25854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-32990", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.116, 10.1.53, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-32990" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-71497", "package": "org.jsoup:jsoup", "installed_version": "1.21.2", "fixed_version": "1.23.1", "title": "org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-71497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41001", "package": "org.springframework.boot:spring-boot-autoconfigure", "installed_version": "3.5.9", "fixed_version": "4.0.7, 3.5.15", "title": "spring-boot: Spring Boot: Local attacker can manipulate data directory due to predictable path", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41001" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41711", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.7", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via parsing Sort parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41711" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41721", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.7", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via specially crafted HTTP request with @ProjectedPayload", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41721" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41710", "package": "org.springframework.retry:spring-retry", "installed_version": "2.0.12", "fixed_version": "2.0.13", "title": "spring-retry: Spring Retry: Denial of Service via cache exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22751", "package": "org.springframework.security:spring-security-core", "installed_version": "6.5.7", "fixed_version": "6.5.10, 7.0.5", "title": "Spring Security: JdbcOneTimeTokenService: Spring Security: Authentication bypass due to race condition in One-Time Token login", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22751" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41706", "package": "org.springframework.security:spring-security-web", "installed_version": "6.5.7", "fixed_version": "7.0.6, 6.5.11", "title": "Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41706" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47838", "package": "org.springframework.security:spring-security-web", "installed_version": "6.5.7", "fixed_version": "6.5.11", "title": "Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47838" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41851", "package": "org.springframework:spring-expression", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Denial of Service via unbounded cache growth in SpEL evaluation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41851" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41854", "package": "org.springframework:spring-web", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Server-Side Request Forgery via incorrect host parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22737", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.6, 6.2.17", "title": "Spring Framework: Spring Framework: Information disclosure via Java scripting engine enabled template views", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22737" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22745", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.7, 6.2.18", "title": "spring-webflux: Spring MVC and Spring WebFlux: Denial of Service via slow static resource resolution on Windows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41841", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring MVC and WebFlux applications: Information Disclosure via static resource resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41841" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41843", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "spring-webflux: spring-webmvc: Spring Framework: Information Disclosure via Path Traversal", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41843" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41844", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Open Redirect via crafted link", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41846", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Cross-site scripting (XSS) via user-supplied values in JSP form tags", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41846" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41853", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Request smuggling vulnerability in Spring MVC and WebFlux", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41853" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-85091", "package": "zlib", "installed_version": "1.3.2-r0", "fixed_version": "1.3.2-r1", "title": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vul ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-85091" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-10532", "package": "ch.qos.logback:logback-core", "installed_version": "1.5.22", "fixed_version": "1.5.34", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-10532" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-1225", "package": "ch.qos.logback:logback-core", "installed_version": "1.5.22", "fixed_version": "1.5.25", "title": "ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-1225" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-9828", "package": "ch.qos.logback:logback-core", "installed_version": "1.5.22", "fixed_version": "1.5.33", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9828" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-43514", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22746", "package": "org.springframework.security:spring-security-core", "installed_version": "6.5.7", "fixed_version": "6.5.10, 7.0.5", "title": "Spring Security: Spring Security: Timing attack defense bypass allows information disclosure", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22746" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41848", "package": "org.springframework:spring-core", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Regular Expression Denial of Service in AntPathMatcher", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41848" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41852", "package": "org.springframework:spring-expression", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: org.springframework/spring-expression: Spring Framework: SpEL vulnerability allows unintended application logic invocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41852" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22735", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.6, 6.2.17", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring MVC and WebFlux: Stream corruption vulnerability when using Server-Sent Events", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22735" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22741", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.7, 6.2.18", "title": "Spring MVC: Spring WebFlux: Spring MVC and Spring WebFlux: Denial of Service via cache poisoning", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-107891", "package": "musl", "installed_version": "1.2.5-r23", "fixed_version": "1.2.5-r24", "title": "Title Not Available", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-107891" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.1.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-107891", "package": "musl-utils", "installed_version": "1.2.5-r23", "fixed_version": "1.2.5-r24", "title": "Title Not Available", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-107891" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1", "vulnerability_count": 171, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-111497", "package": "brotli-libs", "installed_version": "1.2.0-r0", "fixed_version": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-22732", "package": "org.springframework.security:spring-security-web", "installed_version": "6.5.7", "fixed_version": "6.5.9, 7.0.4", "title": "Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22732" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.4", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.4", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.4", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "33.5.0-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40983", "package": "io.micrometer:micrometer-core", "installed_version": "1.15.7", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40983" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.15.7", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42583", "package": "io.netty:netty-codec", "installed_version": "4.1.130.Final", "fixed_version": "4.1.133.Final", "title": "netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42583" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-59901", "package": "io.netty:netty-codec", "installed_version": "4.1.130.Final", "fixed_version": "4.1.136.Final", "title": "io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-33870", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.1.132.Final, 4.2.10.Final", "title": "io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33870" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42584", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42584" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42587", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42587" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55831", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55831" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55833", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55833" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56745", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-33871", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.1.132.Final, 4.2.11.Final", "title": "netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33871" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42587", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42587" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56819", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56819" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-44249", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-44249" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-45416", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45416" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-50010", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50010" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-66046", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "expat: Expat: Denial of Service via quadratic complexity in attribute processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-66046" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76641", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "expat: Expat: Denial of Service via XML external entity parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76641" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76956", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "libexpat: libexpat: Denial of Service via hash flooding attack with crafted XML", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76956" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76957", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76957" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-77214", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.9.0-r0", "title": "expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77214" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-93990", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.5-r0", "title": "expat: Expat: XML Injection via Malformed UTF-16 Input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-93990" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24734", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "11.0.18, 10.1.52, 9.0.115", "title": "tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24880", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.116, 10.1.52, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24880" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34483", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.116, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34483" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34487", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.117, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34487" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41284", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41284" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42498", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42498" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-43513", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-75140", "package": "org.jsoup:jsoup", "installed_version": "1.21.2", "fixed_version": "1.23.2", "title": "org.jsoup/jsoup: jsoup: Denial of Service via deeply nested XML documents", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75140" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42198", "package": "org.postgresql:postgresql", "installed_version": "42.7.8", "fixed_version": "42.7.11", "title": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42198" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54291", "package": "org.postgresql:postgresql", "installed_version": "42.7.8", "fixed_version": "42.7.12", "title": "org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54291" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40973", "package": "org.springframework.boot:spring-boot", "installed_version": "3.5.9", "fixed_version": "4.0.6, 3.5.14", "title": "Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40973" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41695", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.7", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via crafted property path strings", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41695" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41716", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.7", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service due to cache exhaustion via attacker-supplied strings", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41716" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40999", "package": "org.springframework.ws:spring-ws-core", "installed_version": "4.1.2", "fixed_version": "5.0.2, 4.1.4", "title": "Spring Web Services: SSRF via unvalidated WS-Addressing reply destinations", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40999" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40998", "package": "org.springframework.ws:spring-xml", "installed_version": "4.1.2", "fixed_version": "5.0.2, 4.1.4", "title": "org.springframework.ws/spring-xml: Spring Web Services: XML External Entity (XXE) attack via untrusted XML payloads", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40998" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41850", "package": "org.springframework:spring-expression", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service via specially crafted SpEL expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41850" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41842", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service when resolving static resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41842" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41845", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "org.springframework: Spring Framework: Cross-site scripting (XSS) via incorrect JavaScript escaping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41845" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-2100", "package": "p11-kit", "installed_version": "0.25.5-r2", "fixed_version": "0.26.2-r0", "title": "p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2100" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-2100", "package": "p11-kit-trust", "installed_version": "0.25.5-r2", "fixed_version": "0.26.2-r0", "title": "p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2100" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11822", "package": "sqlite-libs", "installed_version": "3.51.2-r0", "fixed_version": "3.53.4-r0", "title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11822" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11824", "package": "sqlite-libs", "installed_version": "3.51.2-r0", "fixed_version": "3.53.4-r0", "title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11824" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18401", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.4", "fixed_version": "2.21.1, 2.18.6", "title": "tools.jackson.core/jackson-core: com.fasterxml.jackson.core/jackson-core: jackson-core: Denial of Service due to number length bypass in asynchronous JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18401" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59888", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41417", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.1.133.Final, 4.2.13.Final", "title": "netty: Netty: HTTP request smuggling via URI manipulation and CRLF injection", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41417" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42580", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: Netty: Request smuggling via chunk size parser integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42580" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42581", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42581" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42585", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42585" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50020", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http: Netty: Data manipulation via request-boundary confusion in HttpObjectDecoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50020" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56746", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56746" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59898", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59898" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59899", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59899" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59903", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59903" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59921", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59921" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47244", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47244" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-48043", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.1.135.Final, 4.2.15.Final", "title": "netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-48043" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50560", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http2: Netty: Denial of Service due to HTTP/2 max header size handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50560" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59900", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59900" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75596", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "Netty is an asynchronous, event-driven network application framework. ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75596" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-102633", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.9.0-r0", "title": "expat: expat: Denial of Service via integer overflow in expat_realloc", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102633" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50219", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50219" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56131", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56131" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56132", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56132" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56403", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution due to integer overflow in storeAtts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56403" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56404", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary Code Execution via integer overflow in addBinding", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56404" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56405", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Information disclosure and arbitrary code execution via integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56405" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56406", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution via integer overflow in XML_ParseBuffer", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56406" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56407", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution due to integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56407" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56408", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Information disclosure and arbitrary code execution via integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56408" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56409", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Integer overflow in xmlwf may lead to information disclosure or arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56409" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56410", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Integer overflow in xmlwf can lead to information disclosure and arbitrary code execution.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56410" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56411", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Integer Overflow Vulnerability Leading to Information Disclosure or Code Execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56411" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56412", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Use-after-free vulnerability due to improper handling of XML CDATA sections", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56412" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-46675", "package": "libpng", "installed_version": "1.6.58-r1", "fixed_version": "1.6.59-r0", "title": "libpng: libpng: Use-after-free in sequential reader when png_read_end called without reading image rows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-46675" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-48924", "package": "org.apache.commons:commons-lang3", "installed_version": "3.17.0", "fixed_version": "3.18.0", "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48924" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49844", "package": "org.apache.logging.log4j:log4j-api", "installed_version": "2.24.3", "fixed_version": "2.25.5, 2.26.1", "title": "org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-25854", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.116, 10.1.53, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-25854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-32990", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.116, 10.1.53, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-32990" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-71497", "package": "org.jsoup:jsoup", "installed_version": "1.21.2", "fixed_version": "1.23.1", "title": "org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-71497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41001", "package": "org.springframework.boot:spring-boot-autoconfigure", "installed_version": "3.5.9", "fixed_version": "4.0.7, 3.5.15", "title": "spring-boot: Spring Boot: Local attacker can manipulate data directory due to predictable path", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41001" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41711", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.7", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via parsing Sort parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41711" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41721", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.7", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via specially crafted HTTP request with @ProjectedPayload", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41721" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41710", "package": "org.springframework.retry:spring-retry", "installed_version": "2.0.12", "fixed_version": "2.0.13", "title": "spring-retry: Spring Retry: Denial of Service via cache exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22751", "package": "org.springframework.security:spring-security-core", "installed_version": "6.5.7", "fixed_version": "6.5.10, 7.0.5", "title": "Spring Security: JdbcOneTimeTokenService: Spring Security: Authentication bypass due to race condition in One-Time Token login", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22751" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41706", "package": "org.springframework.security:spring-security-web", "installed_version": "6.5.7", "fixed_version": "7.0.6, 6.5.11", "title": "Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41706" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47838", "package": "org.springframework.security:spring-security-web", "installed_version": "6.5.7", "fixed_version": "6.5.11", "title": "Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47838" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41851", "package": "org.springframework:spring-expression", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Denial of Service via unbounded cache growth in SpEL evaluation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41851" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41854", "package": "org.springframework:spring-web", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Server-Side Request Forgery via incorrect host parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22737", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.6, 6.2.17", "title": "Spring Framework: Spring Framework: Information disclosure via Java scripting engine enabled template views", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22737" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22745", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.7, 6.2.18", "title": "spring-webflux: Spring MVC and Spring WebFlux: Denial of Service via slow static resource resolution on Windows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41841", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring MVC and WebFlux applications: Information Disclosure via static resource resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41841" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41843", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "spring-webflux: spring-webmvc: Spring Framework: Information Disclosure via Path Traversal", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41843" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41844", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Open Redirect via crafted link", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41846", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Cross-site scripting (XSS) via user-supplied values in JSP form tags", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41846" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41853", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Request smuggling vulnerability in Spring MVC and WebFlux", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41853" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-85091", "package": "zlib", "installed_version": "1.3.2-r0", "fixed_version": "1.3.2-r1", "title": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vul ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-85091" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-10532", "package": "ch.qos.logback:logback-core", "installed_version": "1.5.22", "fixed_version": "1.5.34", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-10532" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-1225", "package": "ch.qos.logback:logback-core", "installed_version": "1.5.22", "fixed_version": "1.5.25", "title": "ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-1225" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-9828", "package": "ch.qos.logback:logback-core", "installed_version": "1.5.22", "fixed_version": "1.5.33", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9828" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-43514", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22746", "package": "org.springframework.security:spring-security-core", "installed_version": "6.5.7", "fixed_version": "6.5.10, 7.0.5", "title": "Spring Security: Spring Security: Timing attack defense bypass allows information disclosure", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22746" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41848", "package": "org.springframework:spring-core", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Regular Expression Denial of Service in AntPathMatcher", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41848" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41852", "package": "org.springframework:spring-expression", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: org.springframework/spring-expression: Spring Framework: SpEL vulnerability allows unintended application logic invocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41852" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22735", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.6, 6.2.17", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring MVC and WebFlux: Stream corruption vulnerability when using Server-Sent Events", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22735" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22741", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.7, 6.2.18", "title": "Spring MVC: Spring WebFlux: Spring MVC and Spring WebFlux: Denial of Service via cache poisoning", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-107891", "package": "musl", "installed_version": "1.2.5-r23", "fixed_version": "1.2.5-r24", "title": "Title Not Available", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-107891" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.1 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-107891", "package": "musl-utils", "installed_version": "1.2.5-r23", "fixed_version": "1.2.5-r24", "title": "Title Not Available", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-107891" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0", "vulnerability_count": 171, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-111497", "package": "brotli-libs", "installed_version": "1.2.0-r0", "fixed_version": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-22732", "package": "org.springframework.security:spring-security-web", "installed_version": "6.5.7", "fixed_version": "6.5.9, 7.0.4", "title": "Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22732" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.4", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.4", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.4", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "33.5.0-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40983", "package": "io.micrometer:micrometer-core", "installed_version": "1.15.7", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40983" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.15.7", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42583", "package": "io.netty:netty-codec", "installed_version": "4.1.130.Final", "fixed_version": "4.1.133.Final", "title": "netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42583" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-59901", "package": "io.netty:netty-codec", "installed_version": "4.1.130.Final", "fixed_version": "4.1.136.Final", "title": "io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-33870", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.1.132.Final, 4.2.10.Final", "title": "io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33870" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42584", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42584" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42587", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42587" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55831", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55831" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55833", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55833" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56745", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-33871", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.1.132.Final, 4.2.11.Final", "title": "netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33871" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42587", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42587" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56819", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56819" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-44249", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-44249" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-45416", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45416" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-50010", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50010" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-66046", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "expat: Expat: Denial of Service via quadratic complexity in attribute processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-66046" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76641", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "expat: Expat: Denial of Service via XML external entity parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76641" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76956", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "libexpat: libexpat: Denial of Service via hash flooding attack with crafted XML", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76956" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76957", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.4-r0", "title": "libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76957" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-77214", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.9.0-r0", "title": "expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77214" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-93990", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.5-r0", "title": "expat: Expat: XML Injection via Malformed UTF-16 Input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-93990" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24734", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "11.0.18, 10.1.52, 9.0.115", "title": "tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24880", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.116, 10.1.52, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24880" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34483", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.116, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34483" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34487", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.117, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34487" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41284", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41284" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42498", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42498" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-43513", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-75140", "package": "org.jsoup:jsoup", "installed_version": "1.21.2", "fixed_version": "1.23.2", "title": "org.jsoup/jsoup: jsoup: Denial of Service via deeply nested XML documents", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75140" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42198", "package": "org.postgresql:postgresql", "installed_version": "42.7.8", "fixed_version": "42.7.11", "title": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42198" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54291", "package": "org.postgresql:postgresql", "installed_version": "42.7.8", "fixed_version": "42.7.12", "title": "org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54291" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40973", "package": "org.springframework.boot:spring-boot", "installed_version": "3.5.9", "fixed_version": "4.0.6, 3.5.14", "title": "Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40973" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41695", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.7", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via crafted property path strings", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41695" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41716", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.7", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service due to cache exhaustion via attacker-supplied strings", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41716" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40999", "package": "org.springframework.ws:spring-ws-core", "installed_version": "4.1.2", "fixed_version": "5.0.2, 4.1.4", "title": "Spring Web Services: SSRF via unvalidated WS-Addressing reply destinations", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40999" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40998", "package": "org.springframework.ws:spring-xml", "installed_version": "4.1.2", "fixed_version": "5.0.2, 4.1.4", "title": "org.springframework.ws/spring-xml: Spring Web Services: XML External Entity (XXE) attack via untrusted XML payloads", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40998" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41850", "package": "org.springframework:spring-expression", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service via specially crafted SpEL expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41850" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41842", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service when resolving static resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41842" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41845", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "org.springframework: Spring Framework: Cross-site scripting (XSS) via incorrect JavaScript escaping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41845" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-2100", "package": "p11-kit", "installed_version": "0.25.5-r2", "fixed_version": "0.26.2-r0", "title": "p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2100" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-2100", "package": "p11-kit-trust", "installed_version": "0.25.5-r2", "fixed_version": "0.26.2-r0", "title": "p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2100" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11822", "package": "sqlite-libs", "installed_version": "3.51.2-r0", "fixed_version": "3.53.4-r0", "title": "sqlite: SQLite: Arbitrary code execution via crafted FTS5 full-text search data", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11822" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-11824", "package": "sqlite-libs", "installed_version": "3.51.2-r0", "fixed_version": "3.53.4-r0", "title": "sqlite: SQLite: Arbitrary code execution and crash via heap-based buffer overflow in FTS5", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-11824" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18401", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.4", "fixed_version": "2.21.1, 2.18.6", "title": "tools.jackson.core/jackson-core: com.fasterxml.jackson.core/jackson-core: jackson-core: Denial of Service due to number length bypass in asynchronous JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18401" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59888", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.4", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41417", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.1.133.Final, 4.2.13.Final", "title": "netty: Netty: HTTP request smuggling via URI manipulation and CRLF injection", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41417" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42580", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: Netty: Request smuggling via chunk size parser integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42580" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42581", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42581" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42585", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42585" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50020", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http: Netty: Data manipulation via request-boundary confusion in HttpObjectDecoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50020" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56746", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56746" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59898", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59898" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59899", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59899" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59903", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59903" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59921", "package": "io.netty:netty-codec-http", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59921" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47244", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47244" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-48043", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.1.135.Final, 4.2.15.Final", "title": "netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-48043" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50560", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http2: Netty: Denial of Service due to HTTP/2 max header size handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50560" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59900", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.130.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59900" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75596", "package": "io.netty:netty-handler", "installed_version": "4.1.130.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "Netty is an asynchronous, event-driven network application framework. ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75596" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-102633", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.9.0-r0", "title": "expat: expat: Denial of Service via integer overflow in expat_realloc", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102633" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50219", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50219" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56131", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56131" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56132", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56132" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56403", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution due to integer overflow in storeAtts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56403" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56404", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary Code Execution via integer overflow in addBinding", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56404" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56405", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Information disclosure and arbitrary code execution via integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56405" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56406", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution via integer overflow in XML_ParseBuffer", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56406" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56407", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution due to integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56407" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56408", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Information disclosure and arbitrary code execution via integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56408" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56409", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Integer overflow in xmlwf may lead to information disclosure or arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56409" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56410", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Integer overflow in xmlwf can lead to information disclosure and arbitrary code execution.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56410" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56411", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Integer Overflow Vulnerability Leading to Information Disclosure or Code Execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56411" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56412", "package": "libexpat", "installed_version": "2.8.1-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Use-after-free vulnerability due to improper handling of XML CDATA sections", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56412" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-46675", "package": "libpng", "installed_version": "1.6.58-r1", "fixed_version": "1.6.59-r0", "title": "libpng: libpng: Use-after-free in sequential reader when png_read_end called without reading image rows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-46675" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-48924", "package": "org.apache.commons:commons-lang3", "installed_version": "3.17.0", "fixed_version": "3.18.0", "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48924" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49844", "package": "org.apache.logging.log4j:log4j-api", "installed_version": "2.24.3", "fixed_version": "2.25.5, 2.26.1", "title": "org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-25854", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.116, 10.1.53, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-25854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-32990", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.116, 10.1.53, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: Improper Input Validation vulnerability due to incomplete fix", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-32990" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-71497", "package": "org.jsoup:jsoup", "installed_version": "1.21.2", "fixed_version": "1.23.1", "title": "org.jsoup/jsoup: jsoup: Cross-site scripting via malformed HTML tag names", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-71497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41001", "package": "org.springframework.boot:spring-boot-autoconfigure", "installed_version": "3.5.9", "fixed_version": "4.0.7, 3.5.15", "title": "spring-boot: Spring Boot: Local attacker can manipulate data directory due to predictable path", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41001" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41711", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.7", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via parsing Sort parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41711" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41721", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.7", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via specially crafted HTTP request with @ProjectedPayload", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41721" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41710", "package": "org.springframework.retry:spring-retry", "installed_version": "2.0.12", "fixed_version": "2.0.13", "title": "spring-retry: Spring Retry: Denial of Service via cache exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22751", "package": "org.springframework.security:spring-security-core", "installed_version": "6.5.7", "fixed_version": "6.5.10, 7.0.5", "title": "Spring Security: JdbcOneTimeTokenService: Spring Security: Authentication bypass due to race condition in One-Time Token login", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22751" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41706", "package": "org.springframework.security:spring-security-web", "installed_version": "6.5.7", "fixed_version": "7.0.6, 6.5.11", "title": "Spring Security: Open Redirect via Unvalidated Post-Login Redirect URL Stored in CookieRequestCache", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41706" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47838", "package": "org.springframework.security:spring-security-web", "installed_version": "6.5.7", "fixed_version": "6.5.11", "title": "Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47838" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41851", "package": "org.springframework:spring-expression", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Denial of Service via unbounded cache growth in SpEL evaluation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41851" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41854", "package": "org.springframework:spring-web", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Server-Side Request Forgery via incorrect host parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22737", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.6, 6.2.17", "title": "Spring Framework: Spring Framework: Information disclosure via Java scripting engine enabled template views", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22737" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22745", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.7, 6.2.18", "title": "spring-webflux: Spring MVC and Spring WebFlux: Denial of Service via slow static resource resolution on Windows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41841", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring MVC and WebFlux applications: Information Disclosure via static resource resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41841" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41843", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "spring-webflux: spring-webmvc: Spring Framework: Information Disclosure via Path Traversal", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41843" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41844", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Open Redirect via crafted link", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41846", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Cross-site scripting (XSS) via user-supplied values in JSP form tags", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41846" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41853", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Request smuggling vulnerability in Spring MVC and WebFlux", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41853" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-85091", "package": "zlib", "installed_version": "1.3.2-r0", "fixed_version": "1.3.2-r1", "title": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vul ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-85091" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-10532", "package": "ch.qos.logback:logback-core", "installed_version": "1.5.22", "fixed_version": "1.5.34", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-10532" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-1225", "package": "ch.qos.logback:logback-core", "installed_version": "1.5.22", "fixed_version": "1.5.25", "title": "ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-1225" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-9828", "package": "ch.qos.logback:logback-core", "installed_version": "1.5.22", "fixed_version": "1.5.33", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9828" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "openssl", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-43514", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.50", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22746", "package": "org.springframework.security:spring-security-core", "installed_version": "6.5.7", "fixed_version": "6.5.10, 7.0.5", "title": "Spring Security: Spring Security: Timing attack defense bypass allows information disclosure", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22746" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41848", "package": "org.springframework:spring-core", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Regular Expression Denial of Service in AntPathMatcher", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41848" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41852", "package": "org.springframework:spring-expression", "installed_version": "6.2.15", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: org.springframework/spring-expression: Spring Framework: SpEL vulnerability allows unintended application logic invocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41852" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22735", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.6, 6.2.17", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring MVC and WebFlux: Stream corruption vulnerability when using Server-Sent Events", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22735" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22741", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.15", "fixed_version": "7.0.7, 6.2.18", "title": "Spring MVC: Spring WebFlux: Spring MVC and Spring WebFlux: Denial of Service via cache poisoning", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-107891", "package": "musl", "installed_version": "1.2.5-r23", "fixed_version": "1.2.5-r24", "title": "Title Not Available", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-107891" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:25.0.0 (alpine 3.23.5)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-107891", "package": "musl-utils", "installed_version": "1.2.5-r23", "fixed_version": "1.2.5-r24", "title": "Title Not Available", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-107891" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0", "vulnerability_count": 342, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-111497", "package": "brotli-libs", "installed_version": "1.1.0-r2", "fixed_version": "1.1.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-33845", "package": "gnutls", "installed_version": "3.8.8-r0", "fixed_version": "3.8.13-r0", "title": "gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33845" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-42010", "package": "gnutls", "installed_version": "3.8.8-r0", "fixed_version": "3.8.13-r0", "title": "gnutls: gnutls: Authentication Bypass via NUL Character in Username", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42010" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-31789", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-31789", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-31789", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2025-24813", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "11.0.3, 10.1.35, 9.0.99", "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-24813" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2025-41232", "package": "org.springframework.security:spring-security-core", "installed_version": "6.4.2", "fixed_version": "6.4.6", "title": "Spring-Security: Spring Security authorization bypass for method security annotations on private methods", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41232" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-22732", "package": "org.springframework.security:spring-security-web", "installed_version": "6.4.2", "fixed_version": "6.5.9, 7.0.4", "title": "Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22732" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.2", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.2", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.3.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2025-3277", "package": "sqlite-libs", "installed_version": "3.48.0-r0", "fixed_version": "3.48.0-r1", "title": "SQLite: integer overflow in SQLite", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-3277" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.18.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.18.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.18.2", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.18.2", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.18.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.18.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.18.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.18.2", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "33.3.1-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48734", "package": "commons-beanutils:commons-beanutils", "installed_version": "1.9.4", "fixed_version": "1.11.0", "title": "commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48976", "package": "commons-fileupload:commons-fileupload", "installed_version": "1.5", "fixed_version": "1.6.0", "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48976" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-68973", "package": "gnupg", "installed_version": "2.4.7-r0", "fixed_version": "2.4.9-r0", "title": "GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68973" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-68973", "package": "gnupg-dirmngr", "installed_version": "2.4.7-r0", "fixed_version": "2.4.9-r0", "title": "GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68973" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-68973", "package": "gnupg-gpgconf", "installed_version": "2.4.7-r0", "fixed_version": "2.4.9-r0", "title": "GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68973" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-68973", "package": "gnupg-keyboxd", "installed_version": "2.4.7-r0", "fixed_version": "2.4.9-r0", "title": "GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68973" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-68973", "package": "gnupg-utils", "installed_version": "2.4.7-r0", "fixed_version": "2.4.9-r0", "title": "GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68973" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-68973", "package": "gnupg-wks-client", "installed_version": "2.4.7-r0", "fixed_version": "2.4.9-r0", "title": "GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68973" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-32988", "package": "gnutls", "installed_version": "3.8.8-r0", "fixed_version": "3.8.12-r0", "title": "gnutls: Vulnerability in GnuTLS otherName SAN export", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-32988" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-32990", "package": "gnutls", "installed_version": "3.8.8-r0", "fixed_version": "3.8.12-r0", "title": "gnutls: Vulnerability in GnuTLS certtool template parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-32990" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-1584", "package": "gnutls", "installed_version": "3.8.8-r0", "fixed_version": "3.8.12-r0", "title": "gnutls: gnutls: Remote Denial of Service via crafted ClientHello with invalid PSK binder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-1584" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-33846", "package": "gnutls", "installed_version": "3.8.8-r0", "fixed_version": "3.8.13-r0", "title": "gnutls: GnuTLS: Denial of Service via heap buffer overflow in DTLS handshake fragment reassembly", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33846" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-3833", "package": "gnutls", "installed_version": "3.8.8-r0", "fixed_version": "3.8.13-r0", "title": "gnutls: GnuTLS: Policy bypass due to case-sensitive nameConstraints comparison", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-3833" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-42009", "package": "gnutls", "installed_version": "3.8.8-r0", "fixed_version": "3.8.13-r0", "title": "gnutls: gnutls: Denial of Service via DTLS packet reordering vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42009" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-68973", "package": "gpg", "installed_version": "2.4.7-r0", "fixed_version": "2.4.9-r0", "title": "GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68973" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-68973", "package": "gpg-agent", "installed_version": "2.4.7-r0", "fixed_version": "2.4.9-r0", "title": "GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68973" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-68973", "package": "gpg-wks-server", "installed_version": "2.4.7-r0", "fixed_version": "2.4.9-r0", "title": "GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68973" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-68973", "package": "gpgsm", "installed_version": "2.4.7-r0", "fixed_version": "2.4.9-r0", "title": "GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68973" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-68973", "package": "gpgv", "installed_version": "2.4.7-r0", "fixed_version": "2.4.9-r0", "title": "GnuPG: GnuPG: Information disclosure and potential arbitrary code execution via out-of-bounds write", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68973" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.14.3", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-15467", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-15467" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-69421", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-69421" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-28387", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r0", "title": "openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-28387" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-28388", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r0", "title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-28388" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-28389", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r0", "title": "openssl: OpenSSL: Denial of Service vulnerability in CMS processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-28389" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-28390", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r0", "title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-28390" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-45447", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45447" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-84782", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84782" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-59375", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.7.2-r0", "title": "firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-59375" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-25210", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.7.4-r0", "title": "libexpat: libexpat: Information disclosure and data integrity issues due to integer overflow in buffer reallocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-25210" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-45186", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.8.1-r0", "title": "libexpat: denial of service via crafted XML input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45186" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-66046", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.8.4-r0", "title": "expat: Expat: Denial of Service via quadratic complexity in attribute processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-66046" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76641", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.8.4-r0", "title": "expat: Expat: Denial of Service via XML external entity parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76641" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76956", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.8.4-r0", "title": "libexpat: libexpat: Denial of Service via hash flooding attack with crafted XML", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76956" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-76957", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.8.4-r0", "title": "libexpat: libexpat: Memory corruption vulnerability allows arbitrary code execution or denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-76957" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-77214", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.9.0-r0", "title": "expat: expat: Information disclosure via heap buffer over-read in XML_ParseBuffer", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77214" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-93990", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.8.5-r0", "title": "expat: Expat: XML Injection via Malformed UTF-16 Input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-93990" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-64720", "package": "libpng", "installed_version": "1.6.44-r0", "fixed_version": "1.6.53-r0", "title": "libpng: LIBPNG buffer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-64720" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-65018", "package": "libpng", "installed_version": "1.6.44-r0", "fixed_version": "1.6.53-r0", "title": "libpng: LIBPNG heap buffer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-65018" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-66293", "package": "libpng", "installed_version": "1.6.44-r0", "fixed_version": "1.6.53-r0", "title": "libpng: LIBPNG out-of-bounds read in png_image_read_composite", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-66293" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-22695", "package": "libpng", "installed_version": "1.6.44-r0", "fixed_version": "1.6.54-r0", "title": "libpng: libpng: Denial of service and information disclosure via heap buffer over-read in png_image_finish_read", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22695" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-22801", "package": "libpng", "installed_version": "1.6.44-r0", "fixed_version": "1.6.54-r0", "title": "libpng: libpng: Information disclosure and denial of service via integer truncation in simplified write API", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22801" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-25646", "package": "libpng", "installed_version": "1.6.44-r0", "fixed_version": "1.6.55-r0", "title": "libpng: LIBPNG has a heap buffer overflow in png_set_quantize", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-25646" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-15467", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-15467" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-69421", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-69421" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-28387", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r0", "title": "openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-28387" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-28388", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r0", "title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-28388" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-28389", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r0", "title": "openssl: OpenSSL: Denial of Service vulnerability in CMS processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-28389" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-28390", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r0", "title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-28390" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-45447", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45447" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-84782", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84782" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-40200", "package": "musl", "installed_version": "1.2.5-r9", "fixed_version": "1.2.5-r11", "title": "musl: musl libc: Arbitrary code execution and denial of service via stack-based memory corruption in qsort", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40200" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-40200", "package": "musl-utils", "installed_version": "1.2.5-r9", "fixed_version": "1.2.5-r11", "title": "musl: musl libc: Arbitrary code execution and denial of service via stack-based memory corruption in qsort", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40200" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-15467", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-15467" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-69421", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-69421" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-28387", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r0", "title": "openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-28387" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-28388", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r0", "title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-28388" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-28389", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r0", "title": "openssl: OpenSSL: Denial of Service vulnerability in CMS processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-28389" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-28390", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r0", "title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-28390" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-45447", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45447" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-84782", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: compat-openssl: openssl: Information disclosure via DTLS handshake retransmission", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84782" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48988", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "tomcat: Apache Tomcat DoS in multipart upload", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48988" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48989", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "11.0.10, 10.1.44, 9.0.108", "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48989" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-52520", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "11.0.9, 10.1.43, 9.0.107", "title": "tomcat: Apache Tomcat denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-52520" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-53506", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "9.0.107, 10.1.43, 11.0.9", "title": "tomcat: Apache Tomcat denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-53506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-55752", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "11.0.11, 10.1.45, 9.0.109", "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55752" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24734", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "11.0.18, 10.1.52, 9.0.115", "title": "tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24880", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "9.0.116, 10.1.52, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24880" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34483", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "9.0.116, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34483" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34487", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "9.0.117, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34487" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41284", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41284" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42498", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42498" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-43513", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2022-45688", "package": "org.json:json", "installed_version": "20170516", "fixed_version": "20230227", "title": "json stack overflow vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-45688" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-5072", "package": "org.json:json", "installed_version": "20170516", "fixed_version": "20231013", "title": "JSON-java: parser confusion leads to OOM", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5072" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-49146", "package": "org.postgresql:postgresql", "installed_version": "42.7.5", "fixed_version": "42.7.7", "title": "pgjdbc: pgjdbc insecure authentication in channel binding", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49146" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42198", "package": "org.postgresql:postgresql", "installed_version": "42.7.5", "fixed_version": "42.7.11", "title": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42198" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54291", "package": "org.postgresql:postgresql", "installed_version": "42.7.5", "fixed_version": "42.7.12", "title": "org.postgresql/postgresql: com.ongres.scram/scram-client: pgjdbc: Man-in-the-middle protection bypass via SCRAM-SHA-256-PLUS downgrade", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54291" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-22235", "package": "org.springframework.boot:spring-boot", "installed_version": "3.4.2", "fixed_version": "3.3.11, 3.4.5", "title": "org.springframework.boot/spring-boot: Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22235" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40973", "package": "org.springframework.boot:spring-boot", "installed_version": "3.4.2", "fixed_version": "4.0.6, 3.5.14", "title": "Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40973" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41695", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.4.2", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via crafted property path strings", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41695" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41716", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.4.2", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service due to cache exhaustion via attacker-supplied strings", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41716" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-41248", "package": "org.springframework.security:spring-security-core", "installed_version": "6.4.2", "fixed_version": "6.4.10, 6.5.4", "title": "org.springframework.security/spring-security-core: Spring Security authorization bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41248" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-22228", "package": "org.springframework.security:spring-security-crypto", "installed_version": "6.4.2", "fixed_version": "6.3.8, 6.4.4, 6.2.10, 6.1.14, 6.0.16, 5.8.18, 5.7.16", "title": "spring-security-core: Spring Security BCryptPasswordEncoder does not enforce maximum password length", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22228" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-41249", "package": "org.springframework:spring-core", "installed_version": "6.2.2", "fixed_version": "6.2.11", "title": "org.springframework/spring-core: Spring Framework Annotation Detection Vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41249" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41850", "package": "org.springframework:spring-expression", "installed_version": "6.2.2", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service via specially crafted SpEL expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41850" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41842", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.2", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service when resolving static resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41842" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41845", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.2", "fixed_version": "7.0.8, 6.2.19", "title": "org.springframework: Spring Framework: Cross-site scripting (XSS) via incorrect JavaScript escaping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41845" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-2100", "package": "p11-kit", "installed_version": "0.25.5-r2", "fixed_version": "0.26.2-r0", "title": "p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2100" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-2100", "package": "p11-kit-trust", "installed_version": "0.25.5-r2", "fixed_version": "0.26.2-r0", "title": "p11-kit: NULL dereference via C_DeriveKey with specific NULL parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2100" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-29087", "package": "sqlite-libs", "installed_version": "3.48.0-r0", "fixed_version": "3.48.0-r1", "title": "sqlite: Integer Overflow in SQLite concat_ws Function", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-29087" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-6965", "package": "sqlite-libs", "installed_version": "3.48.0-r0", "fixed_version": "3.48.0-r3", "title": "sqlite: Integer Truncation in SQLite", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-6965" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-22184", "package": "zlib", "installed_version": "1.3.1-r2", "fixed_version": "1.3.2-r0", "title": "zlib: zlib: Arbitrary code execution via buffer overflow in untgz utility", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22184" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-58251", "package": "busybox", "installed_version": "1.37.0-r12", "fixed_version": "1.37.0-r14", "title": "In netstat in BusyBox through 1.37.0, local users can launch of networ ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-58251" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-58251", "package": "busybox-binsh", "installed_version": "1.37.0-r12", "fixed_version": "1.37.0-r14", "title": "In netstat in BusyBox through 1.37.0, local users can launch of networ ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-58251" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-11226", "package": "ch.qos.logback:logback-core", "installed_version": "1.5.16", "fixed_version": "1.5.19, 1.3.16", "title": "ch.qos.logback/logback-core: Conditional abitrary code execution in logback-core", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-11226" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18401", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.18.2", "fixed_version": "2.21.1, 2.18.6", "title": "tools.jackson.core/jackson-core: com.fasterxml.jackson.core/jackson-core: jackson-core: Denial of Service due to number length bypass in asynchronous JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18401" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.18.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.18.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.18.2", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59888", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.18.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.18.2", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.18.2", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.18.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "GHSA-mhm7-754m-9p8w", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.18.2", "fixed_version": "2.18.9, 2.21.5", "title": "jackson-databind: `@JsonView` bypass for creator properties with `@JsonTypeInfo(include=As.EXTERNAL_PROPERTY)`", "primary_url": "https://github.com/advisories/GHSA-mhm7-754m-9p8w" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-68972", "package": "gnupg", "installed_version": "2.4.7-r0", "fixed_version": "2.4.9-r0", "title": "gnupg: GnuPG: Signature bypass via form feed character in signed messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68972" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-68972", "package": "gnupg-dirmngr", "installed_version": "2.4.7-r0", "fixed_version": "2.4.9-r0", "title": "gnupg: GnuPG: Signature bypass via form feed character in signed messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68972" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-68972", "package": "gnupg-gpgconf", "installed_version": "2.4.7-r0", "fixed_version": "2.4.9-r0", "title": "gnupg: GnuPG: Signature bypass via form feed character in signed messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68972" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-68972", "package": "gnupg-keyboxd", "installed_version": "2.4.7-r0", "fixed_version": "2.4.9-r0", "title": "gnupg: GnuPG: Signature bypass via form feed character in signed messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68972" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-68972", "package": "gnupg-utils", "installed_version": "2.4.7-r0", "fixed_version": "2.4.9-r0", "title": "gnupg: GnuPG: Signature bypass via form feed character in signed messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68972" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-68972", "package": "gnupg-wks-client", "installed_version": "2.4.7-r0", "fixed_version": "2.4.9-r0", "title": "gnupg: GnuPG: Signature bypass via form feed character in signed messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68972" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-12243", "package": "gnutls", "installed_version": "3.8.8-r0", "fixed_version": "3.8.12-r0", "title": "gnutls: GnuTLS Impacted by Inefficient DER Decoding in libtasn1 Leading to Remote DoS", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12243" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-14831", "package": "gnutls", "installed_version": "3.8.8-r0", "fixed_version": "3.8.12-r0", "title": "gnutls: GnuTLS: Denial of Service via excessive resource consumption during certificate verification", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-14831" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-32989", "package": "gnutls", "installed_version": "3.8.8-r0", "fixed_version": "3.8.12-r0", "title": "gnutls: Vulnerability in GnuTLS SCT extension parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-32989" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-6395", "package": "gnutls", "installed_version": "3.8.8-r0", "fixed_version": "3.8.12-r0", "title": "gnutls: NULL pointer dereference in _gnutls_figure_common_ciphersuite()", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-6395" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42011", "package": "gnutls", "installed_version": "3.8.8-r0", "fixed_version": "3.8.13-r0", "title": "gnutls: gnutls: Security bypass due to incorrect name constraint handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42011" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42012", "package": "gnutls", "installed_version": "3.8.8-r0", "fixed_version": "3.8.13-r0", "title": "gnutls: gnutls: Certificate validation bypass due to improper handling of URI and SRV SANs", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42012" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42013", "package": "gnutls", "installed_version": "3.8.8-r0", "fixed_version": "3.8.13-r0", "title": "gnutls: gnutls: Certificate validation bypass due to oversized Subject Alternative Name", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42013" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42014", "package": "gnutls", "installed_version": "3.8.8-r0", "fixed_version": "3.8.13-r0", "title": "gnutls: gnutls: Use-after-free in gnutls_pkcs11_token_set_pin", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42014" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42015", "package": "gnutls", "installed_version": "3.8.8-r0", "fixed_version": "3.8.13-r0", "title": "gnutls: gnutls: Memory corruption due to off-by-one error in PKCS#12 bag handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42015" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-5260", "package": "gnutls", "installed_version": "3.8.8-r0", "fixed_version": "3.8.13-r0", "title": "gnutls: gnutls: Information disclosure via heap overread in RSA key exchange", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5260" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-68972", "package": "gpg", "installed_version": "2.4.7-r0", "fixed_version": "2.4.9-r0", "title": "gnupg: GnuPG: Signature bypass via form feed character in signed messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68972" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-68972", "package": "gpg-agent", "installed_version": "2.4.7-r0", "fixed_version": "2.4.9-r0", "title": "gnupg: GnuPG: Signature bypass via form feed character in signed messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68972" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-68972", "package": "gpg-wks-server", "installed_version": "2.4.7-r0", "fixed_version": "2.4.9-r0", "title": "gnupg: GnuPG: Signature bypass via form feed character in signed messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68972" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-68972", "package": "gpgsm", "installed_version": "2.4.7-r0", "fixed_version": "2.4.9-r0", "title": "gnupg: GnuPG: Signature bypass via form feed character in signed messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68972" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-68972", "package": "gpgv", "installed_version": "2.4.7-r0", "fixed_version": "2.4.9-r0", "title": "gnupg: GnuPG: Signature bypass via form feed character in signed messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68972" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-69419", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-69419" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-9230", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.5-r0", "title": "openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9230" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-9231", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.5-r0", "title": "openssl: Timing side-channel in SM2 algorithm on 64 bit ARM", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9231" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-31790", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r0", "title": "openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-31790" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-34182", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34182" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-34183", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34183" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-45445", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: AES-OCB IV Ignored on EVP_Cipher() Path", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45445" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54872", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: OpenSSL: Private key recovery via timing side-channel in generic elliptic curve operations", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54872" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54875", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: openssl: information disclosure via non-constant-time SM2 scalar multiplication on ARM64 and RISC-V", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54875" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-72897", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: openssl: Denial of Service via out-of-bounds write during TLS context switch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-72897" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75804", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: OpenSSL: Denial of Service via unenforced QUIC connection flow control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75804" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75805", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: openssl: Denial of Service via crafted CMP certificate revocation response", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75805" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75806", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: OpenSSL: Denial of Service via undersized DTLS record", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75806" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77696", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: OpenSSL: Private key recovery via SM2 timing side-channel", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77696" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84784", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: OpenSSL: Denial of Service via unbounded QUIC connection identifier backlog", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84784" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-8176", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.7.0-r0", "title": "libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-8176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-102633", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.9.0-r0", "title": "expat: expat: Denial of Service via integer overflow in expat_realloc", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102633" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-32776", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.7.5-r0", "title": "libexpat: libexpat: Denial of Service due to NULL pointer dereference", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-32776" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-32777", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.7.5-r0", "title": "libexpat: libexpat: Denial of Service via infinite loop in DTD content parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-32777" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-32778", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.7.5-r0", "title": "libexpat: libexpat: Denial of Service via NULL pointer dereference after out-of-memory condition", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-32778" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50219", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Use-after-free vulnerability due to improper handler call depth tracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50219" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56131", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Use-after-free vulnerability due to insufficient handler call depth tracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56131" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56132", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Arbitrary Code Execution via Heap-based Buffer Overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56132" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56403", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution due to integer overflow in storeAtts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56403" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56404", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary Code Execution via integer overflow in addBinding", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56404" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56405", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Information disclosure and arbitrary code execution via integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56405" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56406", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution via integer overflow in XML_ParseBuffer", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56406" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56407", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Arbitrary code execution due to integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56407" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56408", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Information disclosure and arbitrary code execution via integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56408" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56409", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Integer overflow in xmlwf may lead to information disclosure or arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56409" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56410", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Integer overflow in xmlwf can lead to information disclosure and arbitrary code execution.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56410" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56411", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.8.2-r0", "title": "expat: libexpat: Integer Overflow Vulnerability Leading to Information Disclosure or Code Execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56411" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56412", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.8.2-r0", "title": "libexpat: libexpat: Use-after-free vulnerability due to improper handling of XML CDATA sections", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56412" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-64505", "package": "libpng", "installed_version": "1.6.44-r0", "fixed_version": "1.6.53-r0", "title": "libpng: LIBPNG heap buffer overflow via malformed palette index", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-64505" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-64506", "package": "libpng", "installed_version": "1.6.44-r0", "fixed_version": "1.6.53-r0", "title": "libpng: LIBPNG heap buffer over-read", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-64506" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-33416", "package": "libpng", "installed_version": "1.6.44-r0", "fixed_version": "1.6.56-r0", "title": "libpng: libpng: Arbitrary code execution due to use-after-free vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33416" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-33636", "package": "libpng", "installed_version": "1.6.44-r0", "fixed_version": "1.6.56-r0", "title": "libpng: libpng: Information disclosure and denial of service via out-of-bounds read/write in Neon palette expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33636" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-34757", "package": "libpng", "installed_version": "1.6.44-r0", "fixed_version": "1.6.57-r0", "title": "libpng: libpng: Information disclosure and data corruption via use-after-free vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34757" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-40930", "package": "libpng", "installed_version": "1.6.44-r0", "fixed_version": "1.6.59-r0", "title": "libpng: libpng: Data integrity and availability impact due to improper APNG chunk handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40930" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-46675", "package": "libpng", "installed_version": "1.6.44-r0", "fixed_version": "1.6.59-r0", "title": "libpng: libpng: Use-after-free in sequential reader when png_read_end called without reading image rows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-46675" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-69419", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-69419" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-9230", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.5-r0", "title": "openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9230" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-9231", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.5-r0", "title": "openssl: Timing side-channel in SM2 algorithm on 64 bit ARM", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9231" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-31790", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r0", "title": "openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-31790" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-34182", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34182" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-34183", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34183" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-45445", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: AES-OCB IV Ignored on EVP_Cipher() Path", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45445" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54872", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: OpenSSL: Private key recovery via timing side-channel in generic elliptic curve operations", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54872" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54875", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: openssl: information disclosure via non-constant-time SM2 scalar multiplication on ARM64 and RISC-V", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54875" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-72897", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: openssl: Denial of Service via out-of-bounds write during TLS context switch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-72897" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75804", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: OpenSSL: Denial of Service via unenforced QUIC connection flow control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75804" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75805", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: openssl: Denial of Service via crafted CMP certificate revocation response", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75805" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75806", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: OpenSSL: Denial of Service via undersized DTLS record", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75806" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77696", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: OpenSSL: Private key recovery via SM2 timing side-channel", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77696" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84784", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: OpenSSL: Denial of Service via unbounded QUIC connection identifier backlog", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84784" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6042", "package": "musl", "installed_version": "1.2.5-r9", "fixed_version": "1.2.5-r10", "title": "musl libc: GB18030 4-byte Decoder: musl libc: Denial of Service via inefficient algorithmic complexity in iconv", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6042" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6042", "package": "musl-utils", "installed_version": "1.2.5-r9", "fixed_version": "1.2.5-r10", "title": "musl libc: GB18030 4-byte Decoder: musl libc: Denial of Service via inefficient algorithmic complexity in iconv", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6042" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-69419", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-69419" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-9230", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.5-r0", "title": "openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9230" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-9231", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.5-r0", "title": "openssl: Timing side-channel in SM2 algorithm on 64 bit ARM", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9231" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-31790", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r0", "title": "openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-31790" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-34182", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34182" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-34183", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34183" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-45445", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: AES-OCB IV Ignored on EVP_Cipher() Path", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45445" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54872", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: OpenSSL: Private key recovery via timing side-channel in generic elliptic curve operations", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54872" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54875", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: openssl: information disclosure via non-constant-time SM2 scalar multiplication on ARM64 and RISC-V", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54875" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-72897", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: openssl: Denial of Service via out-of-bounds write during TLS context switch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-72897" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75804", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: OpenSSL: Denial of Service via unenforced QUIC connection flow control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75804" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75805", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: openssl: Denial of Service via crafted CMP certificate revocation response", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75805" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75806", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: OpenSSL: Denial of Service via undersized DTLS record", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75806" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77696", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: OpenSSL: Private key recovery via SM2 timing side-channel", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77696" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84784", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: OpenSSL: Denial of Service via unbounded QUIC connection identifier backlog", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84784" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-48924", "package": "org.apache.commons:commons-lang3", "installed_version": "3.17.0", "fixed_version": "3.18.0", "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48924" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49844", "package": "org.apache.logging.log4j:log4j-api", "installed_version": "2.24.3", "fixed_version": "2.25.5, 2.26.1", "title": "org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-31672", "package": "org.apache.poi:poi-ooxml", "installed_version": "5.3.0", "fixed_version": "5.4.0", "title": "org.apache.poi/poi-ooxml: Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31672" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-31650", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "9.0.104, 10.1.40, 11.0.6", "title": "tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31650" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-49124", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "Apache Tomcat installer for Windows has an untrusted search path vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49124" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-49125", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49125" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-55668", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55668" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-66614", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "11.0.15, 10.1.50, 9.0.113", "title": "tomcat: Client certificate verification bypass due to virtual host mapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-66614" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-25854", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "9.0.116, 10.1.53, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-25854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-7962", "package": "org.eclipse.angus:smtp", "installed_version": "2.0.3", "fixed_version": "2.0.4", "title": "com.sun.mail/jakarta.mail: Jakarta Mail SMTP Injection Vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-7962" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41001", "package": "org.springframework.boot:spring-boot-autoconfigure", "installed_version": "3.4.2", "fixed_version": "4.0.7, 3.5.15", "title": "spring-boot: Spring Boot: Local attacker can manipulate data directory due to predictable path", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41001" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41711", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.4.2", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via parsing Sort parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41711" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41721", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.4.2", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via specially crafted HTTP request with @ProjectedPayload", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41721" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41710", "package": "org.springframework.retry:spring-retry", "installed_version": "2.0.11", "fixed_version": "2.0.13", "title": "spring-retry: Spring Retry: Denial of Service via cache exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-22223", "package": "org.springframework.security:spring-security-core", "installed_version": "6.4.2", "fixed_version": "6.4.4", "title": "spring-security: authorization bypass via incorrectly locating method security annotations on parameterized types or methods", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22223" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22751", "package": "org.springframework.security:spring-security-core", "installed_version": "6.4.2", "fixed_version": "6.5.10, 7.0.5", "title": "Spring Security: JdbcOneTimeTokenService: Spring Security: Authentication bypass due to race condition in One-Time Token login", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22751" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47838", "package": "org.springframework.security:spring-security-web", "installed_version": "6.4.2", "fixed_version": "6.5.11", "title": "Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47838" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41851", "package": "org.springframework:spring-expression", "installed_version": "6.2.2", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Denial of Service via unbounded cache growth in SpEL evaluation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41851" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-41234", "package": "org.springframework:spring-web", "installed_version": "6.2.2", "fixed_version": "6.2.8, 6.1.21", "title": "springframework: Reflected download attack in Spring Framework with non-ASCII headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41234" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41854", "package": "org.springframework:spring-web", "installed_version": "6.2.2", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Server-Side Request Forgery via incorrect host parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-41242", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.2", "fixed_version": "6.2.10", "title": "org.springframework/spring-webmvc: Spring Framework MVC path traversal vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41242" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22737", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.2", "fixed_version": "7.0.6, 6.2.17", "title": "Spring Framework: Spring Framework: Information disclosure via Java scripting engine enabled template views", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22737" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22745", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.2", "fixed_version": "7.0.7, 6.2.18", "title": "spring-webflux: Spring MVC and Spring WebFlux: Denial of Service via slow static resource resolution on Windows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41841", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.2", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring MVC and WebFlux applications: Information Disclosure via static resource resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41841" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41843", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.2", "fixed_version": "7.0.8, 6.2.19", "title": "spring-webflux: spring-webmvc: Spring Framework: Information Disclosure via Path Traversal", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41843" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41844", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.2", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Open Redirect via crafted link", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41846", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.2", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Cross-site scripting (XSS) via user-supplied values in JSP form tags", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41846" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41853", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.2", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Request smuggling vulnerability in Spring MVC and WebFlux", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41853" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-29088", "package": "sqlite-libs", "installed_version": "3.48.0-r0", "fixed_version": "3.48.0-r4", "title": "sqlite: Denial of Service in SQLite", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-29088" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-58251", "package": "ssl_client", "installed_version": "1.37.0-r12", "fixed_version": "1.37.0-r14", "title": "In netstat in BusyBox through 1.37.0, local users can launch of networ ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-58251" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-27171", "package": "zlib", "installed_version": "1.3.1-r2", "fixed_version": "1.3.2-r0", "title": "zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27171" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-85091", "package": "zlib", "installed_version": "1.3.1-r2", "fixed_version": "1.3.2-r1", "title": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vul ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-85091" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-46394", "package": "busybox", "installed_version": "1.37.0-r12", "fixed_version": "1.37.0-r14", "title": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hid ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46394" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-46394", "package": "busybox-binsh", "installed_version": "1.37.0-r12", "fixed_version": "1.37.0-r14", "title": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hid ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46394" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-10532", "package": "ch.qos.logback:logback-core", "installed_version": "1.5.16", "fixed_version": "1.5.34", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-10532" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-1225", "package": "ch.qos.logback:logback-core", "installed_version": "1.5.16", "fixed_version": "1.5.25", "title": "ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-1225" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-9828", "package": "ch.qos.logback:logback-core", "installed_version": "1.5.16", "fixed_version": "1.5.33", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9828" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-9820", "package": "gnutls", "installed_version": "3.8.8-r0", "fixed_version": "3.8.12-r0", "title": "gnutls: Stack-based Buffer Overflow in gnutls_pkcs11_token_init() Function", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9820" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-3832", "package": "gnutls", "installed_version": "3.8.8-r0", "fixed_version": "3.8.13-r0", "title": "gnutls: gnutls: Security bypass allows acceptance of revoked server certificates via crafted OCSP response", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-3832" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-5419", "package": "gnutls", "installed_version": "3.8.8-r0", "fixed_version": "3.8.13-r0", "title": "gnutls: gnutls: Information disclosure via timing side-channel in PKCS#7 padding removal", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-5419" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-15468", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-15468" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-66199", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-66199" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-68160", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68160" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-69418", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-69418" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-69420", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Denial of Service via malformed TimeStamp Response", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-69420" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-9232", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.5-r0", "title": "openssl: Out-of-bounds read in HTTP client no_proxy handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9232" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-22795", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22795" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-22796", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22796" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-35189", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-35189" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-42766", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: Possible NULL Dereference in Password-Based CMS Decryption", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42766" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-42768", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42768" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-42770", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: FFC-DH Peer Validation Uses Attacker-Supplied q", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42770" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-45446", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45446" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-9076", "package": "libcrypto3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9076" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-24515", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.7.4-r0", "title": "libexpat: libexpat null pointer dereference", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24515" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-41080", "package": "libexpat", "installed_version": "2.6.4-r0", "fixed_version": "2.8.1-r0", "title": "libexpat: expat: libexpat: Denial of Service via hash flooding with crafted XML", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41080" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-15468", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-15468" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-66199", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-66199" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-68160", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68160" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-69418", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-69418" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-69420", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Denial of Service via malformed TimeStamp Response", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-69420" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-9232", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.5-r0", "title": "openssl: Out-of-bounds read in HTTP client no_proxy handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9232" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-22795", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22795" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-22796", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22796" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-35189", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-35189" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-42766", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: Possible NULL Dereference in Password-Based CMS Decryption", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42766" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-42768", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42768" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-42770", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: FFC-DH Peer Validation Uses Attacker-Supplied q", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42770" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-45446", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45446" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-9076", "package": "libssl3", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9076" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-13151", "package": "libtasn1", "installed_version": "4.20.0-r0", "fixed_version": "4.21.0-r0", "title": "libtasn1: libtasn1: Denial of Service via stack-based buffer overflow in asn1_expend_octet_string", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-13151" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-15468", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-15468" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-66199", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-66199" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-68160", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68160" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-69418", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-69418" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-69420", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Denial of Service via malformed TimeStamp Response", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-69420" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-9232", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.5-r0", "title": "openssl: Out-of-bounds read in HTTP client no_proxy handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9232" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-22795", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22795" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-22796", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.6-r0", "title": "openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22796" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-35189", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r2", "title": "openssl: openssl: Denial of Service via excessive memory allocation in CRL distribution point processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-35189" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-42766", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: Possible NULL Dereference in Password-Based CMS Decryption", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42766" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-42768", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42768" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-42770", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: FFC-DH Peer Validation Uses Attacker-Supplied q", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42770" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-45446", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45446" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-9076", "package": "openssl", "installed_version": "3.3.3-r0", "fixed_version": "3.3.7-r1", "title": "openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9076" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-31651", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "9.0.104, 10.1.40, 11.0.6", "title": "tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31651" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-46701", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "9.0.105, 10.1.41, 11.0.7", "title": "tomcat: Apache Tomcat: Security constraint bypass for CGI scripts", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46701" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-55754", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "11.0.11, 10.1.45, 9.0.109", "title": "org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55754" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-61795", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "11.0.12, 10.1.47, 9.0.110", "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-61795" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-43514", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.34", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22746", "package": "org.springframework.security:spring-security-core", "installed_version": "6.4.2", "fixed_version": "6.5.10, 7.0.5", "title": "Spring Security: Spring Security: Timing attack defense bypass allows information disclosure", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22746" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-22233", "package": "org.springframework:spring-context", "installed_version": "6.2.2", "fixed_version": "6.2.7, 6.1.20", "title": "CVE-2024-38820 ensured Locale-independent, lowercase conversion for bo ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22233" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41848", "package": "org.springframework:spring-core", "installed_version": "6.2.2", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Regular Expression Denial of Service in AntPathMatcher", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41848" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41852", "package": "org.springframework:spring-expression", "installed_version": "6.2.2", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: org.springframework/spring-expression: Spring Framework: SpEL vulnerability allows unintended application logic invocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41852" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22735", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.2", "fixed_version": "7.0.6, 6.2.17", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring MVC and WebFlux: Stream corruption vulnerability when using Server-Sent Events", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22735" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22741", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.2", "fixed_version": "7.0.7, 6.2.18", "title": "Spring MVC: Spring WebFlux: Spring MVC and Spring WebFlux: Denial of Service via cache poisoning", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-46394", "package": "ssl_client", "installed_version": "1.37.0-r12", "fixed_version": "1.37.0-r14", "title": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hid ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46394" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-107891", "package": "musl", "installed_version": "1.2.5-r9", "fixed_version": "1.2.5-r12", "title": "Title Not Available", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-107891" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.4.0 (alpine 3.21.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-107891", "package": "musl-utils", "installed_version": "1.2.5-r9", "fixed_version": "1.2.5-r12", "title": "Title Not Available", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-107891" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2", "vulnerability_count": 171, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-45491", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.3-r0", "title": "libexpat: Integer Overflow or Wraparound", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45491" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-45492", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.3-r0", "title": "libexpat: integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45492" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2025-24813", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.3, 10.1.35, 9.0.99", "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-24813" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-1597", "package": "org.postgresql:postgresql", "installed_version": "42.6.0", "fixed_version": "42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2", "title": "pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-1597" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-38821", "package": "org.springframework.security:spring-security-web", "installed_version": "6.2.0", "fixed_version": "5.7.13, 5.8.15, 6.2.7, 6.0.13, 6.1.11, 6.3.4", "title": "Spring-WebFlux: Authorization Bypass of Static Resources in WebFlux Applications", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38821" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-22732", "package": "org.springframework.security:spring-security-web", "installed_version": "6.2.0", "fixed_version": "6.5.9, 7.0.4", "title": "Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22732" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-0840", "package": "binutils", "installed_version": "2.41-r0", "fixed_version": "2.41-r1", "title": "binutils: GNU Binutils objdump.c disassemble_bytes stack-based overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-0840" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-6378", "package": "ch.qos.logback:logback-classic", "installed_version": "1.4.11", "fixed_version": "1.3.12, 1.4.12, 1.2.13", "title": "logback: serialization vulnerability in logback receiver", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6378" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-6378", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.3.12, 1.4.12, 1.2.13", "title": "logback: serialization vulnerability in logback receiver", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6378" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.15.3", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.15.3", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "33.0.0-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48734", "package": "commons-beanutils:commons-beanutils", "installed_version": "1.9.4", "fixed_version": "1.11.0", "title": "commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48976", "package": "commons-fileupload:commons-fileupload", "installed_version": "1.5", "fixed_version": "1.6.0", "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48976" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.12.0", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-6119", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.7-r0", "title": "openssl: Possible denial of service in X.509 name checks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-6119" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2023-52425", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.0-r0", "title": "expat: parsing large tokens can trigger a denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-52425" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-28757", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.2-r0", "title": "expat: XML Entity Expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-28757" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-45490", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.3-r0", "title": "libexpat: Negative Length Parsing Vulnerability in libexpat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45490" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-59375", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.7.2-r0", "title": "firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-59375" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-6119", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.7-r0", "title": "openssl: Possible denial of service in X.509 name checks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-6119" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-26519", "package": "musl", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r5", "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-26519" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-40200", "package": "musl", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r6", "title": "musl: musl libc: Arbitrary code execution and denial of service via stack-based memory corruption in qsort", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40200" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-26519", "package": "musl-utils", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r5", "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-26519" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-40200", "package": "musl-utils", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r6", "title": "musl: musl libc: Arbitrary code execution and denial of service via stack-based memory corruption in qsort", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40200" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-34750", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.0-M21, 10.1.25, 9.0.90", "title": "tomcat: Improper Handling of Exceptional Conditions", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-34750" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38286", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.0-M21, 10.1.25, 9.0.90", "title": "tomcat: Denial of Service in Tomcat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38286" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-50379", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.2, 10.1.34, 9.0.98", "title": "tomcat: RCE due to TOCTOU issue in JSP compilation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-50379" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-56337", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.2, 10.1.34, 9.0.98", "title": "tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-56337" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48988", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "tomcat: Apache Tomcat DoS in multipart upload", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48988" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48989", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.10, 10.1.44, 9.0.108", "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48989" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-52520", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.9, 10.1.43, 9.0.107", "title": "tomcat: Apache Tomcat denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-52520" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-53506", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.107, 10.1.43, 11.0.9", "title": "tomcat: Apache Tomcat denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-53506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-55752", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.11, 10.1.45, 9.0.109", "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55752" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24734", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.18, 10.1.52, 9.0.115", "title": "tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24880", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.116, 10.1.52, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24880" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34483", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.116, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34483" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34487", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.117, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34487" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41284", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41284" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42498", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42498" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-43513", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2022-45688", "package": "org.json:json", "installed_version": "20170516", "fixed_version": "20230227", "title": "json stack overflow vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-45688" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-5072", "package": "org.json:json", "installed_version": "20170516", "fixed_version": "20231013", "title": "JSON-java: parser confusion leads to OOM", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5072" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42198", "package": "org.postgresql:postgresql", "installed_version": "42.6.0", "fixed_version": "42.7.11", "title": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42198" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-22235", "package": "org.springframework.boot:spring-boot", "installed_version": "3.2.0", "fixed_version": "3.3.11, 3.4.5", "title": "org.springframework.boot/spring-boot: Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22235" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22234", "package": "org.springframework.security:spring-security-core", "installed_version": "6.2.0", "fixed_version": "6.1.7, 6.2.2", "title": "spring-security: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22234" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22257", "package": "org.springframework.security:spring-security-core", "installed_version": "6.2.0", "fixed_version": "5.7.12, 5.8.11, 6.1.8, 6.2.3", "title": "spring-security: Broken Access Control With Direct Use of AuthenticatedVoter", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22257" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-22228", "package": "org.springframework.security:spring-security-crypto", "installed_version": "6.2.0", "fixed_version": "6.3.8, 6.4.4, 6.2.10, 6.1.14, 6.0.16, 5.8.18, 5.7.16", "title": "spring-security-core: Spring Security BCryptPasswordEncoder does not enforce maximum password length", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22228" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-41249", "package": "org.springframework:spring-core", "installed_version": "6.1.1", "fixed_version": "6.2.11", "title": "org.springframework/spring-core: Spring Framework Annotation Detection Vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41249" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41850", "package": "org.springframework:spring-expression", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service via specially crafted SpEL expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41850" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22243", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "6.1.4, 6.0.17, 5.3.32", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22243" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22259", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "6.1.5, 6.0.18, 5.3.33", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22259" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22262", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "5.3.34, 6.0.19, 6.1.6", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22262" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38816", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "6.1.13", "title": "spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38816" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38819", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "6.1.14", "title": "org.springframework:spring-webmvc: Path traversal vulnerability in functional web frameworks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38819" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41842", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service when resolving static resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41842" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41845", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "org.springframework: Spring Framework: Cross-site scripting (XSS) via incorrect JavaScript escaping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41845" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r17", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r16", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-58251", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In netstat in BusyBox through 1.37.0, local users can launch of networ ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-58251" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r17", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r16", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-58251", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In netstat in BusyBox through 1.37.0, local users can launch of networ ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-58251" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-12798", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.13, 1.3.15", "title": "logback-core: arbitrary code execution via JaninoEventEvaluator", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12798" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-11226", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.19, 1.3.16", "title": "ch.qos.logback/logback-core: Conditional abitrary code execution in logback-core", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-11226" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18401", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.15.3", "fixed_version": "2.21.1, 2.18.6", "title": "tools.jackson.core/jackson-core: com.fasterxml.jackson.core/jackson-core: jackson-core: Denial of Service due to number length bypass in asynchronous JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18401" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59888", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-9230", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r1", "title": "openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9230" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-52426", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.0-r0", "title": "expat: recursive XML entity expansion vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-52426" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-50602", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.4-r0", "title": "libexpat: expat: DoS via XML_ResumeParser", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-50602" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-8176", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.7.0-r0", "title": "libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-8176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-9230", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r1", "title": "openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9230" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-12133", "package": "libtasn1", "installed_version": "4.19.0-r2", "fixed_version": "4.20.0-r0", "title": "libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoS", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12133" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6042", "package": "musl", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r6", "title": "musl libc: GB18030 4-byte Decoder: musl libc: Denial of Service via inefficient algorithmic complexity in iconv", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6042" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6042", "package": "musl-utils", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r6", "title": "musl libc: GB18030 4-byte Decoder: musl libc: Denial of Service via inefficient algorithmic complexity in iconv", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6042" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-25710", "package": "org.apache.commons:commons-compress", "installed_version": "1.25.0", "fixed_version": "1.26.0", "title": "commons-compress: Denial of service caused by an infinite loop for a corrupted DUMP file", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-25710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-26308", "package": "org.apache.commons:commons-compress", "installed_version": "1.25.0", "fixed_version": "1.26.0", "title": "commons-compress: OutOfMemoryError unpacking broken Pack200 file", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-26308" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-48924", "package": "org.apache.commons:commons-lang3", "installed_version": "3.13.0", "fixed_version": "3.18.0", "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48924" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49844", "package": "org.apache.logging.log4j:log4j-api", "installed_version": "2.21.1", "fixed_version": "2.25.5, 2.26.1", "title": "org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-31672", "package": "org.apache.poi:poi-ooxml", "installed_version": "5.2.5", "fixed_version": "5.4.0", "title": "org.apache.poi/poi-ooxml: Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31672" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-24549", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "8.5.99, 9.0.86, 10.1.19, 11.0.0-M17", "title": "Tomcat: HTTP/2 header handling DoS", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-24549" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-31650", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.104, 10.1.40, 11.0.6", "title": "tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31650" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-49124", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "Apache Tomcat installer for Windows has an untrusted search path vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49124" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-49125", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49125" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-55668", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55668" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-66614", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.15, 10.1.50, 9.0.113", "title": "tomcat: Client certificate verification bypass due to virtual host mapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-66614" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-25854", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.116, 10.1.53, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-25854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-23672", "package": "org.apache.tomcat.embed:tomcat-embed-websocket", "installed_version": "10.1.16", "fixed_version": "11.0.0-M17, 10.1.19, 9.0.86, 8.5.99", "title": "Tomcat: WebSocket DoS with incomplete closing handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-23672" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-7962", "package": "org.eclipse.angus:smtp", "installed_version": "2.0.2", "fixed_version": "2.0.4", "title": "com.sun.mail/jakarta.mail: Jakarta Mail SMTP Injection Vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-7962" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41711", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.2.0", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via parsing Sort parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41711" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41721", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.2.0", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via specially crafted HTTP request with @ProjectedPayload", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41721" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41710", "package": "org.springframework.retry:spring-retry", "installed_version": "2.0.4", "fixed_version": "2.0.13", "title": "spring-retry: Spring Retry: Denial of Service via cache exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38827", "package": "org.springframework.security:spring-security-core", "installed_version": "6.2.0", "fixed_version": "5.7.14, 5.8.16, 6.0.14, 6.1.12, 6.2.8, 6.3.5", "title": "spring-security: authorization bypass for case sensitive comparisons", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38827" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47838", "package": "org.springframework.security:spring-security-web", "installed_version": "6.2.0", "fixed_version": "6.5.11", "title": "Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47838" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38820", "package": "org.springframework:spring-context", "installed_version": "6.1.1", "fixed_version": "6.1.14", "title": "The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38820" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41851", "package": "org.springframework:spring-expression", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Denial of Service via unbounded cache growth in SpEL evaluation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41851" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38809", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "5.3.38, 6.0.23, 6.1.12", "title": "org.springframework:spring-web: Spring Framework DoS via conditional HTTP request", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38809" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38820", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "6.1.14", "title": "The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38820" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-41234", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "6.2.8, 6.1.21", "title": "springframework: Reflected download attack in Spring Framework with non-ASCII headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41234" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-41242", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "6.2.10", "title": "org.springframework/spring-webmvc: Spring Framework MVC path traversal vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41242" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22737", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.6, 6.2.17", "title": "Spring Framework: Spring Framework: Information disclosure via Java scripting engine enabled template views", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22737" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22745", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.7, 6.2.18", "title": "spring-webflux: Spring MVC and Spring WebFlux: Denial of Service via slow static resource resolution on Windows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41841", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring MVC and WebFlux applications: Information Disclosure via static resource resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41841" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41843", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "spring-webflux: spring-webmvc: Spring Framework: Information Disclosure via Path Traversal", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41843" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41844", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Open Redirect via crafted link", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41846", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Cross-site scripting (XSS) via user-supplied values in JSP form tags", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41846" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41853", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Request smuggling vulnerability in Spring MVC and WebFlux", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41853" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r17", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r16", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-58251", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In netstat in BusyBox through 1.37.0, local users can launch of networ ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-58251" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-46394", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hid ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46394" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-46394", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hid ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46394" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2024-12801", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.13, 1.3.15", "title": "logback-core: SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12801" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-10532", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.34", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-10532" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-1225", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.25", "title": "ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-1225" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-9828", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.33", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9828" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-13176", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r0", "title": "openssl: Timing side-channel in ECDSA signature computation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-2511", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.4-r6", "title": "openssl: Unbounded memory growth with session handling in TLSv1.3", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-2511" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4603", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.5-r0", "title": "openssl: Excessive time spent checking DSA keys and parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4603" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4741", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.6-r0", "title": "openssl: Use After Free with SSL_free_buffers", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-5535", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.6-r0", "title": "openssl: SSL_select_next_proto buffer overread", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-5535" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-9143", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.7-r1", "title": "openssl: Low-level invalid GF(2^m) parameters lead to OOB memory access", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-9143" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-9232", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r1", "title": "openssl: Out-of-bounds read in HTTP client no_proxy handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9232" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-13176", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r0", "title": "openssl: Timing side-channel in ECDSA signature computation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-2511", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.4-r6", "title": "openssl: Unbounded memory growth with session handling in TLSv1.3", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-2511" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4603", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.5-r0", "title": "openssl: Excessive time spent checking DSA keys and parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4603" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4741", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.6-r0", "title": "openssl: Use After Free with SSL_free_buffers", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-5535", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.6-r0", "title": "openssl: SSL_select_next_proto buffer overread", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-5535" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-9143", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.7-r1", "title": "openssl: Low-level invalid GF(2^m) parameters lead to OOB memory access", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-9143" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-9232", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r1", "title": "openssl: Out-of-bounds read in HTTP client no_proxy handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9232" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-31651", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.104, 10.1.40, 11.0.6", "title": "tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31651" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-46701", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.105, 10.1.41, 11.0.7", "title": "tomcat: Apache Tomcat: Security constraint bypass for CGI scripts", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46701" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-55754", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.11, 10.1.45, 9.0.109", "title": "org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55754" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-61795", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.12, 10.1.47, 9.0.110", "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-61795" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-43514", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-22233", "package": "org.springframework:spring-context", "installed_version": "6.1.1", "fixed_version": "6.2.7, 6.1.20", "title": "CVE-2024-38820 ensured Locale-independent, lowercase conversion for bo ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22233" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41848", "package": "org.springframework:spring-core", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Regular Expression Denial of Service in AntPathMatcher", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41848" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41852", "package": "org.springframework:spring-expression", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: org.springframework/spring-expression: Spring Framework: SpEL vulnerability allows unintended application logic invocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41852" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22735", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.6, 6.2.17", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring MVC and WebFlux: Stream corruption vulnerability when using Server-Sent Events", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22735" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22741", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.7, 6.2.18", "title": "Spring MVC: Spring WebFlux: Spring MVC and Spring WebFlux: Denial of Service via cache poisoning", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.2 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-46394", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hid ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46394" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1", "vulnerability_count": 171, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-45491", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.3-r0", "title": "libexpat: Integer Overflow or Wraparound", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45491" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-45492", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.3-r0", "title": "libexpat: integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45492" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2025-24813", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.3, 10.1.35, 9.0.99", "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-24813" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-1597", "package": "org.postgresql:postgresql", "installed_version": "42.6.0", "fixed_version": "42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2", "title": "pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-1597" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-38821", "package": "org.springframework.security:spring-security-web", "installed_version": "6.2.0", "fixed_version": "5.7.13, 5.8.15, 6.2.7, 6.0.13, 6.1.11, 6.3.4", "title": "Spring-WebFlux: Authorization Bypass of Static Resources in WebFlux Applications", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38821" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-22732", "package": "org.springframework.security:spring-security-web", "installed_version": "6.2.0", "fixed_version": "6.5.9, 7.0.4", "title": "Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22732" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-0840", "package": "binutils", "installed_version": "2.41-r0", "fixed_version": "2.41-r1", "title": "binutils: GNU Binutils objdump.c disassemble_bytes stack-based overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-0840" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-6378", "package": "ch.qos.logback:logback-classic", "installed_version": "1.4.11", "fixed_version": "1.3.12, 1.4.12, 1.2.13", "title": "logback: serialization vulnerability in logback receiver", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6378" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-6378", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.3.12, 1.4.12, 1.2.13", "title": "logback: serialization vulnerability in logback receiver", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6378" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.15.3", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.15.3", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "33.0.0-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48734", "package": "commons-beanutils:commons-beanutils", "installed_version": "1.9.4", "fixed_version": "1.11.0", "title": "commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48976", "package": "commons-fileupload:commons-fileupload", "installed_version": "1.5", "fixed_version": "1.6.0", "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48976" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.12.0", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-6119", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.7-r0", "title": "openssl: Possible denial of service in X.509 name checks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-6119" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2023-52425", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.0-r0", "title": "expat: parsing large tokens can trigger a denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-52425" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-28757", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.2-r0", "title": "expat: XML Entity Expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-28757" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-45490", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.3-r0", "title": "libexpat: Negative Length Parsing Vulnerability in libexpat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45490" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-59375", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.7.2-r0", "title": "firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-59375" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-6119", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.7-r0", "title": "openssl: Possible denial of service in X.509 name checks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-6119" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-26519", "package": "musl", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r5", "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-26519" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-40200", "package": "musl", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r6", "title": "musl: musl libc: Arbitrary code execution and denial of service via stack-based memory corruption in qsort", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40200" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-26519", "package": "musl-utils", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r5", "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-26519" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-40200", "package": "musl-utils", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r6", "title": "musl: musl libc: Arbitrary code execution and denial of service via stack-based memory corruption in qsort", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40200" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-34750", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.0-M21, 10.1.25, 9.0.90", "title": "tomcat: Improper Handling of Exceptional Conditions", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-34750" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38286", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.0-M21, 10.1.25, 9.0.90", "title": "tomcat: Denial of Service in Tomcat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38286" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-50379", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.2, 10.1.34, 9.0.98", "title": "tomcat: RCE due to TOCTOU issue in JSP compilation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-50379" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-56337", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.2, 10.1.34, 9.0.98", "title": "tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-56337" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48988", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "tomcat: Apache Tomcat DoS in multipart upload", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48988" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48989", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.10, 10.1.44, 9.0.108", "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48989" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-52520", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.9, 10.1.43, 9.0.107", "title": "tomcat: Apache Tomcat denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-52520" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-53506", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.107, 10.1.43, 11.0.9", "title": "tomcat: Apache Tomcat denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-53506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-55752", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.11, 10.1.45, 9.0.109", "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55752" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24734", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.18, 10.1.52, 9.0.115", "title": "tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24880", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.116, 10.1.52, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24880" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34483", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.116, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34483" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34487", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.117, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34487" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41284", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41284" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42498", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42498" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-43513", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2022-45688", "package": "org.json:json", "installed_version": "20170516", "fixed_version": "20230227", "title": "json stack overflow vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-45688" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-5072", "package": "org.json:json", "installed_version": "20170516", "fixed_version": "20231013", "title": "JSON-java: parser confusion leads to OOM", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5072" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42198", "package": "org.postgresql:postgresql", "installed_version": "42.6.0", "fixed_version": "42.7.11", "title": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42198" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-22235", "package": "org.springframework.boot:spring-boot", "installed_version": "3.2.0", "fixed_version": "3.3.11, 3.4.5", "title": "org.springframework.boot/spring-boot: Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22235" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22234", "package": "org.springframework.security:spring-security-core", "installed_version": "6.2.0", "fixed_version": "6.1.7, 6.2.2", "title": "spring-security: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22234" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22257", "package": "org.springframework.security:spring-security-core", "installed_version": "6.2.0", "fixed_version": "5.7.12, 5.8.11, 6.1.8, 6.2.3", "title": "spring-security: Broken Access Control With Direct Use of AuthenticatedVoter", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22257" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-22228", "package": "org.springframework.security:spring-security-crypto", "installed_version": "6.2.0", "fixed_version": "6.3.8, 6.4.4, 6.2.10, 6.1.14, 6.0.16, 5.8.18, 5.7.16", "title": "spring-security-core: Spring Security BCryptPasswordEncoder does not enforce maximum password length", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22228" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-41249", "package": "org.springframework:spring-core", "installed_version": "6.1.1", "fixed_version": "6.2.11", "title": "org.springframework/spring-core: Spring Framework Annotation Detection Vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41249" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41850", "package": "org.springframework:spring-expression", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service via specially crafted SpEL expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41850" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22243", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "6.1.4, 6.0.17, 5.3.32", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22243" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22259", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "6.1.5, 6.0.18, 5.3.33", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22259" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22262", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "5.3.34, 6.0.19, 6.1.6", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22262" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38816", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "6.1.13", "title": "spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38816" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38819", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "6.1.14", "title": "org.springframework:spring-webmvc: Path traversal vulnerability in functional web frameworks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38819" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41842", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service when resolving static resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41842" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41845", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "org.springframework: Spring Framework: Cross-site scripting (XSS) via incorrect JavaScript escaping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41845" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r17", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r16", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-58251", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In netstat in BusyBox through 1.37.0, local users can launch of networ ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-58251" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r17", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r16", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-58251", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In netstat in BusyBox through 1.37.0, local users can launch of networ ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-58251" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-12798", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.13, 1.3.15", "title": "logback-core: arbitrary code execution via JaninoEventEvaluator", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12798" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-11226", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.19, 1.3.16", "title": "ch.qos.logback/logback-core: Conditional abitrary code execution in logback-core", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-11226" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18401", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.15.3", "fixed_version": "2.21.1, 2.18.6", "title": "tools.jackson.core/jackson-core: com.fasterxml.jackson.core/jackson-core: jackson-core: Denial of Service due to number length bypass in asynchronous JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18401" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59888", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-9230", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r1", "title": "openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9230" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-52426", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.0-r0", "title": "expat: recursive XML entity expansion vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-52426" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-50602", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.4-r0", "title": "libexpat: expat: DoS via XML_ResumeParser", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-50602" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-8176", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.7.0-r0", "title": "libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-8176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-9230", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r1", "title": "openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9230" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-12133", "package": "libtasn1", "installed_version": "4.19.0-r2", "fixed_version": "4.20.0-r0", "title": "libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoS", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12133" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6042", "package": "musl", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r6", "title": "musl libc: GB18030 4-byte Decoder: musl libc: Denial of Service via inefficient algorithmic complexity in iconv", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6042" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6042", "package": "musl-utils", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r6", "title": "musl libc: GB18030 4-byte Decoder: musl libc: Denial of Service via inefficient algorithmic complexity in iconv", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6042" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-25710", "package": "org.apache.commons:commons-compress", "installed_version": "1.25.0", "fixed_version": "1.26.0", "title": "commons-compress: Denial of service caused by an infinite loop for a corrupted DUMP file", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-25710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-26308", "package": "org.apache.commons:commons-compress", "installed_version": "1.25.0", "fixed_version": "1.26.0", "title": "commons-compress: OutOfMemoryError unpacking broken Pack200 file", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-26308" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-48924", "package": "org.apache.commons:commons-lang3", "installed_version": "3.13.0", "fixed_version": "3.18.0", "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48924" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49844", "package": "org.apache.logging.log4j:log4j-api", "installed_version": "2.21.1", "fixed_version": "2.25.5, 2.26.1", "title": "org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-31672", "package": "org.apache.poi:poi-ooxml", "installed_version": "5.2.5", "fixed_version": "5.4.0", "title": "org.apache.poi/poi-ooxml: Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31672" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-24549", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "8.5.99, 9.0.86, 10.1.19, 11.0.0-M17", "title": "Tomcat: HTTP/2 header handling DoS", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-24549" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-31650", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.104, 10.1.40, 11.0.6", "title": "tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31650" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-49124", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "Apache Tomcat installer for Windows has an untrusted search path vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49124" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-49125", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49125" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-55668", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55668" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-66614", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.15, 10.1.50, 9.0.113", "title": "tomcat: Client certificate verification bypass due to virtual host mapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-66614" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-25854", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.116, 10.1.53, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-25854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-23672", "package": "org.apache.tomcat.embed:tomcat-embed-websocket", "installed_version": "10.1.16", "fixed_version": "11.0.0-M17, 10.1.19, 9.0.86, 8.5.99", "title": "Tomcat: WebSocket DoS with incomplete closing handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-23672" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-7962", "package": "org.eclipse.angus:smtp", "installed_version": "2.0.2", "fixed_version": "2.0.4", "title": "com.sun.mail/jakarta.mail: Jakarta Mail SMTP Injection Vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-7962" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41711", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.2.0", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via parsing Sort parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41711" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41721", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.2.0", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via specially crafted HTTP request with @ProjectedPayload", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41721" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41710", "package": "org.springframework.retry:spring-retry", "installed_version": "2.0.4", "fixed_version": "2.0.13", "title": "spring-retry: Spring Retry: Denial of Service via cache exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38827", "package": "org.springframework.security:spring-security-core", "installed_version": "6.2.0", "fixed_version": "5.7.14, 5.8.16, 6.0.14, 6.1.12, 6.2.8, 6.3.5", "title": "spring-security: authorization bypass for case sensitive comparisons", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38827" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47838", "package": "org.springframework.security:spring-security-web", "installed_version": "6.2.0", "fixed_version": "6.5.11", "title": "Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47838" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38820", "package": "org.springframework:spring-context", "installed_version": "6.1.1", "fixed_version": "6.1.14", "title": "The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38820" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41851", "package": "org.springframework:spring-expression", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Denial of Service via unbounded cache growth in SpEL evaluation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41851" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38809", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "5.3.38, 6.0.23, 6.1.12", "title": "org.springframework:spring-web: Spring Framework DoS via conditional HTTP request", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38809" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38820", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "6.1.14", "title": "The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38820" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-41234", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "6.2.8, 6.1.21", "title": "springframework: Reflected download attack in Spring Framework with non-ASCII headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41234" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-41242", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "6.2.10", "title": "org.springframework/spring-webmvc: Spring Framework MVC path traversal vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41242" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22737", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.6, 6.2.17", "title": "Spring Framework: Spring Framework: Information disclosure via Java scripting engine enabled template views", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22737" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22745", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.7, 6.2.18", "title": "spring-webflux: Spring MVC and Spring WebFlux: Denial of Service via slow static resource resolution on Windows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41841", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring MVC and WebFlux applications: Information Disclosure via static resource resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41841" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41843", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "spring-webflux: spring-webmvc: Spring Framework: Information Disclosure via Path Traversal", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41843" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41844", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Open Redirect via crafted link", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41846", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Cross-site scripting (XSS) via user-supplied values in JSP form tags", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41846" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41853", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Request smuggling vulnerability in Spring MVC and WebFlux", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41853" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r17", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r16", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-58251", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In netstat in BusyBox through 1.37.0, local users can launch of networ ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-58251" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-46394", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hid ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46394" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-46394", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hid ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46394" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2024-12801", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.13, 1.3.15", "title": "logback-core: SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12801" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-10532", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.34", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-10532" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-1225", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.25", "title": "ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-1225" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-9828", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.33", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9828" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-13176", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r0", "title": "openssl: Timing side-channel in ECDSA signature computation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-2511", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.4-r6", "title": "openssl: Unbounded memory growth with session handling in TLSv1.3", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-2511" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4603", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.5-r0", "title": "openssl: Excessive time spent checking DSA keys and parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4603" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4741", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.6-r0", "title": "openssl: Use After Free with SSL_free_buffers", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-5535", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.6-r0", "title": "openssl: SSL_select_next_proto buffer overread", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-5535" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-9143", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.7-r1", "title": "openssl: Low-level invalid GF(2^m) parameters lead to OOB memory access", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-9143" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-9232", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r1", "title": "openssl: Out-of-bounds read in HTTP client no_proxy handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9232" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-13176", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r0", "title": "openssl: Timing side-channel in ECDSA signature computation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-2511", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.4-r6", "title": "openssl: Unbounded memory growth with session handling in TLSv1.3", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-2511" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4603", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.5-r0", "title": "openssl: Excessive time spent checking DSA keys and parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4603" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4741", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.6-r0", "title": "openssl: Use After Free with SSL_free_buffers", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-5535", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.6-r0", "title": "openssl: SSL_select_next_proto buffer overread", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-5535" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-9143", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.7-r1", "title": "openssl: Low-level invalid GF(2^m) parameters lead to OOB memory access", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-9143" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-9232", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r1", "title": "openssl: Out-of-bounds read in HTTP client no_proxy handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9232" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-31651", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.104, 10.1.40, 11.0.6", "title": "tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31651" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-46701", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.105, 10.1.41, 11.0.7", "title": "tomcat: Apache Tomcat: Security constraint bypass for CGI scripts", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46701" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-55754", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.11, 10.1.45, 9.0.109", "title": "org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55754" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-61795", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.12, 10.1.47, 9.0.110", "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-61795" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-43514", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-22233", "package": "org.springframework:spring-context", "installed_version": "6.1.1", "fixed_version": "6.2.7, 6.1.20", "title": "CVE-2024-38820 ensured Locale-independent, lowercase conversion for bo ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22233" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41848", "package": "org.springframework:spring-core", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Regular Expression Denial of Service in AntPathMatcher", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41848" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41852", "package": "org.springframework:spring-expression", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: org.springframework/spring-expression: Spring Framework: SpEL vulnerability allows unintended application logic invocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41852" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22735", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.6, 6.2.17", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring MVC and WebFlux: Stream corruption vulnerability when using Server-Sent Events", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22735" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22741", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.7, 6.2.18", "title": "Spring MVC: Spring WebFlux: Spring MVC and Spring WebFlux: Denial of Service via cache poisoning", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-46394", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hid ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46394" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0", "vulnerability_count": 171, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-45491", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.3-r0", "title": "libexpat: Integer Overflow or Wraparound", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45491" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-45492", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.3-r0", "title": "libexpat: integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45492" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2025-24813", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.3, 10.1.35, 9.0.99", "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-24813" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-1597", "package": "org.postgresql:postgresql", "installed_version": "42.6.0", "fixed_version": "42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2", "title": "pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-1597" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-38821", "package": "org.springframework.security:spring-security-web", "installed_version": "6.2.0", "fixed_version": "5.7.13, 5.8.15, 6.2.7, 6.0.13, 6.1.11, 6.3.4", "title": "Spring-WebFlux: Authorization Bypass of Static Resources in WebFlux Applications", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38821" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-22732", "package": "org.springframework.security:spring-security-web", "installed_version": "6.2.0", "fixed_version": "6.5.9, 7.0.4", "title": "Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22732" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-0840", "package": "binutils", "installed_version": "2.41-r0", "fixed_version": "2.41-r1", "title": "binutils: GNU Binutils objdump.c disassemble_bytes stack-based overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-0840" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-6378", "package": "ch.qos.logback:logback-classic", "installed_version": "1.4.11", "fixed_version": "1.3.12, 1.4.12, 1.2.13", "title": "logback: serialization vulnerability in logback receiver", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6378" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-6378", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.3.12, 1.4.12, 1.2.13", "title": "logback: serialization vulnerability in logback receiver", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6378" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.15.3", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.15.3", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "33.0.0-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48734", "package": "commons-beanutils:commons-beanutils", "installed_version": "1.9.4", "fixed_version": "1.11.0", "title": "commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48976", "package": "commons-fileupload:commons-fileupload", "installed_version": "1.5", "fixed_version": "1.6.0", "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48976" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.12.0", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-6119", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.7-r0", "title": "openssl: Possible denial of service in X.509 name checks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-6119" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2023-52425", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.0-r0", "title": "expat: parsing large tokens can trigger a denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-52425" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-28757", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.2-r0", "title": "expat: XML Entity Expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-28757" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-45490", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.3-r0", "title": "libexpat: Negative Length Parsing Vulnerability in libexpat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45490" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-59375", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.7.2-r0", "title": "firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-59375" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-6119", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.7-r0", "title": "openssl: Possible denial of service in X.509 name checks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-6119" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-26519", "package": "musl", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r5", "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-26519" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-40200", "package": "musl", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r6", "title": "musl: musl libc: Arbitrary code execution and denial of service via stack-based memory corruption in qsort", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40200" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-26519", "package": "musl-utils", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r5", "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-26519" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-40200", "package": "musl-utils", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r6", "title": "musl: musl libc: Arbitrary code execution and denial of service via stack-based memory corruption in qsort", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40200" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-34750", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.0-M21, 10.1.25, 9.0.90", "title": "tomcat: Improper Handling of Exceptional Conditions", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-34750" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38286", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.0-M21, 10.1.25, 9.0.90", "title": "tomcat: Denial of Service in Tomcat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38286" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-50379", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.2, 10.1.34, 9.0.98", "title": "tomcat: RCE due to TOCTOU issue in JSP compilation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-50379" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-56337", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.2, 10.1.34, 9.0.98", "title": "tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-56337" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48988", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "tomcat: Apache Tomcat DoS in multipart upload", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48988" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48989", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.10, 10.1.44, 9.0.108", "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48989" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-52520", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.9, 10.1.43, 9.0.107", "title": "tomcat: Apache Tomcat denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-52520" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-53506", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.107, 10.1.43, 11.0.9", "title": "tomcat: Apache Tomcat denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-53506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-55752", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.11, 10.1.45, 9.0.109", "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55752" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24734", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.18, 10.1.52, 9.0.115", "title": "tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24880", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.116, 10.1.52, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24880" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34483", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.116, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34483" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34487", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.117, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34487" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41284", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41284" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42498", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42498" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-43513", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2022-45688", "package": "org.json:json", "installed_version": "20170516", "fixed_version": "20230227", "title": "json stack overflow vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-45688" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-5072", "package": "org.json:json", "installed_version": "20170516", "fixed_version": "20231013", "title": "JSON-java: parser confusion leads to OOM", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5072" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42198", "package": "org.postgresql:postgresql", "installed_version": "42.6.0", "fixed_version": "42.7.11", "title": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42198" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-22235", "package": "org.springframework.boot:spring-boot", "installed_version": "3.2.0", "fixed_version": "3.3.11, 3.4.5", "title": "org.springframework.boot/spring-boot: Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22235" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22234", "package": "org.springframework.security:spring-security-core", "installed_version": "6.2.0", "fixed_version": "6.1.7, 6.2.2", "title": "spring-security: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22234" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22257", "package": "org.springframework.security:spring-security-core", "installed_version": "6.2.0", "fixed_version": "5.7.12, 5.8.11, 6.1.8, 6.2.3", "title": "spring-security: Broken Access Control With Direct Use of AuthenticatedVoter", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22257" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-22228", "package": "org.springframework.security:spring-security-crypto", "installed_version": "6.2.0", "fixed_version": "6.3.8, 6.4.4, 6.2.10, 6.1.14, 6.0.16, 5.8.18, 5.7.16", "title": "spring-security-core: Spring Security BCryptPasswordEncoder does not enforce maximum password length", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22228" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-41249", "package": "org.springframework:spring-core", "installed_version": "6.1.1", "fixed_version": "6.2.11", "title": "org.springframework/spring-core: Spring Framework Annotation Detection Vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41249" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41850", "package": "org.springframework:spring-expression", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service via specially crafted SpEL expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41850" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22243", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "6.1.4, 6.0.17, 5.3.32", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22243" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22259", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "6.1.5, 6.0.18, 5.3.33", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22259" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22262", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "5.3.34, 6.0.19, 6.1.6", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22262" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38816", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "6.1.13", "title": "spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38816" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38819", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "6.1.14", "title": "org.springframework:spring-webmvc: Path traversal vulnerability in functional web frameworks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38819" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41842", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service when resolving static resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41842" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41845", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "org.springframework: Spring Framework: Cross-site scripting (XSS) via incorrect JavaScript escaping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41845" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r17", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r16", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-58251", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In netstat in BusyBox through 1.37.0, local users can launch of networ ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-58251" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r17", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r16", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-58251", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In netstat in BusyBox through 1.37.0, local users can launch of networ ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-58251" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-12798", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.13, 1.3.15", "title": "logback-core: arbitrary code execution via JaninoEventEvaluator", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12798" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-11226", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.19, 1.3.16", "title": "ch.qos.logback/logback-core: Conditional abitrary code execution in logback-core", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-11226" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18401", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.15.3", "fixed_version": "2.21.1, 2.18.6", "title": "tools.jackson.core/jackson-core: com.fasterxml.jackson.core/jackson-core: jackson-core: Denial of Service due to number length bypass in asynchronous JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18401" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59888", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-9230", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r1", "title": "openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9230" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-52426", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.0-r0", "title": "expat: recursive XML entity expansion vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-52426" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-50602", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.4-r0", "title": "libexpat: expat: DoS via XML_ResumeParser", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-50602" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-8176", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.7.0-r0", "title": "libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-8176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-9230", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r1", "title": "openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9230" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-12133", "package": "libtasn1", "installed_version": "4.19.0-r2", "fixed_version": "4.20.0-r0", "title": "libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoS", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12133" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6042", "package": "musl", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r6", "title": "musl libc: GB18030 4-byte Decoder: musl libc: Denial of Service via inefficient algorithmic complexity in iconv", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6042" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6042", "package": "musl-utils", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r6", "title": "musl libc: GB18030 4-byte Decoder: musl libc: Denial of Service via inefficient algorithmic complexity in iconv", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6042" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-25710", "package": "org.apache.commons:commons-compress", "installed_version": "1.25.0", "fixed_version": "1.26.0", "title": "commons-compress: Denial of service caused by an infinite loop for a corrupted DUMP file", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-25710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-26308", "package": "org.apache.commons:commons-compress", "installed_version": "1.25.0", "fixed_version": "1.26.0", "title": "commons-compress: OutOfMemoryError unpacking broken Pack200 file", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-26308" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-48924", "package": "org.apache.commons:commons-lang3", "installed_version": "3.13.0", "fixed_version": "3.18.0", "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48924" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49844", "package": "org.apache.logging.log4j:log4j-api", "installed_version": "2.21.1", "fixed_version": "2.25.5, 2.26.1", "title": "org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-31672", "package": "org.apache.poi:poi-ooxml", "installed_version": "5.2.5", "fixed_version": "5.4.0", "title": "org.apache.poi/poi-ooxml: Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31672" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-24549", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "8.5.99, 9.0.86, 10.1.19, 11.0.0-M17", "title": "Tomcat: HTTP/2 header handling DoS", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-24549" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-31650", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.104, 10.1.40, 11.0.6", "title": "tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31650" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-49124", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "Apache Tomcat installer for Windows has an untrusted search path vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49124" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-49125", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49125" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-55668", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55668" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-66614", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.15, 10.1.50, 9.0.113", "title": "tomcat: Client certificate verification bypass due to virtual host mapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-66614" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-25854", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.116, 10.1.53, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-25854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-23672", "package": "org.apache.tomcat.embed:tomcat-embed-websocket", "installed_version": "10.1.16", "fixed_version": "11.0.0-M17, 10.1.19, 9.0.86, 8.5.99", "title": "Tomcat: WebSocket DoS with incomplete closing handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-23672" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-7962", "package": "org.eclipse.angus:smtp", "installed_version": "2.0.2", "fixed_version": "2.0.4", "title": "com.sun.mail/jakarta.mail: Jakarta Mail SMTP Injection Vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-7962" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41711", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.2.0", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via parsing Sort parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41711" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41721", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.2.0", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via specially crafted HTTP request with @ProjectedPayload", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41721" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41710", "package": "org.springframework.retry:spring-retry", "installed_version": "2.0.4", "fixed_version": "2.0.13", "title": "spring-retry: Spring Retry: Denial of Service via cache exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38827", "package": "org.springframework.security:spring-security-core", "installed_version": "6.2.0", "fixed_version": "5.7.14, 5.8.16, 6.0.14, 6.1.12, 6.2.8, 6.3.5", "title": "spring-security: authorization bypass for case sensitive comparisons", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38827" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47838", "package": "org.springframework.security:spring-security-web", "installed_version": "6.2.0", "fixed_version": "6.5.11", "title": "Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47838" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38820", "package": "org.springframework:spring-context", "installed_version": "6.1.1", "fixed_version": "6.1.14", "title": "The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38820" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41851", "package": "org.springframework:spring-expression", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Denial of Service via unbounded cache growth in SpEL evaluation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41851" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38809", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "5.3.38, 6.0.23, 6.1.12", "title": "org.springframework:spring-web: Spring Framework DoS via conditional HTTP request", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38809" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38820", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "6.1.14", "title": "The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38820" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-41234", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "6.2.8, 6.1.21", "title": "springframework: Reflected download attack in Spring Framework with non-ASCII headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41234" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-41242", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "6.2.10", "title": "org.springframework/spring-webmvc: Spring Framework MVC path traversal vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41242" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22737", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.6, 6.2.17", "title": "Spring Framework: Spring Framework: Information disclosure via Java scripting engine enabled template views", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22737" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22745", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.7, 6.2.18", "title": "spring-webflux: Spring MVC and Spring WebFlux: Denial of Service via slow static resource resolution on Windows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41841", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring MVC and WebFlux applications: Information Disclosure via static resource resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41841" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41843", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "spring-webflux: spring-webmvc: Spring Framework: Information Disclosure via Path Traversal", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41843" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41844", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Open Redirect via crafted link", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41846", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Cross-site scripting (XSS) via user-supplied values in JSP form tags", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41846" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41853", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Request smuggling vulnerability in Spring MVC and WebFlux", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41853" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r17", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r16", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-58251", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In netstat in BusyBox through 1.37.0, local users can launch of networ ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-58251" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-46394", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hid ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46394" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-46394", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hid ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46394" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2024-12801", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.13, 1.3.15", "title": "logback-core: SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12801" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-10532", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.34", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-10532" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-1225", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.25", "title": "ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-1225" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-9828", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.33", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9828" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-13176", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r0", "title": "openssl: Timing side-channel in ECDSA signature computation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-2511", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.4-r6", "title": "openssl: Unbounded memory growth with session handling in TLSv1.3", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-2511" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4603", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.5-r0", "title": "openssl: Excessive time spent checking DSA keys and parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4603" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4741", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.6-r0", "title": "openssl: Use After Free with SSL_free_buffers", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-5535", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.6-r0", "title": "openssl: SSL_select_next_proto buffer overread", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-5535" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-9143", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.7-r1", "title": "openssl: Low-level invalid GF(2^m) parameters lead to OOB memory access", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-9143" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-9232", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r1", "title": "openssl: Out-of-bounds read in HTTP client no_proxy handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9232" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-13176", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r0", "title": "openssl: Timing side-channel in ECDSA signature computation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-2511", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.4-r6", "title": "openssl: Unbounded memory growth with session handling in TLSv1.3", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-2511" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4603", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.5-r0", "title": "openssl: Excessive time spent checking DSA keys and parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4603" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4741", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.6-r0", "title": "openssl: Use After Free with SSL_free_buffers", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-5535", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.6-r0", "title": "openssl: SSL_select_next_proto buffer overread", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-5535" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-9143", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.7-r1", "title": "openssl: Low-level invalid GF(2^m) parameters lead to OOB memory access", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-9143" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-9232", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r1", "title": "openssl: Out-of-bounds read in HTTP client no_proxy handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9232" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-31651", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.104, 10.1.40, 11.0.6", "title": "tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31651" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-46701", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.105, 10.1.41, 11.0.7", "title": "tomcat: Apache Tomcat: Security constraint bypass for CGI scripts", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46701" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-55754", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.11, 10.1.45, 9.0.109", "title": "org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55754" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-61795", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.12, 10.1.47, 9.0.110", "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-61795" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-43514", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-22233", "package": "org.springframework:spring-context", "installed_version": "6.1.1", "fixed_version": "6.2.7, 6.1.20", "title": "CVE-2024-38820 ensured Locale-independent, lowercase conversion for bo ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22233" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41848", "package": "org.springframework:spring-core", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Regular Expression Denial of Service in AntPathMatcher", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41848" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41852", "package": "org.springframework:spring-expression", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: org.springframework/spring-expression: Spring Framework: SpEL vulnerability allows unintended application logic invocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41852" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22735", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.6, 6.2.17", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring MVC and WebFlux: Stream corruption vulnerability when using Server-Sent Events", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22735" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22741", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.7, 6.2.18", "title": "Spring MVC: Spring WebFlux: Spring MVC and Spring WebFlux: Denial of Service via cache poisoning", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.1.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-46394", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hid ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46394" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0", "vulnerability_count": 171, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-45491", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.3-r0", "title": "libexpat: Integer Overflow or Wraparound", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45491" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-45492", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.3-r0", "title": "libexpat: integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45492" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2025-24813", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.3, 10.1.35, 9.0.99", "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-24813" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-1597", "package": "org.postgresql:postgresql", "installed_version": "42.6.0", "fixed_version": "42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2", "title": "pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-1597" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-38821", "package": "org.springframework.security:spring-security-web", "installed_version": "6.2.0", "fixed_version": "5.7.13, 5.8.15, 6.2.7, 6.0.13, 6.1.11, 6.3.4", "title": "Spring-WebFlux: Authorization Bypass of Static Resources in WebFlux Applications", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38821" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-22732", "package": "org.springframework.security:spring-security-web", "installed_version": "6.2.0", "fixed_version": "6.5.9, 7.0.4", "title": "Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22732" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.2.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-0840", "package": "binutils", "installed_version": "2.41-r0", "fixed_version": "2.41-r1", "title": "binutils: GNU Binutils objdump.c disassemble_bytes stack-based overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-0840" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-6378", "package": "ch.qos.logback:logback-classic", "installed_version": "1.4.11", "fixed_version": "1.3.12, 1.4.12, 1.2.13", "title": "logback: serialization vulnerability in logback receiver", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6378" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-6378", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.3.12, 1.4.12, 1.2.13", "title": "logback: serialization vulnerability in logback receiver", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6378" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.15.3", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.15.3", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "32.1.3-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48734", "package": "commons-beanutils:commons-beanutils", "installed_version": "1.9.4", "fixed_version": "1.11.0", "title": "commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48976", "package": "commons-fileupload:commons-fileupload", "installed_version": "1.5", "fixed_version": "1.6.0", "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48976" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.12.0", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-6119", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.7-r0", "title": "openssl: Possible denial of service in X.509 name checks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-6119" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2023-52425", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.0-r0", "title": "expat: parsing large tokens can trigger a denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-52425" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-28757", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.2-r0", "title": "expat: XML Entity Expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-28757" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-45490", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.3-r0", "title": "libexpat: Negative Length Parsing Vulnerability in libexpat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45490" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-59375", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.7.2-r0", "title": "firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-59375" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-6119", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.7-r0", "title": "openssl: Possible denial of service in X.509 name checks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-6119" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-26519", "package": "musl", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r5", "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-26519" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-40200", "package": "musl", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r6", "title": "musl: musl libc: Arbitrary code execution and denial of service via stack-based memory corruption in qsort", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40200" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-26519", "package": "musl-utils", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r5", "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-26519" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-40200", "package": "musl-utils", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r6", "title": "musl: musl libc: Arbitrary code execution and denial of service via stack-based memory corruption in qsort", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40200" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-34750", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.0-M21, 10.1.25, 9.0.90", "title": "tomcat: Improper Handling of Exceptional Conditions", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-34750" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38286", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.0-M21, 10.1.25, 9.0.90", "title": "tomcat: Denial of Service in Tomcat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38286" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-50379", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.2, 10.1.34, 9.0.98", "title": "tomcat: RCE due to TOCTOU issue in JSP compilation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-50379" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-56337", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.2, 10.1.34, 9.0.98", "title": "tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-56337" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48988", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "tomcat: Apache Tomcat DoS in multipart upload", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48988" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48989", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.10, 10.1.44, 9.0.108", "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48989" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-52520", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.9, 10.1.43, 9.0.107", "title": "tomcat: Apache Tomcat denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-52520" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-53506", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.107, 10.1.43, 11.0.9", "title": "tomcat: Apache Tomcat denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-53506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-55752", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.11, 10.1.45, 9.0.109", "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55752" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24734", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.18, 10.1.52, 9.0.115", "title": "tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24880", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.116, 10.1.52, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24880" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34483", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.116, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34483" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34487", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.117, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34487" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41284", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41284" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42498", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42498" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-43513", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2022-45688", "package": "org.json:json", "installed_version": "20170516", "fixed_version": "20230227", "title": "json stack overflow vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-45688" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-5072", "package": "org.json:json", "installed_version": "20170516", "fixed_version": "20231013", "title": "JSON-java: parser confusion leads to OOM", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5072" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42198", "package": "org.postgresql:postgresql", "installed_version": "42.6.0", "fixed_version": "42.7.11", "title": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42198" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-22235", "package": "org.springframework.boot:spring-boot", "installed_version": "3.2.0", "fixed_version": "3.3.11, 3.4.5", "title": "org.springframework.boot/spring-boot: Spring Boot EndpointRequest.to() creates wrong matcher if actuator endpoint is not exposed", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22235" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22234", "package": "org.springframework.security:spring-security-core", "installed_version": "6.2.0", "fixed_version": "6.1.7, 6.2.2", "title": "spring-security: Broken Access Control in Spring Security With Direct Use of isFullyAuthenticated", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22234" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22257", "package": "org.springframework.security:spring-security-core", "installed_version": "6.2.0", "fixed_version": "5.7.12, 5.8.11, 6.1.8, 6.2.3", "title": "spring-security: Broken Access Control With Direct Use of AuthenticatedVoter", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22257" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-22228", "package": "org.springframework.security:spring-security-crypto", "installed_version": "6.2.0", "fixed_version": "6.3.8, 6.4.4, 6.2.10, 6.1.14, 6.0.16, 5.8.18, 5.7.16", "title": "spring-security-core: Spring Security BCryptPasswordEncoder does not enforce maximum password length", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22228" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-41249", "package": "org.springframework:spring-core", "installed_version": "6.1.1", "fixed_version": "6.2.11", "title": "org.springframework/spring-core: Spring Framework Annotation Detection Vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41249" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41850", "package": "org.springframework:spring-expression", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service via specially crafted SpEL expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41850" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22243", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "6.1.4, 6.0.17, 5.3.32", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22243" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22259", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "6.1.5, 6.0.18, 5.3.33", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22259" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22262", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "5.3.34, 6.0.19, 6.1.6", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22262" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38816", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "6.1.13", "title": "spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38816" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38819", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "6.1.14", "title": "org.springframework:spring-webmvc: Path traversal vulnerability in functional web frameworks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38819" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41842", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service when resolving static resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41842" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41845", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "org.springframework: Spring Framework: Cross-site scripting (XSS) via incorrect JavaScript escaping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41845" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r17", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r16", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-58251", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In netstat in BusyBox through 1.37.0, local users can launch of networ ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-58251" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r17", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r16", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-58251", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In netstat in BusyBox through 1.37.0, local users can launch of networ ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-58251" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-12798", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.13, 1.3.15", "title": "logback-core: arbitrary code execution via JaninoEventEvaluator", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12798" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-11226", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.19, 1.3.16", "title": "ch.qos.logback/logback-core: Conditional abitrary code execution in logback-core", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-11226" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18401", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.15.3", "fixed_version": "2.21.1, 2.18.6", "title": "tools.jackson.core/jackson-core: com.fasterxml.jackson.core/jackson-core: jackson-core: Denial of Service due to number length bypass in asynchronous JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18401" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59888", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.15.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-9230", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r1", "title": "openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9230" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-52426", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.0-r0", "title": "expat: recursive XML entity expansion vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-52426" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-50602", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.4-r0", "title": "libexpat: expat: DoS via XML_ResumeParser", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-50602" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-8176", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.7.0-r0", "title": "libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-8176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-9230", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r1", "title": "openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9230" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-12133", "package": "libtasn1", "installed_version": "4.19.0-r2", "fixed_version": "4.20.0-r0", "title": "libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoS", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12133" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6042", "package": "musl", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r6", "title": "musl libc: GB18030 4-byte Decoder: musl libc: Denial of Service via inefficient algorithmic complexity in iconv", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6042" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6042", "package": "musl-utils", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r6", "title": "musl libc: GB18030 4-byte Decoder: musl libc: Denial of Service via inefficient algorithmic complexity in iconv", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6042" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-25710", "package": "org.apache.commons:commons-compress", "installed_version": "1.24.0", "fixed_version": "1.26.0", "title": "commons-compress: Denial of service caused by an infinite loop for a corrupted DUMP file", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-25710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-26308", "package": "org.apache.commons:commons-compress", "installed_version": "1.24.0", "fixed_version": "1.26.0", "title": "commons-compress: OutOfMemoryError unpacking broken Pack200 file", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-26308" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-48924", "package": "org.apache.commons:commons-lang3", "installed_version": "3.13.0", "fixed_version": "3.18.0", "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48924" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49844", "package": "org.apache.logging.log4j:log4j-api", "installed_version": "2.21.1", "fixed_version": "2.25.5, 2.26.1", "title": "org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-31672", "package": "org.apache.poi:poi-ooxml", "installed_version": "5.2.4", "fixed_version": "5.4.0", "title": "org.apache.poi/poi-ooxml: Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31672" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-24549", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "8.5.99, 9.0.86, 10.1.19, 11.0.0-M17", "title": "Tomcat: HTTP/2 header handling DoS", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-24549" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-31650", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.104, 10.1.40, 11.0.6", "title": "tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31650" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-49124", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "Apache Tomcat installer for Windows has an untrusted search path vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49124" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-49125", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49125" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-55668", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55668" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-66614", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.15, 10.1.50, 9.0.113", "title": "tomcat: Client certificate verification bypass due to virtual host mapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-66614" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-25854", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.116, 10.1.53, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-25854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-23672", "package": "org.apache.tomcat.embed:tomcat-embed-websocket", "installed_version": "10.1.16", "fixed_version": "11.0.0-M17, 10.1.19, 9.0.86, 8.5.99", "title": "Tomcat: WebSocket DoS with incomplete closing handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-23672" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-7962", "package": "org.eclipse.angus:smtp", "installed_version": "2.0.2", "fixed_version": "2.0.4", "title": "com.sun.mail/jakarta.mail: Jakarta Mail SMTP Injection Vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-7962" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41711", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.2.0", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via parsing Sort parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41711" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41721", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.2.0", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via specially crafted HTTP request with @ProjectedPayload", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41721" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41710", "package": "org.springframework.retry:spring-retry", "installed_version": "2.0.4", "fixed_version": "2.0.13", "title": "spring-retry: Spring Retry: Denial of Service via cache exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38827", "package": "org.springframework.security:spring-security-core", "installed_version": "6.2.0", "fixed_version": "5.7.14, 5.8.16, 6.0.14, 6.1.12, 6.2.8, 6.3.5", "title": "spring-security: authorization bypass for case sensitive comparisons", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38827" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47838", "package": "org.springframework.security:spring-security-web", "installed_version": "6.2.0", "fixed_version": "6.5.11", "title": "Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47838" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38820", "package": "org.springframework:spring-context", "installed_version": "6.1.1", "fixed_version": "6.1.14", "title": "The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38820" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41851", "package": "org.springframework:spring-expression", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Denial of Service via unbounded cache growth in SpEL evaluation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41851" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38809", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "5.3.38, 6.0.23, 6.1.12", "title": "org.springframework:spring-web: Spring Framework DoS via conditional HTTP request", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38809" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38820", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "6.1.14", "title": "The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38820" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-41234", "package": "org.springframework:spring-web", "installed_version": "6.1.1", "fixed_version": "6.2.8, 6.1.21", "title": "springframework: Reflected download attack in Spring Framework with non-ASCII headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41234" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-41242", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "6.2.10", "title": "org.springframework/spring-webmvc: Spring Framework MVC path traversal vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41242" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22737", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.6, 6.2.17", "title": "Spring Framework: Spring Framework: Information disclosure via Java scripting engine enabled template views", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22737" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22745", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.7, 6.2.18", "title": "spring-webflux: Spring MVC and Spring WebFlux: Denial of Service via slow static resource resolution on Windows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41841", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring MVC and WebFlux applications: Information Disclosure via static resource resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41841" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41843", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "spring-webflux: spring-webmvc: Spring Framework: Information Disclosure via Path Traversal", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41843" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41844", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Open Redirect via crafted link", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41846", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Cross-site scripting (XSS) via user-supplied values in JSP form tags", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41846" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41853", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Request smuggling vulnerability in Spring MVC and WebFlux", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41853" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r17", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r16", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-58251", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In netstat in BusyBox through 1.37.0, local users can launch of networ ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-58251" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-46394", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hid ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46394" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-46394", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hid ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46394" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2024-12801", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.13, 1.3.15", "title": "logback-core: SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12801" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-10532", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.34", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-10532" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-1225", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.25", "title": "ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-1225" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-9828", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.11", "fixed_version": "1.5.33", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9828" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-13176", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r0", "title": "openssl: Timing side-channel in ECDSA signature computation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-2511", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.4-r6", "title": "openssl: Unbounded memory growth with session handling in TLSv1.3", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-2511" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4603", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.5-r0", "title": "openssl: Excessive time spent checking DSA keys and parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4603" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4741", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.6-r0", "title": "openssl: Use After Free with SSL_free_buffers", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-5535", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.6-r0", "title": "openssl: SSL_select_next_proto buffer overread", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-5535" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-9143", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.7-r1", "title": "openssl: Low-level invalid GF(2^m) parameters lead to OOB memory access", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-9143" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-9232", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r1", "title": "openssl: Out-of-bounds read in HTTP client no_proxy handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9232" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-13176", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r0", "title": "openssl: Timing side-channel in ECDSA signature computation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-2511", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.4-r6", "title": "openssl: Unbounded memory growth with session handling in TLSv1.3", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-2511" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4603", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.5-r0", "title": "openssl: Excessive time spent checking DSA keys and parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4603" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4741", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.6-r0", "title": "openssl: Use After Free with SSL_free_buffers", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-5535", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.6-r0", "title": "openssl: SSL_select_next_proto buffer overread", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-5535" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-9143", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.7-r1", "title": "openssl: Low-level invalid GF(2^m) parameters lead to OOB memory access", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-9143" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-9232", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r1", "title": "openssl: Out-of-bounds read in HTTP client no_proxy handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9232" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-31651", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.104, 10.1.40, 11.0.6", "title": "tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31651" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-46701", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.105, 10.1.41, 11.0.7", "title": "tomcat: Apache Tomcat: Security constraint bypass for CGI scripts", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46701" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-55754", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.11, 10.1.45, 9.0.109", "title": "org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55754" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-61795", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "11.0.12, 10.1.47, 9.0.110", "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-61795" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-43514", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.16", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-22233", "package": "org.springframework:spring-context", "installed_version": "6.1.1", "fixed_version": "6.2.7, 6.1.20", "title": "CVE-2024-38820 ensured Locale-independent, lowercase conversion for bo ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22233" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41848", "package": "org.springframework:spring-core", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Regular Expression Denial of Service in AntPathMatcher", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41848" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41852", "package": "org.springframework:spring-expression", "installed_version": "6.1.1", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: org.springframework/spring-expression: Spring Framework: SpEL vulnerability allows unintended application logic invocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41852" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22735", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.6, 6.2.17", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring MVC and WebFlux: Stream corruption vulnerability when using Server-Sent Events", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22735" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22741", "package": "org.springframework:spring-webmvc", "installed_version": "6.1.1", "fixed_version": "7.0.7, 6.2.18", "title": "Spring MVC: Spring WebFlux: Spring MVC and Spring WebFlux: Denial of Service via cache poisoning", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:24.0.0 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-46394", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hid ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46394" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1", "vulnerability_count": 167, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-45491", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.3-r0", "title": "libexpat: Integer Overflow or Wraparound", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45491" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-45492", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.3-r0", "title": "libexpat: integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45492" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2025-24813", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.3, 10.1.35, 9.0.99", "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-24813" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-1597", "package": "org.postgresql:postgresql", "installed_version": "42.5.4", "fixed_version": "42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2", "title": "pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-1597" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-38821", "package": "org.springframework.security:spring-security-web", "installed_version": "6.0.5", "fixed_version": "5.7.13, 5.8.15, 6.2.7, 6.0.13, 6.1.11, 6.3.4", "title": "Spring-WebFlux: Authorization Bypass of Static Resources in WebFlux Applications", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38821" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-22732", "package": "org.springframework.security:spring-security-web", "installed_version": "6.0.5", "fixed_version": "6.5.9, 7.0.4", "title": "Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22732" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-0840", "package": "binutils", "installed_version": "2.41-r0", "fixed_version": "2.41-r1", "title": "binutils: GNU Binutils objdump.c disassemble_bytes stack-based overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-0840" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-6378", "package": "ch.qos.logback:logback-classic", "installed_version": "1.4.8", "fixed_version": "1.3.12, 1.4.12, 1.2.13", "title": "logback: serialization vulnerability in logback receiver", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6378" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-6378", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.3.12, 1.4.12, 1.2.13", "title": "logback: serialization vulnerability in logback receiver", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6378" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-52999", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.14.3", "fixed_version": "2.15.0", "title": "com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-52999" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.14.3", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.14.3", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "31.1-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48734", "package": "commons-beanutils:commons-beanutils", "installed_version": "1.9.4", "fixed_version": "1.11.0", "title": "commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48976", "package": "commons-fileupload:commons-fileupload", "installed_version": "1.5", "fixed_version": "1.6.0", "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48976" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-47554", "package": "commons-io:commons-io", "installed_version": "2.11.0", "fixed_version": "2.14.0", "title": "apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-47554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.10.9", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-6119", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.7-r0", "title": "openssl: Possible denial of service in X.509 name checks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-6119" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2023-52425", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.0-r0", "title": "expat: parsing large tokens can trigger a denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-52425" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-28757", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.2-r0", "title": "expat: XML Entity Expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-28757" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-45490", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.3-r0", "title": "libexpat: Negative Length Parsing Vulnerability in libexpat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45490" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-59375", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.7.2-r0", "title": "firefox: thunderbird: expat: libexpat in Expat allows attackers to trigger large dynamic memory allocations via a small document that is submitted for parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-59375" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-6119", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.7-r0", "title": "openssl: Possible denial of service in X.509 name checks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-6119" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-26519", "package": "musl", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r5", "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-26519" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-40200", "package": "musl", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r6", "title": "musl: musl libc: Arbitrary code execution and denial of service via stack-based memory corruption in qsort", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40200" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-26519", "package": "musl-utils", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r5", "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-26519" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-40200", "package": "musl-utils", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r6", "title": "musl: musl libc: Arbitrary code execution and denial of service via stack-based memory corruption in qsort", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40200" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-46589", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.0-M11, 10.1.16, 9.0.83, 8.5.96", "title": "tomcat: HTTP request smuggling via malformed trailer headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-46589" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-34750", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.0-M21, 10.1.25, 9.0.90", "title": "tomcat: Improper Handling of Exceptional Conditions", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-34750" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38286", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.0-M21, 10.1.25, 9.0.90", "title": "tomcat: Denial of Service in Tomcat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38286" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-50379", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.2, 10.1.34, 9.0.98", "title": "tomcat: RCE due to TOCTOU issue in JSP compilation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-50379" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-56337", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.2, 10.1.34, 9.0.98", "title": "tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-56337" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48988", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "tomcat: Apache Tomcat DoS in multipart upload", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48988" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48989", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.10, 10.1.44, 9.0.108", "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48989" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-52520", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.9, 10.1.43, 9.0.107", "title": "tomcat: Apache Tomcat denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-52520" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-53506", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.107, 10.1.43, 11.0.9", "title": "tomcat: Apache Tomcat denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-53506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-55752", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.11, 10.1.45, 9.0.109", "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55752" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24734", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.18, 10.1.52, 9.0.115", "title": "tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24880", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.116, 10.1.52, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24880" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34483", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.116, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34483" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34487", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.117, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34487" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41284", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41284" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42498", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42498" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-43513", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2022-45688", "package": "org.json:json", "installed_version": "20170516", "fixed_version": "20230227", "title": "json stack overflow vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-45688" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-5072", "package": "org.json:json", "installed_version": "20170516", "fixed_version": "20231013", "title": "JSON-java: parser confusion leads to OOM", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5072" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42198", "package": "org.postgresql:postgresql", "installed_version": "42.5.4", "fixed_version": "42.7.11", "title": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42198" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22257", "package": "org.springframework.security:spring-security-core", "installed_version": "6.0.5", "fixed_version": "5.7.12, 5.8.11, 6.1.8, 6.2.3", "title": "spring-security: Broken Access Control With Direct Use of AuthenticatedVoter", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22257" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-22228", "package": "org.springframework.security:spring-security-crypto", "installed_version": "6.0.5", "fixed_version": "6.3.8, 6.4.4, 6.2.10, 6.1.14, 6.0.16, 5.8.18, 5.7.16", "title": "spring-security-core: Spring Security BCryptPasswordEncoder does not enforce maximum password length", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22228" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-41249", "package": "org.springframework:spring-core", "installed_version": "6.0.11", "fixed_version": "6.2.11", "title": "org.springframework/spring-core: Spring Framework Annotation Detection Vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41249" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22243", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "6.1.4, 6.0.17, 5.3.32", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22243" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22259", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "6.1.5, 6.0.18, 5.3.33", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22259" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22262", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "5.3.34, 6.0.19, 6.1.6", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22262" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-34053", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "6.0.14", "title": "springframework: io.micrometer: micrometer-core classpath vulnerable to denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-34053" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38816", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "6.1.13", "title": "spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38816" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38819", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "6.1.14", "title": "org.springframework:spring-webmvc: Path traversal vulnerability in functional web frameworks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38819" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2022-1471", "package": "org.yaml:snakeyaml", "installed_version": "1.33", "fixed_version": "2.0", "title": "SnakeYaml: Constructor Deserialization Remote Code Execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-1471" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r17", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r16", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-58251", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In netstat in BusyBox through 1.37.0, local users can launch of networ ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-58251" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r17", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r16", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-58251", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In netstat in BusyBox through 1.37.0, local users can launch of networ ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-58251" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-12798", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.13, 1.3.15", "title": "logback-core: arbitrary code execution via JaninoEventEvaluator", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12798" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-11226", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.19, 1.3.16", "title": "ch.qos.logback/logback-core: Conditional abitrary code execution in logback-core", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-11226" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-2976", "package": "com.google.guava:guava", "installed_version": "31.1-jre", "fixed_version": "32.0.0-android", "title": "guava: insecure temporary directory creation", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-2976" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-9230", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r1", "title": "openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9230" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-52426", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.0-r0", "title": "expat: recursive XML entity expansion vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-52426" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-50602", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.6.4-r0", "title": "libexpat: expat: DoS via XML_ResumeParser", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-50602" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-8176", "package": "libexpat", "installed_version": "2.5.0-r2", "fixed_version": "2.7.0-r0", "title": "libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-8176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-9230", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r1", "title": "openssl: Out-of-bounds read & write in RFC 3211 KEK Unwrap", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9230" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-12133", "package": "libtasn1", "installed_version": "4.19.0-r2", "fixed_version": "4.20.0-r0", "title": "libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoS", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12133" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6042", "package": "musl", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r6", "title": "musl libc: GB18030 4-byte Decoder: musl libc: Denial of Service via inefficient algorithmic complexity in iconv", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6042" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6042", "package": "musl-utils", "installed_version": "1.2.4_git20230717-r4", "fixed_version": "1.2.4_git20230717-r6", "title": "musl libc: GB18030 4-byte Decoder: musl libc: Denial of Service via inefficient algorithmic complexity in iconv", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6042" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-25710", "package": "org.apache.commons:commons-compress", "installed_version": "1.21", "fixed_version": "1.26.0", "title": "commons-compress: Denial of service caused by an infinite loop for a corrupted DUMP file", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-25710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-26308", "package": "org.apache.commons:commons-compress", "installed_version": "1.21", "fixed_version": "1.26.0", "title": "commons-compress: OutOfMemoryError unpacking broken Pack200 file", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-26308" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-48924", "package": "org.apache.commons:commons-lang3", "installed_version": "3.12.0", "fixed_version": "3.18.0", "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48924" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49844", "package": "org.apache.logging.log4j:log4j-api", "installed_version": "2.19.0", "fixed_version": "2.25.5, 2.26.1", "title": "org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-31672", "package": "org.apache.poi:poi-ooxml", "installed_version": "5.2.3", "fixed_version": "5.4.0", "title": "org.apache.poi/poi-ooxml: Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31672" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-41080", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "8.5.93, 9.0.80, 10.1.13, 11.0.0-M11", "title": "tomcat: Open Redirect vulnerability in FORM authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-41080" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42795", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "10.1.14, 9.0.81, 8.5.94, 11.0.0-M12", "title": "tomcat: improper cleaning of recycled objects could lead to information leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42795" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-44487", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.0-M12, 10.1.14, 9.0.81, 8.5.94", "title": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-44487" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-45648", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.0-M12, 10.1.14, 9.0.81, 8.5.94", "title": "tomcat: incorrectly parsed http trailer headers can cause request smuggling", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-45648" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-24549", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "8.5.99, 9.0.86, 10.1.19, 11.0.0-M17", "title": "Tomcat: HTTP/2 header handling DoS", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-24549" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-31650", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.104, 10.1.40, 11.0.6", "title": "tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31650" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-49124", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "Apache Tomcat installer for Windows has an untrusted search path vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49124" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-49125", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49125" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-55668", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55668" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-66614", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.15, 10.1.50, 9.0.113", "title": "tomcat: Client certificate verification bypass due to virtual host mapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-66614" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-25854", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.116, 10.1.53, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-25854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-23672", "package": "org.apache.tomcat.embed:tomcat-embed-websocket", "installed_version": "10.1.11", "fixed_version": "11.0.0-M17, 10.1.19, 9.0.86, 8.5.99", "title": "Tomcat: WebSocket DoS with incomplete closing handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-23672" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-7962", "package": "org.eclipse.angus:smtp", "installed_version": "1.0.0", "fixed_version": "2.0.4", "title": "com.sun.mail/jakarta.mail: Jakarta Mail SMTP Injection Vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-7962" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-34055", "package": "org.springframework.boot:spring-boot-actuator", "installed_version": "3.0.9", "fixed_version": "2.7.18, 3.0.13, 3.1.6", "title": "spring-boot: org.springframework.boot: spring-boot-actuator class vulnerable to denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-34055" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41711", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.0.8", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via parsing Sort parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41711" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41721", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.0.8", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via specially crafted HTTP request with @ProjectedPayload", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41721" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41710", "package": "org.springframework.retry:spring-retry", "installed_version": "2.0.2", "fixed_version": "2.0.13", "title": "spring-retry: Spring Retry: Denial of Service via cache exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-34042", "package": "org.springframework.security:spring-security-config", "installed_version": "6.0.5", "fixed_version": "6.1.4, 6.0.7, 5.8.7, 5.7.11", "title": "spring-security-config: Incorrect Permission Assignment for spring-security.xsd", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-34042" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38827", "package": "org.springframework.security:spring-security-core", "installed_version": "6.0.5", "fixed_version": "5.7.14, 5.8.16, 6.0.14, 6.1.12, 6.2.8, 6.3.5", "title": "spring-security: authorization bypass for case sensitive comparisons", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38827" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47838", "package": "org.springframework.security:spring-security-web", "installed_version": "6.0.5", "fixed_version": "6.5.11", "title": "Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47838" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38820", "package": "org.springframework:spring-context", "installed_version": "6.0.11", "fixed_version": "6.1.14", "title": "The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38820" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38809", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "5.3.38, 6.0.23, 6.1.12", "title": "org.springframework:spring-web: Spring Framework DoS via conditional HTTP request", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38809" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38820", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "6.1.14", "title": "The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38820" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-41234", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "6.2.8, 6.1.21", "title": "springframework: Reflected download attack in Spring Framework with non-ASCII headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41234" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-41242", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "6.2.10", "title": "org.springframework/spring-webmvc: Spring Framework MVC path traversal vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41242" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22737", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "7.0.6, 6.2.17", "title": "Spring Framework: Spring Framework: Information disclosure via Java scripting engine enabled template views", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22737" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r17", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r19", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r16", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-58251", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In netstat in BusyBox through 1.37.0, local users can launch of networ ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-58251" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-46394", "package": "busybox", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hid ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46394" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-46394", "package": "busybox-binsh", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hid ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46394" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2024-12801", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.13, 1.3.15", "title": "logback-core: SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12801" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-10532", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.34", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-10532" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-1225", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.25", "title": "ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-1225" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-9828", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.33", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9828" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2020-8908", "package": "com.google.guava:guava", "installed_version": "31.1-jre", "fixed_version": "32.0.0-android", "title": "guava: local information disclosure via temporary directory created with unsafe permissions", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-8908" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-13176", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r0", "title": "openssl: Timing side-channel in ECDSA signature computation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-2511", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.4-r6", "title": "openssl: Unbounded memory growth with session handling in TLSv1.3", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-2511" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4603", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.5-r0", "title": "openssl: Excessive time spent checking DSA keys and parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4603" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4741", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.6-r0", "title": "openssl: Use After Free with SSL_free_buffers", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-5535", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.6-r0", "title": "openssl: SSL_select_next_proto buffer overread", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-5535" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-9143", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.7-r1", "title": "openssl: Low-level invalid GF(2^m) parameters lead to OOB memory access", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-9143" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-9232", "package": "libcrypto3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r1", "title": "openssl: Out-of-bounds read in HTTP client no_proxy handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9232" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-13176", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r0", "title": "openssl: Timing side-channel in ECDSA signature computation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-2511", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.4-r6", "title": "openssl: Unbounded memory growth with session handling in TLSv1.3", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-2511" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4603", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.5-r0", "title": "openssl: Excessive time spent checking DSA keys and parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4603" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4741", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.6-r0", "title": "openssl: Use After Free with SSL_free_buffers", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-5535", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.6-r0", "title": "openssl: SSL_select_next_proto buffer overread", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-5535" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-9143", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.7-r1", "title": "openssl: Low-level invalid GF(2^m) parameters lead to OOB memory access", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-9143" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-9232", "package": "libssl3", "installed_version": "3.1.4-r5", "fixed_version": "3.1.8-r1", "title": "openssl: Out-of-bounds read in HTTP client no_proxy handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-9232" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-31651", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.104, 10.1.40, 11.0.6", "title": "tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31651" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-46701", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.105, 10.1.41, 11.0.7", "title": "tomcat: Apache Tomcat: Security constraint bypass for CGI scripts", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46701" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-55754", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.11, 10.1.45, 9.0.109", "title": "org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55754" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-61795", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.12, 10.1.47, 9.0.110", "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-61795" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-43514", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-22233", "package": "org.springframework:spring-context", "installed_version": "6.0.11", "fixed_version": "6.2.7, 6.1.20", "title": "CVE-2024-38820 ensured Locale-independent, lowercase conversion for bo ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22233" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22735", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "7.0.6, 6.2.17", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring MVC and WebFlux: Stream corruption vulnerability when using Server-Sent Events", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22735" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.1 (alpine 3.19.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-46394", "package": "ssl_client", "installed_version": "1.36.1-r15", "fixed_version": "1.36.1-r21", "title": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hid ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46394" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0", "vulnerability_count": 162, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-45491", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.3-r0", "title": "libexpat: Integer Overflow or Wraparound", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45491" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-45492", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.3-r0", "title": "libexpat: integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45492" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2025-24813", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.3, 10.1.35, 9.0.99", "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-24813" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-1597", "package": "org.postgresql:postgresql", "installed_version": "42.5.4", "fixed_version": "42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2", "title": "pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-1597" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-38821", "package": "org.springframework.security:spring-security-web", "installed_version": "6.0.5", "fixed_version": "5.7.13, 5.8.15, 6.2.7, 6.0.13, 6.1.11, 6.3.4", "title": "Spring-WebFlux: Authorization Bypass of Static Resources in WebFlux Applications", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38821" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-22732", "package": "org.springframework.security:spring-security-web", "installed_version": "6.0.5", "fixed_version": "6.5.9, 7.0.4", "title": "Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22732" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-0840", "package": "binutils", "installed_version": "2.40-r7", "fixed_version": "2.40-r8", "title": "binutils: GNU Binutils objdump.c disassemble_bytes stack-based overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-0840" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-6378", "package": "ch.qos.logback:logback-classic", "installed_version": "1.4.8", "fixed_version": "1.3.12, 1.4.12, 1.2.13", "title": "logback: serialization vulnerability in logback receiver", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6378" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-6378", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.3.12, 1.4.12, 1.2.13", "title": "logback: serialization vulnerability in logback receiver", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6378" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-52999", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.14.3", "fixed_version": "2.15.0", "title": "com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-52999" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.14.3", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.14.3", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "31.1-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48734", "package": "commons-beanutils:commons-beanutils", "installed_version": "1.9.4", "fixed_version": "1.11.0", "title": "commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48976", "package": "commons-fileupload:commons-fileupload", "installed_version": "1.5", "fixed_version": "1.6.0", "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48976" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-47554", "package": "commons-io:commons-io", "installed_version": "2.11.0", "fixed_version": "2.14.0", "title": "apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-47554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.10.9", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2023-5363", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r0", "title": "openssl: Incorrect cipher key and IV length processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-6119", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.7-r0", "title": "openssl: Possible denial of service in X.509 name checks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-6119" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2023-52425", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.0-r0", "title": "expat: parsing large tokens can trigger a denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-52425" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-28757", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.2-r0", "title": "expat: XML Entity Expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-28757" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-45490", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.3-r0", "title": "libexpat: Negative Length Parsing Vulnerability in libexpat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45490" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2023-5363", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r0", "title": "openssl: Incorrect cipher key and IV length processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-6119", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.7-r0", "title": "openssl: Possible denial of service in X.509 name checks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-6119" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-26519", "package": "musl", "installed_version": "1.2.4-r1", "fixed_version": "1.2.4-r3", "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-26519" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-26519", "package": "musl-utils", "installed_version": "1.2.4-r1", "fixed_version": "1.2.4-r3", "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-26519" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-46589", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.0-M11, 10.1.16, 9.0.83, 8.5.96", "title": "tomcat: HTTP request smuggling via malformed trailer headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-46589" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-34750", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.0-M21, 10.1.25, 9.0.90", "title": "tomcat: Improper Handling of Exceptional Conditions", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-34750" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38286", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.0-M21, 10.1.25, 9.0.90", "title": "tomcat: Denial of Service in Tomcat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38286" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-50379", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.2, 10.1.34, 9.0.98", "title": "tomcat: RCE due to TOCTOU issue in JSP compilation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-50379" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-56337", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.2, 10.1.34, 9.0.98", "title": "tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-56337" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48988", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "tomcat: Apache Tomcat DoS in multipart upload", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48988" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48989", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.10, 10.1.44, 9.0.108", "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48989" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-52520", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.9, 10.1.43, 9.0.107", "title": "tomcat: Apache Tomcat denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-52520" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-53506", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.107, 10.1.43, 11.0.9", "title": "tomcat: Apache Tomcat denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-53506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-55752", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.11, 10.1.45, 9.0.109", "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55752" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24734", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.18, 10.1.52, 9.0.115", "title": "tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24880", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.116, 10.1.52, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24880" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34483", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.116, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34483" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34487", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.117, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34487" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41284", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41284" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42498", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42498" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-43513", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2022-45688", "package": "org.json:json", "installed_version": "20170516", "fixed_version": "20230227", "title": "json stack overflow vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-45688" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-5072", "package": "org.json:json", "installed_version": "20170516", "fixed_version": "20231013", "title": "JSON-java: parser confusion leads to OOM", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5072" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42198", "package": "org.postgresql:postgresql", "installed_version": "42.5.4", "fixed_version": "42.7.11", "title": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42198" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22257", "package": "org.springframework.security:spring-security-core", "installed_version": "6.0.5", "fixed_version": "5.7.12, 5.8.11, 6.1.8, 6.2.3", "title": "spring-security: Broken Access Control With Direct Use of AuthenticatedVoter", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22257" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-22228", "package": "org.springframework.security:spring-security-crypto", "installed_version": "6.0.5", "fixed_version": "6.3.8, 6.4.4, 6.2.10, 6.1.14, 6.0.16, 5.8.18, 5.7.16", "title": "spring-security-core: Spring Security BCryptPasswordEncoder does not enforce maximum password length", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22228" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-41249", "package": "org.springframework:spring-core", "installed_version": "6.0.11", "fixed_version": "6.2.11", "title": "org.springframework/spring-core: Spring Framework Annotation Detection Vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41249" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22243", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "6.1.4, 6.0.17, 5.3.32", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22243" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22259", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "6.1.5, 6.0.18, 5.3.33", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22259" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22262", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "5.3.34, 6.0.19, 6.1.6", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22262" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-34053", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "6.0.14", "title": "springframework: io.micrometer: micrometer-core classpath vulnerable to denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-34053" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38816", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "6.1.13", "title": "spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38816" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38819", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "6.1.14", "title": "org.springframework:spring-webmvc: Path traversal vulnerability in functional web frameworks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38819" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2022-1471", "package": "org.yaml:snakeyaml", "installed_version": "1.33", "fixed_version": "2.0", "title": "SnakeYaml: Constructor Deserialization Remote Code Execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-1471" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "busybox", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "busybox", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "busybox", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "busybox", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r6", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "busybox-binsh", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "busybox-binsh", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "busybox-binsh", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "busybox-binsh", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r6", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-12798", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.13, 1.3.15", "title": "logback-core: arbitrary code execution via JaninoEventEvaluator", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12798" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-11226", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.19, 1.3.16", "title": "ch.qos.logback/logback-core: Conditional abitrary code execution in logback-core", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-11226" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-2976", "package": "com.google.guava:guava", "installed_version": "31.1-jre", "fixed_version": "32.0.0-android", "title": "guava: insecure temporary directory creation", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-2976" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-5678", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r1", "title": "openssl: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5678" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-6129", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r3", "title": "openssl: POLY1305 MAC implementation corrupts vector registers on PowerPC", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6129" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-0727", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r5", "title": "openssl: denial of service via null dereference", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-0727" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-52426", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.0-r0", "title": "expat: recursive XML entity expansion vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-52426" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-50602", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.4-r0", "title": "libexpat: expat: DoS via XML_ResumeParser", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-50602" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-8176", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.7.0-r0", "title": "libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-8176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-5678", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r1", "title": "openssl: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5678" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-6129", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r3", "title": "openssl: POLY1305 MAC implementation corrupts vector registers on PowerPC", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6129" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-0727", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r5", "title": "openssl: denial of service via null dereference", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-0727" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-12133", "package": "libtasn1", "installed_version": "4.19.0-r1", "fixed_version": "4.20.0-r0", "title": "libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoS", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12133" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-25710", "package": "org.apache.commons:commons-compress", "installed_version": "1.21", "fixed_version": "1.26.0", "title": "commons-compress: Denial of service caused by an infinite loop for a corrupted DUMP file", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-25710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-26308", "package": "org.apache.commons:commons-compress", "installed_version": "1.21", "fixed_version": "1.26.0", "title": "commons-compress: OutOfMemoryError unpacking broken Pack200 file", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-26308" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-48924", "package": "org.apache.commons:commons-lang3", "installed_version": "3.12.0", "fixed_version": "3.18.0", "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48924" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49844", "package": "org.apache.logging.log4j:log4j-api", "installed_version": "2.19.0", "fixed_version": "2.25.5, 2.26.1", "title": "org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-31672", "package": "org.apache.poi:poi-ooxml", "installed_version": "5.2.3", "fixed_version": "5.4.0", "title": "org.apache.poi/poi-ooxml: Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31672" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-41080", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "8.5.93, 9.0.80, 10.1.13, 11.0.0-M11", "title": "tomcat: Open Redirect vulnerability in FORM authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-41080" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42795", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "10.1.14, 9.0.81, 8.5.94, 11.0.0-M12", "title": "tomcat: improper cleaning of recycled objects could lead to information leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42795" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-44487", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.0-M12, 10.1.14, 9.0.81, 8.5.94", "title": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-44487" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-45648", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.0-M12, 10.1.14, 9.0.81, 8.5.94", "title": "tomcat: incorrectly parsed http trailer headers can cause request smuggling", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-45648" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-24549", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "8.5.99, 9.0.86, 10.1.19, 11.0.0-M17", "title": "Tomcat: HTTP/2 header handling DoS", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-24549" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-31650", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.104, 10.1.40, 11.0.6", "title": "tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31650" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-49124", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "Apache Tomcat installer for Windows has an untrusted search path vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49124" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-49125", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49125" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-55668", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55668" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-66614", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.15, 10.1.50, 9.0.113", "title": "tomcat: Client certificate verification bypass due to virtual host mapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-66614" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-25854", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.116, 10.1.53, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-25854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-23672", "package": "org.apache.tomcat.embed:tomcat-embed-websocket", "installed_version": "10.1.11", "fixed_version": "11.0.0-M17, 10.1.19, 9.0.86, 8.5.99", "title": "Tomcat: WebSocket DoS with incomplete closing handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-23672" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-7962", "package": "org.eclipse.angus:smtp", "installed_version": "1.0.0", "fixed_version": "2.0.4", "title": "com.sun.mail/jakarta.mail: Jakarta Mail SMTP Injection Vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-7962" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-34055", "package": "org.springframework.boot:spring-boot-actuator", "installed_version": "3.0.9", "fixed_version": "2.7.18, 3.0.13, 3.1.6", "title": "spring-boot: org.springframework.boot: spring-boot-actuator class vulnerable to denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-34055" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41711", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.0.8", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via parsing Sort parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41711" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41721", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.0.8", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via specially crafted HTTP request with @ProjectedPayload", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41721" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41710", "package": "org.springframework.retry:spring-retry", "installed_version": "2.0.2", "fixed_version": "2.0.13", "title": "spring-retry: Spring Retry: Denial of Service via cache exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-34042", "package": "org.springframework.security:spring-security-config", "installed_version": "6.0.5", "fixed_version": "6.1.4, 6.0.7, 5.8.7, 5.7.11", "title": "spring-security-config: Incorrect Permission Assignment for spring-security.xsd", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-34042" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38827", "package": "org.springframework.security:spring-security-core", "installed_version": "6.0.5", "fixed_version": "5.7.14, 5.8.16, 6.0.14, 6.1.12, 6.2.8, 6.3.5", "title": "spring-security: authorization bypass for case sensitive comparisons", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38827" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47838", "package": "org.springframework.security:spring-security-web", "installed_version": "6.0.5", "fixed_version": "6.5.11", "title": "Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47838" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38820", "package": "org.springframework:spring-context", "installed_version": "6.0.11", "fixed_version": "6.1.14", "title": "The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38820" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38809", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "5.3.38, 6.0.23, 6.1.12", "title": "org.springframework:spring-web: Spring Framework DoS via conditional HTTP request", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38809" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38820", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "6.1.14", "title": "The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38820" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-41234", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "6.2.8, 6.1.21", "title": "springframework: Reflected download attack in Spring Framework with non-ASCII headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41234" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-41242", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "6.2.10", "title": "org.springframework/spring-webmvc: Spring Framework MVC path traversal vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41242" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22737", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "7.0.6, 6.2.17", "title": "Spring Framework: Spring Framework: Information disclosure via Java scripting engine enabled template views", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22737" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "ssl_client", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "ssl_client", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "ssl_client", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "ssl_client", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r6", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2024-12801", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.13, 1.3.15", "title": "logback-core: SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12801" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-10532", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.34", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-10532" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-1225", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.25", "title": "ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-1225" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-9828", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.33", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9828" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2020-8908", "package": "com.google.guava:guava", "installed_version": "31.1-jre", "fixed_version": "32.0.0-android", "title": "guava: local information disclosure via temporary directory created with unsafe permissions", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-8908" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-6237", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r4", "title": "openssl: Excessive time spent checking invalid RSA public keys", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6237" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-13176", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.8-r0", "title": "openssl: Timing side-channel in ECDSA signature computation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-2511", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r6", "title": "openssl: Unbounded memory growth with session handling in TLSv1.3", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-2511" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4603", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.5-r0", "title": "openssl: Excessive time spent checking DSA keys and parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4603" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4741", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.6-r0", "title": "openssl: Use After Free with SSL_free_buffers", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-5535", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.6-r0", "title": "openssl: SSL_select_next_proto buffer overread", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-5535" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-9143", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.7-r1", "title": "openssl: Low-level invalid GF(2^m) parameters lead to OOB memory access", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-9143" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-6237", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r4", "title": "openssl: Excessive time spent checking invalid RSA public keys", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6237" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-13176", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.8-r0", "title": "openssl: Timing side-channel in ECDSA signature computation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-2511", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r6", "title": "openssl: Unbounded memory growth with session handling in TLSv1.3", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-2511" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4603", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.5-r0", "title": "openssl: Excessive time spent checking DSA keys and parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4603" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4741", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.6-r0", "title": "openssl: Use After Free with SSL_free_buffers", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-5535", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.6-r0", "title": "openssl: SSL_select_next_proto buffer overread", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-5535" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.3.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-9143", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.7-r1", "title": "openssl: Low-level invalid GF(2^m) parameters lead to OOB memory access", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-9143" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-31651", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.104, 10.1.40, 11.0.6", "title": "tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31651" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-46701", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.105, 10.1.41, 11.0.7", "title": "tomcat: Apache Tomcat: Security constraint bypass for CGI scripts", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46701" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-55754", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.11, 10.1.45, 9.0.109", "title": "org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55754" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-61795", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.12, 10.1.47, 9.0.110", "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-61795" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-43514", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-22233", "package": "org.springframework:spring-context", "installed_version": "6.0.11", "fixed_version": "6.2.7, 6.1.20", "title": "CVE-2024-38820 ensured Locale-independent, lowercase conversion for bo ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22233" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22735", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "7.0.6, 6.2.17", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring MVC and WebFlux: Stream corruption vulnerability when using Server-Sent Events", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22735" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0", "vulnerability_count": 162, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-45491", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.3-r0", "title": "libexpat: Integer Overflow or Wraparound", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45491" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-45492", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.3-r0", "title": "libexpat: integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45492" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2025-24813", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.3, 10.1.35, 9.0.99", "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-24813" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-1597", "package": "org.postgresql:postgresql", "installed_version": "42.5.4", "fixed_version": "42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2", "title": "pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-1597" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-38821", "package": "org.springframework.security:spring-security-web", "installed_version": "6.0.5", "fixed_version": "5.7.13, 5.8.15, 6.2.7, 6.0.13, 6.1.11, 6.3.4", "title": "Spring-WebFlux: Authorization Bypass of Static Resources in WebFlux Applications", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38821" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-22732", "package": "org.springframework.security:spring-security-web", "installed_version": "6.0.5", "fixed_version": "6.5.9, 7.0.4", "title": "Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22732" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-0840", "package": "binutils", "installed_version": "2.40-r7", "fixed_version": "2.40-r8", "title": "binutils: GNU Binutils objdump.c disassemble_bytes stack-based overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-0840" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-6378", "package": "ch.qos.logback:logback-classic", "installed_version": "1.4.8", "fixed_version": "1.3.12, 1.4.12, 1.2.13", "title": "logback: serialization vulnerability in logback receiver", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6378" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-6378", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.3.12, 1.4.12, 1.2.13", "title": "logback: serialization vulnerability in logback receiver", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6378" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-52999", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.14.3", "fixed_version": "2.15.0", "title": "com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-52999" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.14.3", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.14.3", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "31.1-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48734", "package": "commons-beanutils:commons-beanutils", "installed_version": "1.9.4", "fixed_version": "1.11.0", "title": "commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48976", "package": "commons-fileupload:commons-fileupload", "installed_version": "1.5", "fixed_version": "1.6.0", "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48976" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-47554", "package": "commons-io:commons-io", "installed_version": "2.11.0", "fixed_version": "2.14.0", "title": "apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-47554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.10.9", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2023-5363", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r0", "title": "openssl: Incorrect cipher key and IV length processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-6119", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.7-r0", "title": "openssl: Possible denial of service in X.509 name checks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-6119" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2023-52425", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.0-r0", "title": "expat: parsing large tokens can trigger a denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-52425" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-28757", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.2-r0", "title": "expat: XML Entity Expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-28757" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-45490", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.3-r0", "title": "libexpat: Negative Length Parsing Vulnerability in libexpat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45490" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2023-5363", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r0", "title": "openssl: Incorrect cipher key and IV length processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-6119", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.7-r0", "title": "openssl: Possible denial of service in X.509 name checks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-6119" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-26519", "package": "musl", "installed_version": "1.2.4-r1", "fixed_version": "1.2.4-r3", "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-26519" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-26519", "package": "musl-utils", "installed_version": "1.2.4-r1", "fixed_version": "1.2.4-r3", "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-26519" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-46589", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.0-M11, 10.1.16, 9.0.83, 8.5.96", "title": "tomcat: HTTP request smuggling via malformed trailer headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-46589" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-34750", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.0-M21, 10.1.25, 9.0.90", "title": "tomcat: Improper Handling of Exceptional Conditions", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-34750" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38286", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.0-M21, 10.1.25, 9.0.90", "title": "tomcat: Denial of Service in Tomcat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38286" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-50379", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.2, 10.1.34, 9.0.98", "title": "tomcat: RCE due to TOCTOU issue in JSP compilation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-50379" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-56337", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.2, 10.1.34, 9.0.98", "title": "tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-56337" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48988", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "tomcat: Apache Tomcat DoS in multipart upload", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48988" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48989", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.10, 10.1.44, 9.0.108", "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48989" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-52520", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.9, 10.1.43, 9.0.107", "title": "tomcat: Apache Tomcat denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-52520" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-53506", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.107, 10.1.43, 11.0.9", "title": "tomcat: Apache Tomcat denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-53506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-55752", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.11, 10.1.45, 9.0.109", "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55752" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24734", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.18, 10.1.52, 9.0.115", "title": "tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24880", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.116, 10.1.52, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24880" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34483", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.116, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34483" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34487", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.117, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34487" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41284", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41284" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42498", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42498" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-43513", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2022-45688", "package": "org.json:json", "installed_version": "20170516", "fixed_version": "20230227", "title": "json stack overflow vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-45688" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-5072", "package": "org.json:json", "installed_version": "20170516", "fixed_version": "20231013", "title": "JSON-java: parser confusion leads to OOM", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5072" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42198", "package": "org.postgresql:postgresql", "installed_version": "42.5.4", "fixed_version": "42.7.11", "title": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42198" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22257", "package": "org.springframework.security:spring-security-core", "installed_version": "6.0.5", "fixed_version": "5.7.12, 5.8.11, 6.1.8, 6.2.3", "title": "spring-security: Broken Access Control With Direct Use of AuthenticatedVoter", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22257" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-22228", "package": "org.springframework.security:spring-security-crypto", "installed_version": "6.0.5", "fixed_version": "6.3.8, 6.4.4, 6.2.10, 6.1.14, 6.0.16, 5.8.18, 5.7.16", "title": "spring-security-core: Spring Security BCryptPasswordEncoder does not enforce maximum password length", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22228" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-41249", "package": "org.springframework:spring-core", "installed_version": "6.0.11", "fixed_version": "6.2.11", "title": "org.springframework/spring-core: Spring Framework Annotation Detection Vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41249" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22243", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "6.1.4, 6.0.17, 5.3.32", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22243" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22259", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "6.1.5, 6.0.18, 5.3.33", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22259" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22262", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "5.3.34, 6.0.19, 6.1.6", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22262" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-34053", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "6.0.14", "title": "springframework: io.micrometer: micrometer-core classpath vulnerable to denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-34053" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38816", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "6.1.13", "title": "spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38816" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38819", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "6.1.14", "title": "org.springframework:spring-webmvc: Path traversal vulnerability in functional web frameworks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38819" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2022-1471", "package": "org.yaml:snakeyaml", "installed_version": "1.33", "fixed_version": "2.0", "title": "SnakeYaml: Constructor Deserialization Remote Code Execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-1471" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "busybox", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "busybox", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "busybox", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "busybox", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r6", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "busybox-binsh", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "busybox-binsh", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "busybox-binsh", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "busybox-binsh", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r6", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-12798", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.13, 1.3.15", "title": "logback-core: arbitrary code execution via JaninoEventEvaluator", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12798" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-11226", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.19, 1.3.16", "title": "ch.qos.logback/logback-core: Conditional abitrary code execution in logback-core", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-11226" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-2976", "package": "com.google.guava:guava", "installed_version": "31.1-jre", "fixed_version": "32.0.0-android", "title": "guava: insecure temporary directory creation", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-2976" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-5678", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r1", "title": "openssl: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5678" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-6129", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r3", "title": "openssl: POLY1305 MAC implementation corrupts vector registers on PowerPC", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6129" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-0727", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r5", "title": "openssl: denial of service via null dereference", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-0727" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-52426", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.0-r0", "title": "expat: recursive XML entity expansion vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-52426" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-50602", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.4-r0", "title": "libexpat: expat: DoS via XML_ResumeParser", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-50602" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-8176", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.7.0-r0", "title": "libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-8176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-5678", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r1", "title": "openssl: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5678" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-6129", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r3", "title": "openssl: POLY1305 MAC implementation corrupts vector registers on PowerPC", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6129" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-0727", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r5", "title": "openssl: denial of service via null dereference", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-0727" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-12133", "package": "libtasn1", "installed_version": "4.19.0-r1", "fixed_version": "4.20.0-r0", "title": "libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoS", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12133" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-25710", "package": "org.apache.commons:commons-compress", "installed_version": "1.21", "fixed_version": "1.26.0", "title": "commons-compress: Denial of service caused by an infinite loop for a corrupted DUMP file", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-25710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-26308", "package": "org.apache.commons:commons-compress", "installed_version": "1.21", "fixed_version": "1.26.0", "title": "commons-compress: OutOfMemoryError unpacking broken Pack200 file", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-26308" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-48924", "package": "org.apache.commons:commons-lang3", "installed_version": "3.12.0", "fixed_version": "3.18.0", "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48924" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49844", "package": "org.apache.logging.log4j:log4j-api", "installed_version": "2.19.0", "fixed_version": "2.25.5, 2.26.1", "title": "org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-31672", "package": "org.apache.poi:poi-ooxml", "installed_version": "5.2.3", "fixed_version": "5.4.0", "title": "org.apache.poi/poi-ooxml: Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31672" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-41080", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "8.5.93, 9.0.80, 10.1.13, 11.0.0-M11", "title": "tomcat: Open Redirect vulnerability in FORM authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-41080" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42795", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "10.1.14, 9.0.81, 8.5.94, 11.0.0-M12", "title": "tomcat: improper cleaning of recycled objects could lead to information leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42795" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-44487", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.0-M12, 10.1.14, 9.0.81, 8.5.94", "title": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-44487" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-45648", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.0-M12, 10.1.14, 9.0.81, 8.5.94", "title": "tomcat: incorrectly parsed http trailer headers can cause request smuggling", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-45648" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-24549", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "8.5.99, 9.0.86, 10.1.19, 11.0.0-M17", "title": "Tomcat: HTTP/2 header handling DoS", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-24549" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-31650", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.104, 10.1.40, 11.0.6", "title": "tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31650" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-49124", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "Apache Tomcat installer for Windows has an untrusted search path vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49124" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-49125", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49125" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-55668", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55668" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-66614", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.15, 10.1.50, 9.0.113", "title": "tomcat: Client certificate verification bypass due to virtual host mapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-66614" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-25854", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.116, 10.1.53, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-25854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-23672", "package": "org.apache.tomcat.embed:tomcat-embed-websocket", "installed_version": "10.1.11", "fixed_version": "11.0.0-M17, 10.1.19, 9.0.86, 8.5.99", "title": "Tomcat: WebSocket DoS with incomplete closing handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-23672" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-7962", "package": "org.eclipse.angus:smtp", "installed_version": "1.0.0", "fixed_version": "2.0.4", "title": "com.sun.mail/jakarta.mail: Jakarta Mail SMTP Injection Vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-7962" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-34055", "package": "org.springframework.boot:spring-boot-actuator", "installed_version": "3.0.9", "fixed_version": "2.7.18, 3.0.13, 3.1.6", "title": "spring-boot: org.springframework.boot: spring-boot-actuator class vulnerable to denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-34055" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41711", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.0.8", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via parsing Sort parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41711" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41721", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.0.8", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via specially crafted HTTP request with @ProjectedPayload", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41721" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41710", "package": "org.springframework.retry:spring-retry", "installed_version": "2.0.2", "fixed_version": "2.0.13", "title": "spring-retry: Spring Retry: Denial of Service via cache exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-34042", "package": "org.springframework.security:spring-security-config", "installed_version": "6.0.5", "fixed_version": "6.1.4, 6.0.7, 5.8.7, 5.7.11", "title": "spring-security-config: Incorrect Permission Assignment for spring-security.xsd", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-34042" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38827", "package": "org.springframework.security:spring-security-core", "installed_version": "6.0.5", "fixed_version": "5.7.14, 5.8.16, 6.0.14, 6.1.12, 6.2.8, 6.3.5", "title": "spring-security: authorization bypass for case sensitive comparisons", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38827" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47838", "package": "org.springframework.security:spring-security-web", "installed_version": "6.0.5", "fixed_version": "6.5.11", "title": "Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47838" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38820", "package": "org.springframework:spring-context", "installed_version": "6.0.11", "fixed_version": "6.1.14", "title": "The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38820" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38809", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "5.3.38, 6.0.23, 6.1.12", "title": "org.springframework:spring-web: Spring Framework DoS via conditional HTTP request", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38809" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38820", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "6.1.14", "title": "The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38820" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-41234", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "6.2.8, 6.1.21", "title": "springframework: Reflected download attack in Spring Framework with non-ASCII headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41234" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-41242", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "6.2.10", "title": "org.springframework/spring-webmvc: Spring Framework MVC path traversal vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41242" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22737", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "7.0.6, 6.2.17", "title": "Spring Framework: Spring Framework: Information disclosure via Java scripting engine enabled template views", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22737" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "ssl_client", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "ssl_client", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "ssl_client", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "ssl_client", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r6", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2024-12801", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.13, 1.3.15", "title": "logback-core: SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12801" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-10532", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.34", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-10532" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-1225", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.25", "title": "ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-1225" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-9828", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.33", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9828" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2020-8908", "package": "com.google.guava:guava", "installed_version": "31.1-jre", "fixed_version": "32.0.0-android", "title": "guava: local information disclosure via temporary directory created with unsafe permissions", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-8908" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-6237", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r4", "title": "openssl: Excessive time spent checking invalid RSA public keys", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6237" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-13176", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.8-r0", "title": "openssl: Timing side-channel in ECDSA signature computation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-2511", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r6", "title": "openssl: Unbounded memory growth with session handling in TLSv1.3", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-2511" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4603", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.5-r0", "title": "openssl: Excessive time spent checking DSA keys and parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4603" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4741", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.6-r0", "title": "openssl: Use After Free with SSL_free_buffers", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-5535", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.6-r0", "title": "openssl: SSL_select_next_proto buffer overread", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-5535" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-9143", "package": "libcrypto3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.7-r1", "title": "openssl: Low-level invalid GF(2^m) parameters lead to OOB memory access", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-9143" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-6237", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r4", "title": "openssl: Excessive time spent checking invalid RSA public keys", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6237" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-13176", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.8-r0", "title": "openssl: Timing side-channel in ECDSA signature computation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-2511", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.4-r6", "title": "openssl: Unbounded memory growth with session handling in TLSv1.3", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-2511" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4603", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.5-r0", "title": "openssl: Excessive time spent checking DSA keys and parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4603" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4741", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.6-r0", "title": "openssl: Use After Free with SSL_free_buffers", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-5535", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.6-r0", "title": "openssl: SSL_select_next_proto buffer overread", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-5535" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.2.0 (alpine 3.18.4)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-9143", "package": "libssl3", "installed_version": "3.1.3-r0", "fixed_version": "3.1.7-r1", "title": "openssl: Low-level invalid GF(2^m) parameters lead to OOB memory access", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-9143" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-31651", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.104, 10.1.40, 11.0.6", "title": "tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31651" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-46701", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.105, 10.1.41, 11.0.7", "title": "tomcat: Apache Tomcat: Security constraint bypass for CGI scripts", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46701" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-55754", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.11, 10.1.45, 9.0.109", "title": "org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55754" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-61795", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.12, 10.1.47, 9.0.110", "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-61795" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-43514", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-22233", "package": "org.springframework:spring-context", "installed_version": "6.0.11", "fixed_version": "6.2.7, 6.1.20", "title": "CVE-2024-38820 ensured Locale-independent, lowercase conversion for bo ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22233" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22735", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "7.0.6, 6.2.17", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring MVC and WebFlux: Stream corruption vulnerability when using Server-Sent Events", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22735" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0", "vulnerability_count": 161, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-45491", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.3-r0", "title": "libexpat: Integer Overflow or Wraparound", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45491" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-45492", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.3-r0", "title": "libexpat: integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45492" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2025-24813", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.3, 10.1.35, 9.0.99", "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-24813" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-1597", "package": "org.postgresql:postgresql", "installed_version": "42.5.4", "fixed_version": "42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2", "title": "pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-1597" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-38821", "package": "org.springframework.security:spring-security-web", "installed_version": "6.0.5", "fixed_version": "5.7.13, 5.8.15, 6.2.7, 6.0.13, 6.1.11, 6.3.4", "title": "Spring-WebFlux: Authorization Bypass of Static Resources in WebFlux Applications", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38821" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-22732", "package": "org.springframework.security:spring-security-web", "installed_version": "6.0.5", "fixed_version": "6.5.9, 7.0.4", "title": "Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22732" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-6378", "package": "ch.qos.logback:logback-classic", "installed_version": "1.4.8", "fixed_version": "1.3.12, 1.4.12, 1.2.13", "title": "logback: serialization vulnerability in logback receiver", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6378" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-6378", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.3.12, 1.4.12, 1.2.13", "title": "logback: serialization vulnerability in logback receiver", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6378" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-52999", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.14.3", "fixed_version": "2.15.0", "title": "com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-52999" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.14.3", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.14.3", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "31.1-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48734", "package": "commons-beanutils:commons-beanutils", "installed_version": "1.9.4", "fixed_version": "1.11.0", "title": "commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48976", "package": "commons-fileupload:commons-fileupload", "installed_version": "1.5", "fixed_version": "1.6.0", "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48976" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-47554", "package": "commons-io:commons-io", "installed_version": "2.11.0", "fixed_version": "2.14.0", "title": "apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-47554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.10.9", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2023-5363", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r0", "title": "openssl: Incorrect cipher key and IV length processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-6119", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.7-r0", "title": "openssl: Possible denial of service in X.509 name checks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-6119" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2023-52425", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.0-r0", "title": "expat: parsing large tokens can trigger a denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-52425" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-28757", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.2-r0", "title": "expat: XML Entity Expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-28757" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-45490", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.3-r0", "title": "libexpat: Negative Length Parsing Vulnerability in libexpat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45490" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2023-5363", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r0", "title": "openssl: Incorrect cipher key and IV length processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-6119", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.7-r0", "title": "openssl: Possible denial of service in X.509 name checks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-6119" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-26519", "package": "musl", "installed_version": "1.2.4-r1", "fixed_version": "1.2.4-r3", "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-26519" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-26519", "package": "musl-utils", "installed_version": "1.2.4-r1", "fixed_version": "1.2.4-r3", "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-26519" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-46589", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.0-M11, 10.1.16, 9.0.83, 8.5.96", "title": "tomcat: HTTP request smuggling via malformed trailer headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-46589" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-34750", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.0-M21, 10.1.25, 9.0.90", "title": "tomcat: Improper Handling of Exceptional Conditions", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-34750" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38286", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.0-M21, 10.1.25, 9.0.90", "title": "tomcat: Denial of Service in Tomcat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38286" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-50379", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.2, 10.1.34, 9.0.98", "title": "tomcat: RCE due to TOCTOU issue in JSP compilation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-50379" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-56337", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.2, 10.1.34, 9.0.98", "title": "tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-56337" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48988", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "tomcat: Apache Tomcat DoS in multipart upload", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48988" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48989", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.10, 10.1.44, 9.0.108", "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48989" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-52520", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.9, 10.1.43, 9.0.107", "title": "tomcat: Apache Tomcat denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-52520" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-53506", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.107, 10.1.43, 11.0.9", "title": "tomcat: Apache Tomcat denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-53506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-55752", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.11, 10.1.45, 9.0.109", "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55752" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24734", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.18, 10.1.52, 9.0.115", "title": "tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24880", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.116, 10.1.52, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24880" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34483", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.116, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34483" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34487", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.117, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34487" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41284", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41284" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42498", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42498" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-43513", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2022-45688", "package": "org.json:json", "installed_version": "20170516", "fixed_version": "20230227", "title": "json stack overflow vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-45688" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-5072", "package": "org.json:json", "installed_version": "20170516", "fixed_version": "20231013", "title": "JSON-java: parser confusion leads to OOM", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5072" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42198", "package": "org.postgresql:postgresql", "installed_version": "42.5.4", "fixed_version": "42.7.11", "title": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42198" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22257", "package": "org.springframework.security:spring-security-core", "installed_version": "6.0.5", "fixed_version": "5.7.12, 5.8.11, 6.1.8, 6.2.3", "title": "spring-security: Broken Access Control With Direct Use of AuthenticatedVoter", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22257" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-22228", "package": "org.springframework.security:spring-security-crypto", "installed_version": "6.0.5", "fixed_version": "6.3.8, 6.4.4, 6.2.10, 6.1.14, 6.0.16, 5.8.18, 5.7.16", "title": "spring-security-core: Spring Security BCryptPasswordEncoder does not enforce maximum password length", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22228" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-41249", "package": "org.springframework:spring-core", "installed_version": "6.0.11", "fixed_version": "6.2.11", "title": "org.springframework/spring-core: Spring Framework Annotation Detection Vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41249" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22243", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "6.1.4, 6.0.17, 5.3.32", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22243" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22259", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "6.1.5, 6.0.18, 5.3.33", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22259" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22262", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "5.3.34, 6.0.19, 6.1.6", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22262" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-34053", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "6.0.14", "title": "springframework: io.micrometer: micrometer-core classpath vulnerable to denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-34053" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38816", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "6.1.13", "title": "spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38816" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38819", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "6.1.14", "title": "org.springframework:spring-webmvc: Path traversal vulnerability in functional web frameworks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38819" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2022-1471", "package": "org.yaml:snakeyaml", "installed_version": "1.33", "fixed_version": "2.0", "title": "SnakeYaml: Constructor Deserialization Remote Code Execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-1471" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "busybox", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "busybox", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "busybox", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "busybox", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r6", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "busybox-binsh", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "busybox-binsh", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "busybox-binsh", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "busybox-binsh", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r6", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-12798", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.13, 1.3.15", "title": "logback-core: arbitrary code execution via JaninoEventEvaluator", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12798" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-11226", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.19, 1.3.16", "title": "ch.qos.logback/logback-core: Conditional abitrary code execution in logback-core", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-11226" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-2976", "package": "com.google.guava:guava", "installed_version": "31.1-jre", "fixed_version": "32.0.0-android", "title": "guava: insecure temporary directory creation", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-2976" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-5678", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r1", "title": "openssl: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5678" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-6129", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r3", "title": "openssl: POLY1305 MAC implementation corrupts vector registers on PowerPC", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6129" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-0727", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r5", "title": "openssl: denial of service via null dereference", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-0727" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-52426", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.0-r0", "title": "expat: recursive XML entity expansion vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-52426" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-50602", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.4-r0", "title": "libexpat: expat: DoS via XML_ResumeParser", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-50602" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-8176", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.7.0-r0", "title": "libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-8176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-5678", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r1", "title": "openssl: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5678" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-6129", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r3", "title": "openssl: POLY1305 MAC implementation corrupts vector registers on PowerPC", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6129" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-0727", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r5", "title": "openssl: denial of service via null dereference", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-0727" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-12133", "package": "libtasn1", "installed_version": "4.19.0-r1", "fixed_version": "4.20.0-r0", "title": "libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoS", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12133" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-25710", "package": "org.apache.commons:commons-compress", "installed_version": "1.21", "fixed_version": "1.26.0", "title": "commons-compress: Denial of service caused by an infinite loop for a corrupted DUMP file", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-25710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-26308", "package": "org.apache.commons:commons-compress", "installed_version": "1.21", "fixed_version": "1.26.0", "title": "commons-compress: OutOfMemoryError unpacking broken Pack200 file", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-26308" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-48924", "package": "org.apache.commons:commons-lang3", "installed_version": "3.12.0", "fixed_version": "3.18.0", "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48924" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49844", "package": "org.apache.logging.log4j:log4j-api", "installed_version": "2.19.0", "fixed_version": "2.25.5, 2.26.1", "title": "org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-31672", "package": "org.apache.poi:poi-ooxml", "installed_version": "5.2.3", "fixed_version": "5.4.0", "title": "org.apache.poi/poi-ooxml: Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31672" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-41080", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "8.5.93, 9.0.80, 10.1.13, 11.0.0-M11", "title": "tomcat: Open Redirect vulnerability in FORM authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-41080" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42795", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "10.1.14, 9.0.81, 8.5.94, 11.0.0-M12", "title": "tomcat: improper cleaning of recycled objects could lead to information leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42795" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-44487", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.0-M12, 10.1.14, 9.0.81, 8.5.94", "title": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-44487" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-45648", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.0-M12, 10.1.14, 9.0.81, 8.5.94", "title": "tomcat: incorrectly parsed http trailer headers can cause request smuggling", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-45648" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-24549", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "8.5.99, 9.0.86, 10.1.19, 11.0.0-M17", "title": "Tomcat: HTTP/2 header handling DoS", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-24549" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-31650", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.104, 10.1.40, 11.0.6", "title": "tomcat: Apache Tomcat: DoS via malformed HTTP/2 PRIORITY_UPDATE frame", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31650" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-49124", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "Apache Tomcat installer for Windows has an untrusted search path vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49124" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-49125", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49125" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-55668", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55668" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-66614", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.15, 10.1.50, 9.0.113", "title": "tomcat: Client certificate verification bypass due to virtual host mapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-66614" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-25854", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.116, 10.1.53, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-25854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-23672", "package": "org.apache.tomcat.embed:tomcat-embed-websocket", "installed_version": "10.1.11", "fixed_version": "11.0.0-M17, 10.1.19, 9.0.86, 8.5.99", "title": "Tomcat: WebSocket DoS with incomplete closing handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-23672" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-7962", "package": "org.eclipse.angus:smtp", "installed_version": "1.0.0", "fixed_version": "2.0.4", "title": "com.sun.mail/jakarta.mail: Jakarta Mail SMTP Injection Vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-7962" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-34055", "package": "org.springframework.boot:spring-boot-actuator", "installed_version": "3.0.9", "fixed_version": "2.7.18, 3.0.13, 3.1.6", "title": "spring-boot: org.springframework.boot: spring-boot-actuator class vulnerable to denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-34055" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41711", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.0.8", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via parsing Sort parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41711" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41721", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.0.8", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via specially crafted HTTP request with @ProjectedPayload", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41721" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41710", "package": "org.springframework.retry:spring-retry", "installed_version": "2.0.2", "fixed_version": "2.0.13", "title": "spring-retry: Spring Retry: Denial of Service via cache exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-34042", "package": "org.springframework.security:spring-security-config", "installed_version": "6.0.5", "fixed_version": "6.1.4, 6.0.7, 5.8.7, 5.7.11", "title": "spring-security-config: Incorrect Permission Assignment for spring-security.xsd", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-34042" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38827", "package": "org.springframework.security:spring-security-core", "installed_version": "6.0.5", "fixed_version": "5.7.14, 5.8.16, 6.0.14, 6.1.12, 6.2.8, 6.3.5", "title": "spring-security: authorization bypass for case sensitive comparisons", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38827" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47838", "package": "org.springframework.security:spring-security-web", "installed_version": "6.0.5", "fixed_version": "6.5.11", "title": "Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47838" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38820", "package": "org.springframework:spring-context", "installed_version": "6.0.11", "fixed_version": "6.1.14", "title": "The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38820" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38809", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "5.3.38, 6.0.23, 6.1.12", "title": "org.springframework:spring-web: Spring Framework DoS via conditional HTTP request", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38809" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38820", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "6.1.14", "title": "The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38820" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-41234", "package": "org.springframework:spring-web", "installed_version": "6.0.11", "fixed_version": "6.2.8, 6.1.21", "title": "springframework: Reflected download attack in Spring Framework with non-ASCII headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41234" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-41242", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "6.2.10", "title": "org.springframework/spring-webmvc: Spring Framework MVC path traversal vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41242" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22737", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "7.0.6, 6.2.17", "title": "Spring Framework: Spring Framework: Information disclosure via Java scripting engine enabled template views", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22737" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "ssl_client", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "ssl_client", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "ssl_client", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "ssl_client", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r6", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2024-12801", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.13, 1.3.15", "title": "logback-core: SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12801" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-10532", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.34", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-10532" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-1225", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.25", "title": "ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-1225" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-9828", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.8", "fixed_version": "1.5.33", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9828" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2020-8908", "package": "com.google.guava:guava", "installed_version": "31.1-jre", "fixed_version": "32.0.0-android", "title": "guava: local information disclosure via temporary directory created with unsafe permissions", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-8908" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-6237", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r4", "title": "openssl: Excessive time spent checking invalid RSA public keys", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6237" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-13176", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.8-r0", "title": "openssl: Timing side-channel in ECDSA signature computation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-2511", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r6", "title": "openssl: Unbounded memory growth with session handling in TLSv1.3", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-2511" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4603", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.5-r0", "title": "openssl: Excessive time spent checking DSA keys and parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4603" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4741", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.6-r0", "title": "openssl: Use After Free with SSL_free_buffers", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-5535", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.6-r0", "title": "openssl: SSL_select_next_proto buffer overread", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-5535" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-9143", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.7-r1", "title": "openssl: Low-level invalid GF(2^m) parameters lead to OOB memory access", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-9143" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-6237", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r4", "title": "openssl: Excessive time spent checking invalid RSA public keys", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6237" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-13176", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.8-r0", "title": "openssl: Timing side-channel in ECDSA signature computation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-2511", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r6", "title": "openssl: Unbounded memory growth with session handling in TLSv1.3", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-2511" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4603", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.5-r0", "title": "openssl: Excessive time spent checking DSA keys and parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4603" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4741", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.6-r0", "title": "openssl: Use After Free with SSL_free_buffers", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-5535", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.6-r0", "title": "openssl: SSL_select_next_proto buffer overread", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-5535" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.1.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-9143", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.7-r1", "title": "openssl: Low-level invalid GF(2^m) parameters lead to OOB memory access", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-9143" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-31651", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.104, 10.1.40, 11.0.6", "title": "tomcat: Apache Tomcat: Bypass of rules in Rewrite Valve", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31651" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-46701", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.105, 10.1.41, 11.0.7", "title": "tomcat: Apache Tomcat: Security constraint bypass for CGI scripts", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46701" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-55754", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.11, 10.1.45, 9.0.109", "title": "org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55754" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-61795", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "11.0.12, 10.1.47, 9.0.110", "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-61795" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-43514", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.11", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-22233", "package": "org.springframework:spring-context", "installed_version": "6.0.11", "fixed_version": "6.2.7, 6.1.20", "title": "CVE-2024-38820 ensured Locale-independent, lowercase conversion for bo ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22233" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22735", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.11", "fixed_version": "7.0.6, 6.2.17", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring MVC and WebFlux: Stream corruption vulnerability when using Server-Sent Events", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22735" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1", "vulnerability_count": 161, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-45491", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.3-r0", "title": "libexpat: Integer Overflow or Wraparound", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45491" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-45492", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.3-r0", "title": "libexpat: integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45492" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2025-24813", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.3, 10.1.35, 9.0.99", "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-24813" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-1597", "package": "org.postgresql:postgresql", "installed_version": "42.5.4", "fixed_version": "42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2", "title": "pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-1597" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2023-34034", "package": "org.springframework.security:spring-security-config", "installed_version": "6.0.3", "fixed_version": "5.6.12, 5.7.10, 5.8.5, 6.0.5, 6.1.2", "title": "spring-security-webflux: path wildcard leads to security bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-34034" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-38821", "package": "org.springframework.security:spring-security-web", "installed_version": "6.0.3", "fixed_version": "5.7.13, 5.8.15, 6.2.7, 6.0.13, 6.1.11, 6.3.4", "title": "Spring-WebFlux: Authorization Bypass of Static Resources in WebFlux Applications", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38821" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-22732", "package": "org.springframework.security:spring-security-web", "installed_version": "6.0.3", "fixed_version": "6.5.9, 7.0.4", "title": "Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22732" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.9", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-6378", "package": "ch.qos.logback:logback-classic", "installed_version": "1.4.7", "fixed_version": "1.3.12, 1.4.12, 1.2.13", "title": "logback: serialization vulnerability in logback receiver", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6378" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-6378", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.7", "fixed_version": "1.3.12, 1.4.12, 1.2.13", "title": "logback: serialization vulnerability in logback receiver", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6378" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-52999", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.14.3", "fixed_version": "2.15.0", "title": "com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-52999" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.14.3", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.14.3", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "31.1-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48734", "package": "commons-beanutils:commons-beanutils", "installed_version": "1.9.4", "fixed_version": "1.11.0", "title": "commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48976", "package": "commons-fileupload:commons-fileupload", "installed_version": "1.5", "fixed_version": "1.6.0", "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48976" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-47554", "package": "commons-io:commons-io", "installed_version": "2.11.0", "fixed_version": "2.14.0", "title": "apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-47554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.10.7", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2023-5363", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r0", "title": "openssl: Incorrect cipher key and IV length processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-6119", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.7-r0", "title": "openssl: Possible denial of service in X.509 name checks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-6119" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2023-52425", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.0-r0", "title": "expat: parsing large tokens can trigger a denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-52425" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-28757", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.2-r0", "title": "expat: XML Entity Expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-28757" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-45490", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.3-r0", "title": "libexpat: Negative Length Parsing Vulnerability in libexpat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45490" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2023-5363", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r0", "title": "openssl: Incorrect cipher key and IV length processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-6119", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.7-r0", "title": "openssl: Possible denial of service in X.509 name checks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-6119" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-26519", "package": "musl", "installed_version": "1.2.4-r1", "fixed_version": "1.2.4-r3", "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-26519" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-26519", "package": "musl-utils", "installed_version": "1.2.4-r1", "fixed_version": "1.2.4-r3", "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-26519" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-34981", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.0-M6, 10.1.9, 9.0.75", "title": "tomcat: response headers from the previous request leading to an information leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-34981" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-46589", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.0-M11, 10.1.16, 9.0.83, 8.5.96", "title": "tomcat: HTTP request smuggling via malformed trailer headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-46589" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-34750", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.0-M21, 10.1.25, 9.0.90", "title": "tomcat: Improper Handling of Exceptional Conditions", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-34750" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38286", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.0-M21, 10.1.25, 9.0.90", "title": "tomcat: Denial of Service in Tomcat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38286" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-50379", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.2, 10.1.34, 9.0.98", "title": "tomcat: RCE due to TOCTOU issue in JSP compilation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-50379" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-56337", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.2, 10.1.34, 9.0.98", "title": "tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-56337" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48988", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "tomcat: Apache Tomcat DoS in multipart upload", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48988" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48989", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.10, 10.1.44, 9.0.108", "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48989" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-52520", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.9, 10.1.43, 9.0.107", "title": "tomcat: Apache Tomcat denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-52520" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-53506", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.107, 10.1.43, 11.0.9", "title": "tomcat: Apache Tomcat denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-53506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-55752", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.11, 10.1.45, 9.0.109", "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55752" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24734", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.18, 10.1.52, 9.0.115", "title": "tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24880", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.116, 10.1.52, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24880" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34483", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.116, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34483" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34487", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.117, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34487" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41284", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41284" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42498", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42498" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-43513", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2022-45688", "package": "org.json:json", "installed_version": "20170516", "fixed_version": "20230227", "title": "json stack overflow vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-45688" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-5072", "package": "org.json:json", "installed_version": "20170516", "fixed_version": "20231013", "title": "JSON-java: parser confusion leads to OOM", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5072" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42198", "package": "org.postgresql:postgresql", "installed_version": "42.5.4", "fixed_version": "42.7.11", "title": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42198" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-34035", "package": "org.springframework.security:spring-security-config", "installed_version": "6.0.3", "fixed_version": "5.8.5, 6.0.5, 6.1.2", "title": "Spring Security's authorization rules can be misconfigured when using multiple servlets", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-34035" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22257", "package": "org.springframework.security:spring-security-core", "installed_version": "6.0.3", "fixed_version": "5.7.12, 5.8.11, 6.1.8, 6.2.3", "title": "spring-security: Broken Access Control With Direct Use of AuthenticatedVoter", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22257" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-22228", "package": "org.springframework.security:spring-security-crypto", "installed_version": "6.0.3", "fixed_version": "6.3.8, 6.4.4, 6.2.10, 6.1.14, 6.0.16, 5.8.18, 5.7.16", "title": "spring-security-core: Spring Security BCryptPasswordEncoder does not enforce maximum password length", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22228" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-41249", "package": "org.springframework:spring-core", "installed_version": "6.0.9", "fixed_version": "6.2.11", "title": "org.springframework/spring-core: Spring Framework Annotation Detection Vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41249" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22243", "package": "org.springframework:spring-web", "installed_version": "6.0.9", "fixed_version": "6.1.4, 6.0.17, 5.3.32", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22243" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22259", "package": "org.springframework:spring-web", "installed_version": "6.0.9", "fixed_version": "6.1.5, 6.0.18, 5.3.33", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22259" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22262", "package": "org.springframework:spring-web", "installed_version": "6.0.9", "fixed_version": "5.3.34, 6.0.19, 6.1.6", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22262" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-34053", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.9", "fixed_version": "6.0.14", "title": "springframework: io.micrometer: micrometer-core classpath vulnerable to denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-34053" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38816", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.9", "fixed_version": "6.1.13", "title": "spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38816" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38819", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.9", "fixed_version": "6.1.14", "title": "org.springframework:spring-webmvc: Path traversal vulnerability in functional web frameworks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38819" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2022-1471", "package": "org.yaml:snakeyaml", "installed_version": "1.33", "fixed_version": "2.0", "title": "SnakeYaml: Constructor Deserialization Remote Code Execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-1471" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "busybox", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "busybox", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "busybox", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "busybox", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r6", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "busybox-binsh", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "busybox-binsh", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "busybox-binsh", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "busybox-binsh", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r6", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-12798", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.7", "fixed_version": "1.5.13, 1.3.15", "title": "logback-core: arbitrary code execution via JaninoEventEvaluator", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12798" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-11226", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.7", "fixed_version": "1.5.19, 1.3.16", "title": "ch.qos.logback/logback-core: Conditional abitrary code execution in logback-core", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-11226" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-2976", "package": "com.google.guava:guava", "installed_version": "31.1-jre", "fixed_version": "32.0.0-android", "title": "guava: insecure temporary directory creation", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-2976" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-5678", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r1", "title": "openssl: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5678" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-6129", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r3", "title": "openssl: POLY1305 MAC implementation corrupts vector registers on PowerPC", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6129" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-0727", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r5", "title": "openssl: denial of service via null dereference", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-0727" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-52426", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.0-r0", "title": "expat: recursive XML entity expansion vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-52426" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-50602", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.4-r0", "title": "libexpat: expat: DoS via XML_ResumeParser", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-50602" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-8176", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.7.0-r0", "title": "libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-8176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-5678", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r1", "title": "openssl: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5678" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-6129", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r3", "title": "openssl: POLY1305 MAC implementation corrupts vector registers on PowerPC", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6129" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-0727", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r5", "title": "openssl: denial of service via null dereference", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-0727" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-12133", "package": "libtasn1", "installed_version": "4.19.0-r1", "fixed_version": "4.20.0-r0", "title": "libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoS", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12133" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-25710", "package": "org.apache.commons:commons-compress", "installed_version": "1.21", "fixed_version": "1.26.0", "title": "commons-compress: Denial of service caused by an infinite loop for a corrupted DUMP file", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-25710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-26308", "package": "org.apache.commons:commons-compress", "installed_version": "1.21", "fixed_version": "1.26.0", "title": "commons-compress: OutOfMemoryError unpacking broken Pack200 file", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-26308" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-48924", "package": "org.apache.commons:commons-lang3", "installed_version": "3.12.0", "fixed_version": "3.18.0", "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48924" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49844", "package": "org.apache.logging.log4j:log4j-api", "installed_version": "2.19.0", "fixed_version": "2.25.5, 2.26.1", "title": "org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-31672", "package": "org.apache.poi:poi-ooxml", "installed_version": "5.2.3", "fixed_version": "5.4.0", "title": "org.apache.poi/poi-ooxml: Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31672" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-41080", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "8.5.93, 9.0.80, 10.1.13, 11.0.0-M11", "title": "tomcat: Open Redirect vulnerability in FORM authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-41080" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42795", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "10.1.14, 9.0.81, 8.5.94, 11.0.0-M12", "title": "tomcat: improper cleaning of recycled objects could lead to information leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42795" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-44487", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.0-M12, 10.1.14, 9.0.81, 8.5.94", "title": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-44487" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-45648", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.0-M12, 10.1.14, 9.0.81, 8.5.94", "title": "tomcat: incorrectly parsed http trailer headers can cause request smuggling", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-45648" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-24549", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "8.5.99, 9.0.86, 10.1.19, 11.0.0-M17", "title": "Tomcat: HTTP/2 header handling DoS", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-24549" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-49124", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "Apache Tomcat installer for Windows has an untrusted search path vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49124" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-49125", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49125" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-55668", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55668" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-66614", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.15, 10.1.50, 9.0.113", "title": "tomcat: Client certificate verification bypass due to virtual host mapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-66614" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-25854", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.116, 10.1.53, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-25854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-23672", "package": "org.apache.tomcat.embed:tomcat-embed-websocket", "installed_version": "10.1.8", "fixed_version": "11.0.0-M17, 10.1.19, 9.0.86, 8.5.99", "title": "Tomcat: WebSocket DoS with incomplete closing handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-23672" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-7962", "package": "org.eclipse.angus:smtp", "installed_version": "1.0.0", "fixed_version": "2.0.4", "title": "com.sun.mail/jakarta.mail: Jakarta Mail SMTP Injection Vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-7962" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-34055", "package": "org.springframework.boot:spring-boot-actuator", "installed_version": "3.0.7", "fixed_version": "2.7.18, 3.0.13, 3.1.6", "title": "spring-boot: org.springframework.boot: spring-boot-actuator class vulnerable to denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-34055" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41711", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.0.6", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via parsing Sort parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41711" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41721", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.0.6", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via specially crafted HTTP request with @ProjectedPayload", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41721" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41710", "package": "org.springframework.retry:spring-retry", "installed_version": "2.0.1", "fixed_version": "2.0.13", "title": "spring-retry: Spring Retry: Denial of Service via cache exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38827", "package": "org.springframework.security:spring-security-core", "installed_version": "6.0.3", "fixed_version": "5.7.14, 5.8.16, 6.0.14, 6.1.12, 6.2.8, 6.3.5", "title": "spring-security: authorization bypass for case sensitive comparisons", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38827" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47838", "package": "org.springframework.security:spring-security-web", "installed_version": "6.0.3", "fixed_version": "6.5.11", "title": "Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47838" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38820", "package": "org.springframework:spring-context", "installed_version": "6.0.9", "fixed_version": "6.1.14", "title": "The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38820" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38809", "package": "org.springframework:spring-web", "installed_version": "6.0.9", "fixed_version": "5.3.38, 6.0.23, 6.1.12", "title": "org.springframework:spring-web: Spring Framework DoS via conditional HTTP request", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38809" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38820", "package": "org.springframework:spring-web", "installed_version": "6.0.9", "fixed_version": "6.1.14", "title": "The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38820" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-41234", "package": "org.springframework:spring-web", "installed_version": "6.0.9", "fixed_version": "6.2.8, 6.1.21", "title": "springframework: Reflected download attack in Spring Framework with non-ASCII headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41234" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-41242", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.9", "fixed_version": "6.2.10", "title": "org.springframework/spring-webmvc: Spring Framework MVC path traversal vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41242" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22737", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.9", "fixed_version": "7.0.6, 6.2.17", "title": "Spring Framework: Spring Framework: Information disclosure via Java scripting engine enabled template views", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22737" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "ssl_client", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "ssl_client", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "ssl_client", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "ssl_client", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r6", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2024-12801", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.7", "fixed_version": "1.5.13, 1.3.15", "title": "logback-core: SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12801" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-10532", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.7", "fixed_version": "1.5.34", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-10532" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-1225", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.7", "fixed_version": "1.5.25", "title": "ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-1225" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-9828", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.7", "fixed_version": "1.5.33", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9828" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2020-8908", "package": "com.google.guava:guava", "installed_version": "31.1-jre", "fixed_version": "32.0.0-android", "title": "guava: local information disclosure via temporary directory created with unsafe permissions", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-8908" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-6237", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r4", "title": "openssl: Excessive time spent checking invalid RSA public keys", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6237" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-13176", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.8-r0", "title": "openssl: Timing side-channel in ECDSA signature computation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-2511", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r6", "title": "openssl: Unbounded memory growth with session handling in TLSv1.3", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-2511" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4603", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.5-r0", "title": "openssl: Excessive time spent checking DSA keys and parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4603" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4741", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.6-r0", "title": "openssl: Use After Free with SSL_free_buffers", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-5535", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.6-r0", "title": "openssl: SSL_select_next_proto buffer overread", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-5535" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-9143", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.7-r1", "title": "openssl: Low-level invalid GF(2^m) parameters lead to OOB memory access", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-9143" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-6237", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r4", "title": "openssl: Excessive time spent checking invalid RSA public keys", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6237" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-13176", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.8-r0", "title": "openssl: Timing side-channel in ECDSA signature computation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-2511", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r6", "title": "openssl: Unbounded memory growth with session handling in TLSv1.3", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-2511" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4603", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.5-r0", "title": "openssl: Excessive time spent checking DSA keys and parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4603" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4741", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.6-r0", "title": "openssl: Use After Free with SSL_free_buffers", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-5535", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.6-r0", "title": "openssl: SSL_select_next_proto buffer overread", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-5535" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.1 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-9143", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.7-r1", "title": "openssl: Low-level invalid GF(2^m) parameters lead to OOB memory access", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-9143" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-46701", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.105, 10.1.41, 11.0.7", "title": "tomcat: Apache Tomcat: Security constraint bypass for CGI scripts", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46701" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-55754", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.11, 10.1.45, 9.0.109", "title": "org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55754" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-61795", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.12, 10.1.47, 9.0.110", "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-61795" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-43514", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-22233", "package": "org.springframework:spring-context", "installed_version": "6.0.9", "fixed_version": "6.2.7, 6.1.20", "title": "CVE-2024-38820 ensured Locale-independent, lowercase conversion for bo ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22233" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22735", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.9", "fixed_version": "7.0.6, 6.2.17", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring MVC and WebFlux: Stream corruption vulnerability when using Server-Sent Events", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22735" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0", "vulnerability_count": 161, "highest_severity": "CRITICAL", "findings": [ { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-45491", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.3-r0", "title": "libexpat: Integer Overflow or Wraparound", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45491" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-45492", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.3-r0", "title": "libexpat: integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45492" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2025-24813", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.3, 10.1.35, 9.0.99", "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-24813" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-1597", "package": "org.postgresql:postgresql", "installed_version": "42.5.4", "fixed_version": "42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2", "title": "pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-1597" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2023-34034", "package": "org.springframework.security:spring-security-config", "installed_version": "6.0.3", "fixed_version": "5.6.12, 5.7.10, 5.8.5, 6.0.5, 6.1.2", "title": "spring-security-webflux: path wildcard leads to security bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-34034" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2024-38821", "package": "org.springframework.security:spring-security-web", "installed_version": "6.0.3", "fixed_version": "5.7.13, 5.8.15, 6.2.7, 6.0.13, 6.1.11, 6.3.4", "title": "Spring-WebFlux: Authorization Bypass of Static Resources in WebFlux Applications", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38821" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-22732", "package": "org.springframework.security:spring-security-web", "installed_version": "6.0.3", "fixed_version": "6.5.9, 7.0.4", "title": "Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22732" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.9", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40477", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via security bypass in expression execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40477" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-40478", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.4.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40478" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41901", "package": "org.thymeleaf:thymeleaf-spring6", "installed_version": "3.1.1.RELEASE", "fixed_version": "3.1.5.RELEASE", "title": "thymeleaf: Thymeleaf: Server-Side Template Injection (SSTI) via expression execution bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-6378", "package": "ch.qos.logback:logback-classic", "installed_version": "1.4.7", "fixed_version": "1.3.12, 1.4.12, 1.2.13", "title": "logback: serialization vulnerability in logback receiver", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6378" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-6378", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.7", "fixed_version": "1.3.12, 1.4.12, 1.2.13", "title": "logback: serialization vulnerability in logback receiver", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6378" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-52999", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.14.3", "fixed_version": "2.15.0", "title": "com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-52999" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.14.3", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.14.3", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-102554", "package": "com.google.guava:guava", "installed_version": "31.1-jre", "fixed_version": "33.7.2", "title": "com.google.guava/guava: Google Guava: Denial of Service via unthrottled memory allocation during deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-102554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48734", "package": "commons-beanutils:commons-beanutils", "installed_version": "1.9.4", "fixed_version": "1.11.0", "title": "commons-beanutils: Apache Commons BeanUtils: PropertyUtilsBean does not suppresses an enum's declaredClass property by default", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48976", "package": "commons-fileupload:commons-fileupload", "installed_version": "1.5", "fixed_version": "1.6.0", "title": "apache-commons-fileupload: Apache Commons FileUpload DoS via part headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48976" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-47554", "package": "commons-io:commons-io", "installed_version": "2.11.0", "fixed_version": "2.14.0", "title": "apache-commons-io: Possible denial of service attack on untrusted input to XmlStreamReader", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-47554" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.10.7", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2023-5363", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r0", "title": "openssl: Incorrect cipher key and IV length processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-6119", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.7-r0", "title": "openssl: Possible denial of service in X.509 name checks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-6119" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2023-52425", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.0-r0", "title": "expat: parsing large tokens can trigger a denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-52425" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-28757", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.2-r0", "title": "expat: XML Entity Expansion", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-28757" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-45490", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.3-r0", "title": "libexpat: Negative Length Parsing Vulnerability in libexpat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-45490" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2023-5363", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r0", "title": "openssl: Incorrect cipher key and IV length processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2024-6119", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.7-r0", "title": "openssl: Possible denial of service in X.509 name checks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-6119" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-26519", "package": "musl", "installed_version": "1.2.4-r1", "fixed_version": "1.2.4-r3", "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-26519" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-26519", "package": "musl-utils", "installed_version": "1.2.4-r1", "fixed_version": "1.2.4-r3", "title": "musl libc 0.9.13 through 1.2.5 before 1.2.6 has an out-of-bounds write ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-26519" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-34981", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.0-M6, 10.1.9, 9.0.75", "title": "tomcat: response headers from the previous request leading to an information leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-34981" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-46589", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.0-M11, 10.1.16, 9.0.83, 8.5.96", "title": "tomcat: HTTP request smuggling via malformed trailer headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-46589" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-34750", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.0-M21, 10.1.25, 9.0.90", "title": "tomcat: Improper Handling of Exceptional Conditions", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-34750" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38286", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.0-M21, 10.1.25, 9.0.90", "title": "tomcat: Denial of Service in Tomcat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38286" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-50379", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.2, 10.1.34, 9.0.98", "title": "tomcat: RCE due to TOCTOU issue in JSP compilation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-50379" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-56337", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.2, 10.1.34, 9.0.98", "title": "tomcat: Incomplete fix for CVE-2024-50379 - RCE due to TOCTOU issue in JSP compilation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-56337" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48988", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "tomcat: Apache Tomcat DoS in multipart upload", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48988" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-48989", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.10, 10.1.44, 9.0.108", "title": "tomcat: http/2 \"MadeYouReset\" DoS attack through HTTP/2 control frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48989" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-52520", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.9, 10.1.43, 9.0.107", "title": "tomcat: Apache Tomcat denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-52520" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-53506", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.107, 10.1.43, 11.0.9", "title": "tomcat: Apache Tomcat denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-53506" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-55752", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.11, 10.1.45, 9.0.109", "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Directory traversal via rewrite with possible RCE", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55752" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24734", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.18, 10.1.52, 9.0.115", "title": "tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24880", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.116, 10.1.52, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24880" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34483", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.116, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34483" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34487", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.117, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34487" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41284", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41284" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42498", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42498" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-43513", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2022-45688", "package": "org.json:json", "installed_version": "20170516", "fixed_version": "20230227", "title": "json stack overflow vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-45688" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-5072", "package": "org.json:json", "installed_version": "20170516", "fixed_version": "20231013", "title": "JSON-java: parser confusion leads to OOM", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5072" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42198", "package": "org.postgresql:postgresql", "installed_version": "42.5.4", "fixed_version": "42.7.11", "title": "jdbc.postgresql.org: pgjdbc: Client-side Denial of Service via malicious SCRAM-SHA-256 authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42198" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-34035", "package": "org.springframework.security:spring-security-config", "installed_version": "6.0.3", "fixed_version": "5.8.5, 6.0.5, 6.1.2", "title": "Spring Security's authorization rules can be misconfigured when using multiple servlets", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-34035" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22257", "package": "org.springframework.security:spring-security-core", "installed_version": "6.0.3", "fixed_version": "5.7.12, 5.8.11, 6.1.8, 6.2.3", "title": "spring-security: Broken Access Control With Direct Use of AuthenticatedVoter", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22257" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-22228", "package": "org.springframework.security:spring-security-crypto", "installed_version": "6.0.3", "fixed_version": "6.3.8, 6.4.4, 6.2.10, 6.1.14, 6.0.16, 5.8.18, 5.7.16", "title": "spring-security-core: Spring Security BCryptPasswordEncoder does not enforce maximum password length", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22228" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2025-41249", "package": "org.springframework:spring-core", "installed_version": "6.0.9", "fixed_version": "6.2.11", "title": "org.springframework/spring-core: Spring Framework Annotation Detection Vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41249" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22243", "package": "org.springframework:spring-web", "installed_version": "6.0.9", "fixed_version": "6.1.4, 6.0.17, 5.3.32", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22243" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22259", "package": "org.springframework:spring-web", "installed_version": "6.0.9", "fixed_version": "6.1.5, 6.0.18, 5.3.33", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22259" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-22262", "package": "org.springframework:spring-web", "installed_version": "6.0.9", "fixed_version": "5.3.34, 6.0.19, 6.1.6", "title": "springframework: URL Parsing with Host Validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-22262" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2023-34053", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.9", "fixed_version": "6.0.14", "title": "springframework: io.micrometer: micrometer-core classpath vulnerable to denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-34053" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38816", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.9", "fixed_version": "6.1.13", "title": "spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38816" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2024-38819", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.9", "fixed_version": "6.1.14", "title": "org.springframework:spring-webmvc: Path traversal vulnerability in functional web frameworks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38819" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2022-1471", "package": "org.yaml:snakeyaml", "installed_version": "1.33", "fixed_version": "2.0", "title": "SnakeYaml: Constructor Deserialization Remote Code Execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2022-1471" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "busybox", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "busybox", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "busybox", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "busybox", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r6", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "busybox-binsh", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "busybox-binsh", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "busybox-binsh", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "busybox-binsh", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r6", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-12798", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.7", "fixed_version": "1.5.13, 1.3.15", "title": "logback-core: arbitrary code execution via JaninoEventEvaluator", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12798" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-11226", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.7", "fixed_version": "1.5.19, 1.3.16", "title": "ch.qos.logback/logback-core: Conditional abitrary code execution in logback-core", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-11226" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.14.3", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-2976", "package": "com.google.guava:guava", "installed_version": "31.1-jre", "fixed_version": "32.0.0-android", "title": "guava: insecure temporary directory creation", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-2976" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-5678", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r1", "title": "openssl: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5678" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-6129", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r3", "title": "openssl: POLY1305 MAC implementation corrupts vector registers on PowerPC", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6129" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-0727", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r5", "title": "openssl: denial of service via null dereference", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-0727" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-52426", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.0-r0", "title": "expat: recursive XML entity expansion vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-52426" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-50602", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.6.4-r0", "title": "libexpat: expat: DoS via XML_ResumeParser", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-50602" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-8176", "package": "libexpat", "installed_version": "2.5.0-r1", "fixed_version": "2.7.0-r0", "title": "libexpat: expat: Improper Restriction of XML Entity Expansion Depth in libexpat", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-8176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-5678", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r1", "title": "openssl: Generating excessively long X9.42 DH keys or checking excessively long X9.42 DH keys or parameters may be very slow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-5678" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-6129", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r3", "title": "openssl: POLY1305 MAC implementation corrupts vector registers on PowerPC", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6129" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-0727", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r5", "title": "openssl: denial of service via null dereference", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-0727" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-12133", "package": "libtasn1", "installed_version": "4.19.0-r1", "fixed_version": "4.20.0-r0", "title": "libtasn1: Inefficient DER Decoding in libtasn1 Leading to Potential Remote DoS", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12133" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-25710", "package": "org.apache.commons:commons-compress", "installed_version": "1.21", "fixed_version": "1.26.0", "title": "commons-compress: Denial of service caused by an infinite loop for a corrupted DUMP file", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-25710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-26308", "package": "org.apache.commons:commons-compress", "installed_version": "1.21", "fixed_version": "1.26.0", "title": "commons-compress: OutOfMemoryError unpacking broken Pack200 file", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-26308" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-48924", "package": "org.apache.commons:commons-lang3", "installed_version": "3.12.0", "fixed_version": "3.18.0", "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48924" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49844", "package": "org.apache.logging.log4j:log4j-api", "installed_version": "2.19.0", "fixed_version": "2.25.5, 2.26.1", "title": "org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-31672", "package": "org.apache.poi:poi-ooxml", "installed_version": "5.2.3", "fixed_version": "5.4.0", "title": "org.apache.poi/poi-ooxml: Apache POI: parsing OOXML based files (xlsx, docx, etc.), poi-ooxml could read unexpected data if underlying zip has duplicate zip entry names", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-31672" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-41080", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "8.5.93, 9.0.80, 10.1.13, 11.0.0-M11", "title": "tomcat: Open Redirect vulnerability in FORM authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-41080" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42795", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "10.1.14, 9.0.81, 8.5.94, 11.0.0-M12", "title": "tomcat: improper cleaning of recycled objects could lead to information leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42795" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-44487", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.0-M12, 10.1.14, 9.0.81, 8.5.94", "title": "HTTP/2: Multiple HTTP/2 enabled web servers are vulnerable to a DDoS attack (Rapid Reset Attack)", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-44487" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-45648", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.0-M12, 10.1.14, 9.0.81, 8.5.94", "title": "tomcat: incorrectly parsed http trailer headers can cause request smuggling", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-45648" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-24549", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "8.5.99, 9.0.86, 10.1.19, 11.0.0-M17", "title": "Tomcat: HTTP/2 header handling DoS", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-24549" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-49124", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "Apache Tomcat installer for Windows has an untrusted search path vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49124" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-49125", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "tomcat: Apache Tomcat: Security constraint bypass for pre/post-resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-49125" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-55668", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.8, 10.1.42, 9.0.106", "title": "org.apache.tomcat/tomcat-catalina: tomcat: Apache Tomcat: session fixation via rewrite valve", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55668" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-66614", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.15, 10.1.50, 9.0.113", "title": "tomcat: Client certificate verification bypass due to virtual host mapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-66614" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-25854", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.116, 10.1.53, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-25854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-23672", "package": "org.apache.tomcat.embed:tomcat-embed-websocket", "installed_version": "10.1.8", "fixed_version": "11.0.0-M17, 10.1.19, 9.0.86, 8.5.99", "title": "Tomcat: WebSocket DoS with incomplete closing handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-23672" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-7962", "package": "org.eclipse.angus:smtp", "installed_version": "1.0.0", "fixed_version": "2.0.4", "title": "com.sun.mail/jakarta.mail: Jakarta Mail SMTP Injection Vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-7962" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-34055", "package": "org.springframework.boot:spring-boot-actuator", "installed_version": "3.0.7", "fixed_version": "2.7.18, 3.0.13, 3.1.6", "title": "spring-boot: org.springframework.boot: spring-boot-actuator class vulnerable to denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-34055" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41711", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.0.6", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via parsing Sort parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41711" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41721", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.0.6", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via specially crafted HTTP request with @ProjectedPayload", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41721" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41710", "package": "org.springframework.retry:spring-retry", "installed_version": "2.0.1", "fixed_version": "2.0.13", "title": "spring-retry: Spring Retry: Denial of Service via cache exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41710" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38827", "package": "org.springframework.security:spring-security-core", "installed_version": "6.0.3", "fixed_version": "5.7.14, 5.8.16, 6.0.14, 6.1.12, 6.2.8, 6.3.5", "title": "spring-security: authorization bypass for case sensitive comparisons", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38827" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47838", "package": "org.springframework.security:spring-security-web", "installed_version": "6.0.3", "fixed_version": "6.5.11", "title": "Spring Security Vulnerable to Unauthorized User Impersonation when Using X.509 Client Certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47838" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38820", "package": "org.springframework:spring-context", "installed_version": "6.0.9", "fixed_version": "6.1.14", "title": "The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38820" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38809", "package": "org.springframework:spring-web", "installed_version": "6.0.9", "fixed_version": "5.3.38, 6.0.23, 6.1.12", "title": "org.springframework:spring-web: Spring Framework DoS via conditional HTTP request", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38809" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-38820", "package": "org.springframework:spring-web", "installed_version": "6.0.9", "fixed_version": "6.1.14", "title": "The fix for CVE-2022-22968 made disallowedFieldspatterns in DataBinder ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-38820" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-41234", "package": "org.springframework:spring-web", "installed_version": "6.0.9", "fixed_version": "6.2.8, 6.1.21", "title": "springframework: Reflected download attack in Spring Framework with non-ASCII headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41234" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-41242", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.9", "fixed_version": "6.2.10", "title": "org.springframework/spring-webmvc: Spring Framework MVC path traversal vulnerability", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-41242" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22737", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.9", "fixed_version": "7.0.6, 6.2.17", "title": "Spring Framework: Spring Framework: Information disclosure via Java scripting engine enabled template views", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22737" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42363", "package": "ssl_client", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free in awk", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42363" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42364", "package": "ssl_client", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42364" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42365", "package": "ssl_client", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r7", "title": "busybox: use-after-free", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42365" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2023-42366", "package": "ssl_client", "installed_version": "1.36.1-r2", "fixed_version": "1.36.1-r6", "title": "busybox: A heap-buffer-overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-42366" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2024-12801", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.7", "fixed_version": "1.5.13, 1.3.15", "title": "logback-core: SaxEventRecorder vulnerable to Server-Side Request Forgery (SSRF) attacks", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-12801" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-10532", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.7", "fixed_version": "1.5.34", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-10532" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-1225", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.7", "fixed_version": "1.5.25", "title": "ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-1225" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-9828", "package": "ch.qos.logback:logback-core", "installed_version": "1.4.7", "fixed_version": "1.5.33", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9828" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2020-8908", "package": "com.google.guava:guava", "installed_version": "31.1-jre", "fixed_version": "32.0.0-android", "title": "guava: local information disclosure via temporary directory created with unsafe permissions", "primary_url": "https://avd.aquasec.com/nvd/cve-2020-8908" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-6237", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r4", "title": "openssl: Excessive time spent checking invalid RSA public keys", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6237" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-13176", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.8-r0", "title": "openssl: Timing side-channel in ECDSA signature computation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-2511", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r6", "title": "openssl: Unbounded memory growth with session handling in TLSv1.3", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-2511" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4603", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.5-r0", "title": "openssl: Excessive time spent checking DSA keys and parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4603" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4741", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.6-r0", "title": "openssl: Use After Free with SSL_free_buffers", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-5535", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.6-r0", "title": "openssl: SSL_select_next_proto buffer overread", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-5535" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-9143", "package": "libcrypto3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.7-r1", "title": "openssl: Low-level invalid GF(2^m) parameters lead to OOB memory access", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-9143" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2023-6237", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r4", "title": "openssl: Excessive time spent checking invalid RSA public keys", "primary_url": "https://avd.aquasec.com/nvd/cve-2023-6237" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-13176", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.8-r0", "title": "openssl: Timing side-channel in ECDSA signature computation", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-13176" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-2511", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.4-r6", "title": "openssl: Unbounded memory growth with session handling in TLSv1.3", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-2511" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4603", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.5-r0", "title": "openssl: Excessive time spent checking DSA keys and parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4603" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-4741", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.6-r0", "title": "openssl: Use After Free with SSL_free_buffers", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-4741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-5535", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.6-r0", "title": "openssl: SSL_select_next_proto buffer overread", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-5535" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/control:23.0.0 (alpine 3.18.3)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2024-9143", "package": "libssl3", "installed_version": "3.1.2-r0", "fixed_version": "3.1.7-r1", "title": "openssl: Low-level invalid GF(2^m) parameters lead to OOB memory access", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-9143" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-46701", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.105, 10.1.41, 11.0.7", "title": "tomcat: Apache Tomcat: Security constraint bypass for CGI scripts", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46701" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-55754", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.11, 10.1.45, 9.0.109", "title": "org.apache.tomcat/tomcat-juli: tomcat: Apache Tomcat: console manipulation", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-55754" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-61795", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "11.0.12, 10.1.47, 9.0.110", "title": "tomcat: org.apache.tomcat/tomcat-catalina: Apache Tomcat: Denial of service", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-61795" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-43514", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.8", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2025-22233", "package": "org.springframework:spring-context", "installed_version": "6.0.9", "fixed_version": "6.2.7, 6.1.20", "title": "CVE-2024-38820 ensured Locale-independent, lowercase conversion for bo ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-22233" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22735", "package": "org.springframework:spring-webmvc", "installed_version": "6.0.9", "fixed_version": "7.0.6, 6.2.17", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring MVC and WebFlux: Stream corruption vulnerability when using Server-Sent Events", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22735" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1", "vulnerability_count": 200, "highest_severity": "CRITICAL", "findings": [ { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed_version": "4.1.128.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-31789", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-31789", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.48", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.48", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.48", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.48", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.48", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.48", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.12", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.12", "fixed_version": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68494", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-core: tools.jackson.core/jackson-core: jackson-core: Denial of Service via incomplete fix in async JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68494" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.2", "fixed_version": "2.21.7, 2.22.3, 2.18.11", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54512", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.8, 3.1.4, 2.21.4", "title": "jackson-databind: jackson-databind: Arbitrary code execution via PolymorphicTypeValidator bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54512" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-54513", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: Jackson-databind: Security bypass allows arbitrary code execution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.11, 2.21.7, 2.22.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.21.7, 2.18.11, 2.22.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40983", "package": "io.micrometer:micrometer-core", "installed_version": "1.15.5", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer: micrometer-core: Micrometer: Denial of Service via specially crafted gRPC requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40983" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40984", "package": "io.micrometer:micrometer-core", "installed_version": "1.15.5", "fixed_version": "1.16.6, 1.15.12", "title": "micrometer-core: micrometer-jetty11: micrometer-jetty12: Micrometer: Denial of Service via specially crafted HTTP requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40984" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42583", "package": "io.netty:netty-codec", "installed_version": "4.1.128.Final", "fixed_version": "4.1.133.Final", "title": "netty: io.netty/netty-codec-compression: io.netty/netty-codec: Netty: Denial of Service via excessive memory allocation in LZ4FrameDecoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42583" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-59901", "package": "io.netty:netty-codec", "installed_version": "4.1.128.Final", "fixed_version": "4.1.136.Final", "title": "io.netty/netty-codec-compression: Netty: Infinite loop in netty-codec-compression (bzip2)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59901" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-33870", "package": "io.netty:netty-codec-http", "installed_version": "4.1.128.Final", "fixed_version": "4.1.132.Final, 4.2.10.Final", "title": "io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33870" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42584", "package": "io.netty:netty-codec-http", "installed_version": "4.1.128.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: Incorrect HTTP response parsing leads to data confusion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42584" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42587", "package": "io.netty:netty-codec-http", "installed_version": "4.1.128.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42587" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55831", "package": "io.netty:netty-codec-http", "installed_version": "4.1.128.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Denial of Service via SPDY SETTINGS frame processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55831" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-55833", "package": "io.netty:netty-codec-http", "installed_version": "4.1.128.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via SPDY header decompression amplification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-55833" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56745", "package": "io.netty:netty-codec-http", "installed_version": "4.1.128.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "netty: io.netty/netty-codec-http: Netty: Denial of Service via memory exhaustion in SPDY-to-HTTP codec", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-33871", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.128.Final", "fixed_version": "4.1.132.Final, 4.2.11.Final", "title": "netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33871" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42587", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.128.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: io.netty/netty-codec-http2: Netty: Denial of Service via unbounded memory allocation in HTTP content decompression", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42587" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-56819", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.128.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Denial of Service via HTTP/2 DATA frame memory leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56819" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-44249", "package": "io.netty:netty-handler", "installed_version": "4.1.128.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: netty-handler: IPv6 subnet rule bypass due to incorrect masking operation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-44249" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-45416", "package": "io.netty:netty-handler", "installed_version": "4.1.128.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: Netty: Denial of Service due to eager buffer allocation in TLS handshake", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45416" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-50010", "package": "io.netty:netty-handler", "installed_version": "4.1.128.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-handler: Netty: Improper trust manager handling leads to hostname verification bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50010" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-15467", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-15467" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-69421", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-69421" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-28387", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.6-r0", "title": "openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-28387" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-28388", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.6-r0", "title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-28388" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-28389", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.6-r0", "title": "openssl: OpenSSL: Denial of Service vulnerability in CMS processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-28389" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-28390", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.6-r0", "title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-28390" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-45447", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45447" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-15467", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Remote code execution or Denial of Service via oversized Initialization Vector in CMS parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-15467" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2025-69421", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Denial of Service via malformed PKCS#12 file processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-69421" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-28387", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.6-r0", "title": "openssl: OpenSSL: Arbitrary code execution due to use-after-free in DANE TLSA authentication", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-28387" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-28388", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.6-r0", "title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in delta CRL processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-28388" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-28389", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.6-r0", "title": "openssl: OpenSSL: Denial of Service vulnerability in CMS processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-28389" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-28390", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.6-r0", "title": "openssl: OpenSSL: Denial of Service due to NULL pointer dereference in CMS EnvelopedData processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-28390" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-45447", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: Heap Use-After-Free in OpenSSL PKCS7_verify()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45447" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-40200", "package": "musl", "installed_version": "1.2.5-r10", "fixed_version": "1.2.5-r12", "title": "musl: musl libc: Arbitrary code execution and denial of service via stack-based memory corruption in qsort", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40200" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-40200", "package": "musl-utils", "installed_version": "1.2.5-r10", "fixed_version": "1.2.5-r12", "title": "musl: musl libc: Arbitrary code execution and denial of service via stack-based memory corruption in qsort", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40200" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24734", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.48", "fixed_version": "11.0.18, 10.1.52, 9.0.115", "title": "tomcat: Apache Tomcat: Certificate revocation bypass due to improper OCSP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24734" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-24880", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.48", "fixed_version": "9.0.116, 10.1.52, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: HTTP Request/Response Smuggling via invalid chunk extension", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-24880" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34483", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.48", "fixed_version": "9.0.116, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure due to improper encoding in JsonAccessLogValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34483" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-34487", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.48", "fixed_version": "9.0.117, 10.1.54, 11.0.21", "title": "Apache Tomcat: Apache Tomcat: Information disclosure via sensitive data in log files", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34487" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41284", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.48", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Denial of Service due to uncontrolled resource allocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41284" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-42498", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.48", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Information disclosure due to HTTP Authentication Header exposure during WebSocket authentication.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42498" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-43513", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.48", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-catalina: Apache Tomcat: Improper Handling of Case Sensitivity in LockOutRealm", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43513" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40973", "package": "org.springframework.boot:spring-boot", "installed_version": "3.5.7", "fixed_version": "4.0.6, 3.5.14", "title": "Spring Boot: Spring Boot: Arbitrary Code Execution and Session Hijacking via predictable temporary directory", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40973" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41695", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.5", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via crafted property path strings", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41695" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41716", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.5", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service due to cache exhaustion via attacker-supplied strings", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41716" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40999", "package": "org.springframework.ws:spring-ws-core", "installed_version": "4.1.2", "fixed_version": "5.0.2, 4.1.4", "title": "Spring Web Services: SSRF via unvalidated WS-Addressing reply destinations", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40999" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-40998", "package": "org.springframework.ws:spring-xml", "installed_version": "4.1.2", "fixed_version": "5.0.2, 4.1.4", "title": "org.springframework.ws/spring-xml: Spring Web Services: XML External Entity (XXE) attack via untrusted XML payloads", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-40998" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41850", "package": "org.springframework:spring-expression", "installed_version": "6.2.12", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service via specially crafted SpEL expressions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41850" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41842", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.12", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Denial of Service when resolving static resources", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41842" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-41845", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.12", "fixed_version": "7.0.8, 6.2.19", "title": "org.springframework: Spring Framework: Cross-site scripting (XSS) via incorrect JavaScript escaping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41845" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-22184", "package": "zlib", "installed_version": "1.3.1-r2", "fixed_version": "1.3.2-r0", "title": "zlib: zlib: Arbitrary code execution via buffer overflow in untgz utility", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22184" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-58251", "package": "busybox", "installed_version": "1.37.0-r19", "fixed_version": "1.37.0-r20", "title": "In netstat in BusyBox through 1.37.0, local users can launch of networ ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-58251" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-58251", "package": "busybox-binsh", "installed_version": "1.37.0-r19", "fixed_version": "1.37.0-r20", "title": "In netstat in BusyBox through 1.37.0, local users can launch of networ ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-58251" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18401", "package": "com.fasterxml.jackson.core:jackson-core", "installed_version": "2.19.2", "fixed_version": "2.21.1, 2.18.6", "title": "tools.jackson.core/jackson-core: com.fasterxml.jackson.core/jackson-core: jackson-core: Denial of Service due to number length bypass in asynchronous JSON parser", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18401" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54514", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.8, 2.21.4, 3.1.4", "title": "jackson-databind: jackson-databind: Information Disclosure via Eager DNS Resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-54515", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "3.1.4, 2.18.9, 2.21.5, 2.22.1", "title": "jackson-databind: jackson-databind: Ignored properties can be unexpectedly modified", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54515" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59888", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.8, 2.21.4", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: @JsonIgnore bypass in Java Records", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59888" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59889", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.21.5, 2.18.9, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: Jackson-databind: Privilege escalation via improper handling of @JsonUnwrapped properties", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59889" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-77310", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.9, 2.21.5, 2.22.1", "title": "com.fasterxml.jackson.core/jackson-databind: jackson-databind: Server-Side Request Forgery and internal host enumeration via eager DNS resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-77310" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "com.fasterxml.jackson.core:jackson-databind", "installed_version": "2.19.2", "fixed_version": "2.18.10, 2.21.6, 2.22.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-67735", "package": "io.netty:netty-codec-http", "installed_version": "4.1.128.Final", "fixed_version": "4.2.8.Final, 4.1.129.Final", "title": "netty-codec-http: Netty (netty-codec-http): Request Smuggling via CRLF Injection", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-67735" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41417", "package": "io.netty:netty-codec-http", "installed_version": "4.1.128.Final", "fixed_version": "4.1.133.Final, 4.2.13.Final", "title": "netty: Netty: HTTP request smuggling via URI manipulation and CRLF injection", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41417" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42580", "package": "io.netty:netty-codec-http", "installed_version": "4.1.128.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: Netty: Request smuggling via chunk size parser integer overflow", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42580" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42581", "package": "io.netty:netty-codec-http", "installed_version": "4.1.128.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: HTTP Request Smuggling due to improper handling of conflicting HTTP/1.0 headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42581" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42585", "package": "io.netty:netty-codec-http", "installed_version": "4.1.128.Final", "fixed_version": "4.2.13.Final, 4.1.133.Final", "title": "netty: io.netty/netty-codec-http: Netty: Request smuggling via malformed Transfer-Encoding parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42585" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50020", "package": "io.netty:netty-codec-http", "installed_version": "4.1.128.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http: Netty: Data manipulation via request-boundary confusion in HttpObjectDecoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50020" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56746", "package": "io.netty:netty-codec-http", "installed_version": "4.1.128.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Security control bypass allows unauthorized requests via null origin header", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56746" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59898", "package": "io.netty:netty-codec-http", "installed_version": "4.1.128.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Protocol version confusion in netty-codec-http (WebSocket)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59898" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59899", "package": "io.netty:netty-codec-http", "installed_version": "4.1.128.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: Memory exhaustion in netty-codec-http (decompression bomb)", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59899" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59903", "package": "io.netty:netty-codec-http", "installed_version": "4.1.128.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty: Netty: Information disclosure via CORS Vary header overwrite", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59903" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59921", "package": "io.netty:netty-codec-http", "installed_version": "4.1.128.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http: Netty: CRLF Injection via Multipart Filename in Netty HttpPostRequestEncoder", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59921" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-47244", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.128.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http2: Netty: Denial of Service via uncontrolled HTTP/2 concurrent streams", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-47244" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-48043", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.128.Final", "fixed_version": "4.1.135.Final, 4.2.15.Final", "title": "netty-codec-http2: netty-codec-http2: Denial of Service due to resource leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-48043" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-50560", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.128.Final", "fixed_version": "4.2.15.Final, 4.1.135.Final", "title": "netty-codec-http2: Netty: Denial of Service due to HTTP/2 max header size handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-50560" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-59900", "package": "io.netty:netty-codec-http2", "installed_version": "4.1.128.Final", "fixed_version": "4.2.16.Final, 4.1.136.Final", "title": "io.netty/netty-codec-http2: Netty: Improper header neutralization in netty-codec-http2", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-59900" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-75596", "package": "io.netty:netty-handler", "installed_version": "4.1.128.Final", "fixed_version": "4.2.17.Final, 4.1.137.Final", "title": "Netty is an asynchronous, event-driven network application framework. ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75596" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-11187", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-11187" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-69419", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-69419" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-2673", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.6-r0", "title": "openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2673" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-31790", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.6-r0", "title": "openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-31790" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-34182", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34182" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-34183", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34183" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42764", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: NULL pointer dereference in QUIC server initial packet handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42764" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-45445", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: AES-OCB IV Ignored on EVP_Cipher() Path", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45445" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-11187", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Arbitrary code execution or denial of service through crafted PKCS#12 file", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-11187" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-69419", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Arbitrary code execution due to out-of-bounds write in PKCS#12 processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-69419" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-2673", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.6-r0", "title": "openssl: OpenSSL TLS 1.3 server may choose unexpected key agreement group", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-2673" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-31790", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.6-r0", "title": "openssl: openssl: Information Disclosure from Uninitialized Memory via Invalid RSA Public Key", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-31790" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-34182", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: CMS AuthEnvelopedData Processing May Accept Forged Messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34182" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-34183", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: Unbounded Memory Growth in the QUIC PATH_CHALLENGE Handler", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34183" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-42764", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: NULL pointer dereference in QUIC server initial packet handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42764" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-45445", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: AES-OCB IV Ignored on EVP_Cipher() Path", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45445" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6042", "package": "musl", "installed_version": "1.2.5-r10", "fixed_version": "1.2.5-r11", "title": "musl libc: GB18030 4-byte Decoder: musl libc: Denial of Service via inefficient algorithmic complexity in iconv", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6042" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-6042", "package": "musl-utils", "installed_version": "1.2.5-r10", "fixed_version": "1.2.5-r11", "title": "musl libc: GB18030 4-byte Decoder: musl libc: Denial of Service via inefficient algorithmic complexity in iconv", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-6042" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-48924", "package": "org.apache.commons:commons-lang3", "installed_version": "3.17.0", "fixed_version": "3.18.0", "title": "commons-lang/commons-lang: org.apache.commons/commons-lang3: Uncontrolled Recursion vulnerability in Apache Commons Lang", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-48924" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-49844", "package": "org.apache.logging.log4j:log4j-api", "installed_version": "2.24.3", "fixed_version": "2.25.5, 2.26.1", "title": "org.apache.logging.log4j/log4j-api: Apache Log4j API: Malformed JSON output due to improper encoding of floating-point values", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-49844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2025-66614", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.48", "fixed_version": "11.0.15, 10.1.50, 9.0.113", "title": "tomcat: Client certificate verification bypass due to virtual host mapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-66614" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-25854", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.48", "fixed_version": "9.0.116, 10.1.53, 11.0.20", "title": "Apache Tomcat: Apache Tomcat: Open Redirect vulnerability via LoadBalancerDrainingValve", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-25854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41001", "package": "org.springframework.boot:spring-boot-autoconfigure", "installed_version": "3.5.7", "fixed_version": "4.0.7, 3.5.15", "title": "spring-boot: Spring Boot: Local attacker can manipulate data directory due to predictable path", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41001" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41711", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.5", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via parsing Sort parameters", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41711" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41721", "package": "org.springframework.data:spring-data-commons", "installed_version": "3.5.5", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Commons: Spring Data Commons: Denial of Service via specially crafted HTTP request with @ProjectedPayload", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41721" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41697", "package": "org.springframework.data:spring-data-relational", "installed_version": "3.5.5", "fixed_version": "4.0.6, 3.5.12", "title": "Spring Data Relational: Spring Data Relational: Information disclosure via improper input escaping in Query By Example", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41697" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41851", "package": "org.springframework:spring-expression", "installed_version": "6.2.12", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Denial of Service via unbounded cache growth in SpEL evaluation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41851" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41854", "package": "org.springframework:spring-web", "installed_version": "6.2.12", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Server-Side Request Forgery via incorrect host parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41854" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22737", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.12", "fixed_version": "7.0.6, 6.2.17", "title": "Spring Framework: Spring Framework: Information disclosure via Java scripting engine enabled template views", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22737" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-22745", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.12", "fixed_version": "7.0.7, 6.2.18", "title": "spring-webflux: Spring MVC and Spring WebFlux: Denial of Service via slow static resource resolution on Windows", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22745" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41841", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.12", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring MVC and WebFlux applications: Information Disclosure via static resource resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41841" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41843", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.12", "fixed_version": "7.0.8, 6.2.19", "title": "spring-webflux: spring-webmvc: Spring Framework: Information Disclosure via Path Traversal", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41843" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41844", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.12", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Open Redirect via crafted link", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41844" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41846", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.12", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Cross-site scripting (XSS) via user-supplied values in JSP form tags", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41846" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41853", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.12", "fixed_version": "7.0.8, 6.2.19", "title": "Spring Framework: Spring Framework: Request smuggling vulnerability in Spring MVC and WebFlux", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41853" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2024-58251", "package": "ssl_client", "installed_version": "1.37.0-r19", "fixed_version": "1.37.0-r20", "title": "In netstat in BusyBox through 1.37.0, local users can launch of networ ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2024-58251" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-27171", "package": "zlib", "installed_version": "1.3.1-r2", "fixed_version": "1.3.2-r0", "title": "zlib: zlib: Denial of Service via infinite loop in CRC32 combine functions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-27171" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-85091", "package": "zlib", "installed_version": "1.3.1-r2", "fixed_version": "1.3.2-r1", "title": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vul ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-85091" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-46394", "package": "busybox", "installed_version": "1.37.0-r19", "fixed_version": "1.37.0-r20", "title": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hid ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46394" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-46394", "package": "busybox-binsh", "installed_version": "1.37.0-r19", "fixed_version": "1.37.0-r20", "title": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hid ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46394" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-10532", "package": "ch.qos.logback:logback-core", "installed_version": "1.5.20", "fixed_version": "1.5.34", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-10532" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-1225", "package": "ch.qos.logback:logback-core", "installed_version": "1.5.20", "fixed_version": "1.5.25", "title": "ch.qos.logback/logback-core: Malicious logback.xml configuration file allows instantiation of arbitrary classes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-1225" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-9828", "package": "ch.qos.logback:logback-core", "installed_version": "1.5.20", "fixed_version": "1.5.33", "title": "Deserialization of untrusted data vulnerability in QOS.CH Sarl logback ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9828" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-15468", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-15468" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-15469", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Data integrity bypass in `openssl dgst` command due to silent truncation", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-15469" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-66199", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-66199" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-68160", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68160" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-69418", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-69418" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-69420", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Denial of Service via malformed TimeStamp Response", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-69420" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-22795", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22795" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-22796", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22796" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-34180", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34180" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-34181", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34181" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-42766", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: Possible NULL Dereference in Password-Based CMS Decryption", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42766" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-42767", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42767" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-42768", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42768" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-42769", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42769" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-42770", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: FFC-DH Peer Validation Uses Attacker-Supplied q", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42770" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-45446", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45446" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-7383", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-7383" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-9076", "package": "libcrypto3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9076" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-15468", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Denial of Service via NULL pointer dereference in QUIC protocol handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-15468" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-15469", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Data integrity bypass in `openssl dgst` command due to silent truncation", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-15469" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-66199", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Denial of Service due to excessive memory allocation in TLS 1.3 certificate compression", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-66199" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-68160", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Denial of Service due to out-of-bounds write in BIO filter", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-68160" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-69418", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Information disclosure and data tampering via specific low-level OCB encryption/decryption calls", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-69418" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-69420", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Denial of Service via malformed TimeStamp Response", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-69420" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-22795", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Denial of Service due to type confusion in PKCS#12 file processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22795" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-22796", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.5-r0", "title": "openssl: OpenSSL: Denial of Service via type confusion in PKCS#7 signature verification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22796" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-34180", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: OpenSSL: Heap buffer over-read in ASN.1 decoding can lead to denial of service or information disclosure.", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34180" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-34181", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: PKCS#12 Files with PBMAC1 Are Accepted with Short HMAC Keys", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-34181" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-42766", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: Possible NULL Dereference in Password-Based CMS Decryption", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42766" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-42767", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: NULL Pointer Dereference in CRMF EncryptedValue Decryption", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42767" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-42768", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: Multi-RecipientInfo Bleichenbacher Oracle in CMS_decrypt() and PKCS7_decrypt()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42768" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-42769", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: Trust-Anchor Substitution via cert/issuer Typo in CMP rootCaKeyUpdate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42769" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-42770", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: FFC-DH Peer Validation Uses Attacker-Supplied q", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42770" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-45446", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: Incorrect Tag Processing for Empty Messages in AES-GCM-SIV and AES-SIV modes", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-45446" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-7383", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow due to signed integer overflow in Unicode output sizing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-7383" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-9076", "package": "libssl3", "installed_version": "3.5.4-r0", "fixed_version": "3.5.7-r0", "title": "openssl: OpenSSL: Denial of Service due to heap out-of-bounds read in CMS password-based decryption", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-9076" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-43514", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "10.1.48", "fixed_version": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat: Apache Tomcat: Information disclosure via AJP secret timing discrepancy", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-43514" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41848", "package": "org.springframework:spring-core", "installed_version": "6.2.12", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: Spring Framework: Regular Expression Denial of Service in AntPathMatcher", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41848" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-41852", "package": "org.springframework:spring-expression", "installed_version": "6.2.12", "fixed_version": "7.0.8, 6.2.19", "title": "spring-framework: org.springframework/spring-expression: Spring Framework: SpEL vulnerability allows unintended application logic invocation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41852" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22735", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.12", "fixed_version": "7.0.6, 6.2.17", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring MVC and WebFlux: Stream corruption vulnerability when using Server-Sent Events", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22735" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "LOW", "vulnerability_id": "CVE-2026-22741", "package": "org.springframework:spring-webmvc", "installed_version": "6.2.12", "fixed_version": "7.0.7, 6.2.18", "title": "Spring MVC: Spring WebFlux: Spring MVC and Spring WebFlux: Denial of Service via cache poisoning", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-22741" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2025-46394", "package": "ssl_client", "installed_version": "1.37.0-r19", "fixed_version": "1.37.0-r20", "title": "In tar in BusyBox through 1.37.0, a TAR archive can have filenames hid ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-46394" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-107891", "package": "musl", "installed_version": "1.2.5-r10", "fixed_version": "1.2.5-r13", "title": "Title Not Available", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-107891" }, { "target": "docker.rtb-bl.de/pdm/hub/pdm/rao:1.7.1 (alpine 3.22.2)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-107891", "package": "musl-utils", "installed_version": "1.2.5-r10", "fixed_version": "1.2.5-r13", "title": "Title Not Available", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-107891" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/pdm/sale-register:3.0.0", "vulnerability_count": 11, "highest_severity": "CRITICAL", "findings": [ { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "11.0.24", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "11.0.24", "fixed_version": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "11.0.24", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed_version": "11.0.24", "fixed_version": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89407", "package": "tools.jackson.core:jackson-core", "installed_version": "3.1.5", "fixed_version": "3.1.7, 3.2.2", "title": "com.fasterxml.jackson/jackson-core: tools.jackson.core/jackson-core: Jackson-core: Denial of Service via regular expression backtracking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89407" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-89425", "package": "tools.jackson.core:jackson-core", "installed_version": "3.1.5", "fixed_version": "3.1.7, 3.2.3", "title": "com.fasterxml.jackson.core/jackson-core: Jackson-core: Denial of Service via unbounded StringBuilder growth during malformed token processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-89425" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-68497", "package": "tools.jackson.core:jackson-databind", "installed_version": "3.1.5", "fixed_version": "3.2.2, 3.1.6", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: CPU Denial of Service via unbounded numeric parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-68497" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91776", "package": "tools.jackson.core:jackson-databind", "installed_version": "3.1.5", "fixed_version": "3.1.7, 3.2.3", "title": "jackson-databind: com.fasterxml.jackson/jackson-core: jackson-databind: Denial of Service via unbounded cache growth in TypeDeserializerBase", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91776" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "HIGH", "vulnerability_id": "CVE-2026-91777", "package": "tools.jackson.core:jackson-databind", "installed_version": "3.1.5", "fixed_version": "3.1.7, 3.2.3", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core:jackson-databind: Jackson-databind: Denial of Service via quadratic forward-reference completion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-91777" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-19032", "package": "tools.jackson.core:jackson-databind", "installed_version": "3.1.5", "fixed_version": "3.1.6, 3.2.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: Jackson-databind: Uncontrolled URI scheme resolution in Path deserialization", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-19032" }, { "target": "Java", "source_class": "lang-pkgs", "source_type": "jar", "source_group": "java", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-83557", "package": "tools.jackson.core:jackson-databind", "installed_version": "3.1.5", "fixed_version": "3.1.6, 3.2.2", "title": "com.fasterxml.jackson.core/jackson-databind: tools.jackson.core/jackson-databind: jackson-databind: Path traversal via incomplete type validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-83557" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/portainer/agent:2.45.0", "vulnerability_count": 96, "highest_severity": "HIGH", "findings": [ { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-95837", "package": "github.com/containerd/containerd/v2", "installed_version": "v2.2.5", "fixed_version": "2.2.7, 2.3.4", "title": "github.com/containerd/containerd: containerd: Privilege escalation via crafted container checkpoint restore", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95837" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2025-15558", "package": "github.com/docker/cli", "installed_version": "v28.5.1+incompatible", "fixed_version": "29.2.0", "title": "docker/cli: Docker CLI for Windows: Privilege escalation via malicious plugin binaries", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-15558" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-41567", "package": "github.com/docker/docker", "installed_version": "v28.5.2+incompatible", "fixed_version": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41567" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-41567", "package": "github.com/docker/docker", "installed_version": "v28.5.2+incompatible", "fixed_version": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41567" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-42306", "package": "github.com/docker/docker", "installed_version": "v28.5.2+incompatible", "fixed_version": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42306" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-42306", "package": "github.com/docker/docker", "installed_version": "v28.5.2+incompatible", "fixed_version": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42306" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-33747", "package": "github.com/moby/buildkit", "installed_version": "v0.25.1", "fixed_version": "0.28.1", "title": "BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33747" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-33748", "package": "github.com/moby/buildkit", "installed_version": "v0.25.1", "fixed_version": "0.28.1", "title": "github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33748" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-17106", "package": "github.com/moby/go-archive", "installed_version": "v0.1.0", "fixed_version": "0.3.0", "title": "github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-17106" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56854", "package": "golang.org/x/crypto", "installed_version": "v0.54.0", "fixed_version": "0.55.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56854" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56864", "package": "golang.org/x/mod", "installed_version": "v0.37.0", "fixed_version": "0.40.0", "title": "golang.org/x/mod/sumdb: golang.org/x/mod/sumdb: Integrity bypass via malicious GOSUMDB", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56864" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56864", "package": "golang.org/x/mod", "installed_version": "v0.37.0", "fixed_version": "0.40.0", "title": "golang.org/x/mod/sumdb: golang.org/x/mod/sumdb: Integrity bypass via malicious GOSUMDB", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56864" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56865", "package": "golang.org/x/mod", "installed_version": "v0.37.0", "fixed_version": "0.40.0", "title": "golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56865" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56865", "package": "golang.org/x/mod", "installed_version": "v0.37.0", "fixed_version": "0.40.0", "title": "golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56865" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78669", "package": "golang.org/x/net", "installed_version": "v0.56.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78669" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78669", "package": "golang.org/x/net", "installed_version": "v0.56.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78669" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56851", "package": "golang.org/x/text", "installed_version": "v0.40.0", "fixed_version": "0.41.0", "title": "golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56851" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56851", "package": "golang.org/x/text", "installed_version": "v0.40.0", "fixed_version": "0.41.0", "title": "golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56851" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-84304", "package": "google.golang.org/grpc", "installed_version": "v1.82.1", "fixed_version": "1.83.1", "title": "google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84304" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-84445", "package": "google.golang.org/grpc", "installed_version": "v1.82.1", "fixed_version": "1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e", "title": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84445" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-111943", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.10, 1.27.3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-111943" }, { "target": "app/docker-credential-portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-111943", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.10, 1.27.3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-111943" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-111943", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.10, 1.27.3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-111943" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78667", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78667" }, { "target": "app/docker-credential-portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78667", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78667" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78667", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78667" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78669", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78669" }, { "target": "app/docker-credential-portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78669", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78669" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78669", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78669" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-97031", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97031" }, { "target": "app/docker-credential-portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-97031", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97031" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-97031", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97031" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53493", "package": "github.com/containerd/containerd", "installed_version": "v1.7.33", "fixed_version": "1.7.36", "title": "github.com/containerd/containerd: containerd: Denial of Service via crafted OCI image index", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53493" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53495", "package": "github.com/containerd/containerd", "installed_version": "v1.7.33", "fixed_version": "1.7.35", "title": "github.com/containerd/containerd: containerd: Denial of Service via CRI ExecSync goroutine leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53495" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95838", "package": "github.com/containerd/containerd", "installed_version": "v1.7.33", "fixed_version": "1.7.35", "title": "github.com/containerd/containerd: containerd: Denial of Service via repeated directory traversals during layer unpacking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95838" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53493", "package": "github.com/containerd/containerd/v2", "installed_version": "v2.2.5", "fixed_version": "2.0.13, 2.2.9, 2.3.6, 2.4.1", "title": "github.com/containerd/containerd: containerd: Denial of Service via crafted OCI image index", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53493" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53495", "package": "github.com/containerd/containerd/v2", "installed_version": "v2.2.5", "fixed_version": "2.0.12, 2.2.8, 2.3.5", "title": "github.com/containerd/containerd: containerd: Denial of Service via CRI ExecSync goroutine leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53495" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95838", "package": "github.com/containerd/containerd/v2", "installed_version": "v2.2.5", "fixed_version": "2.0.12, 2.2.8, 2.3.5", "title": "github.com/containerd/containerd: containerd: Denial of Service via repeated directory traversals during layer unpacking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95838" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-85747", "package": "github.com/docker/distribution", "installed_version": "v2.8.3+incompatible", "fixed_version": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-85747" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-33997", "package": "github.com/docker/docker", "installed_version": "v28.5.2+incompatible", "fixed_version": "29.3.1", "title": "moby: docker: github.com/moby/moby: Moby: Privilege validation bypass during plugin installation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33997" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-33997", "package": "github.com/docker/docker", "installed_version": "v28.5.2+incompatible", "fixed_version": "29.3.1", "title": "moby: docker: github.com/moby/moby: Moby: Privilege validation bypass during plugin installation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33997" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41568", "package": "github.com/docker/docker", "installed_version": "v28.5.2+incompatible", "fixed_version": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41568" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41568", "package": "github.com/docker/docker", "installed_version": "v28.5.2+incompatible", "fixed_version": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41568" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-61711", "package": "github.com/moby/buildkit", "installed_version": "v0.25.1", "fixed_version": "0.31.1", "title": "github.com/moby/buildkit: BuildKit: Security bypass allows disabling container protections", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-61711" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-61801", "package": "github.com/moby/sys/user", "installed_version": "v0.4.0", "fixed_version": "0.4.1", "title": "github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-61801" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56855", "package": "golang.org/x/crypto", "installed_version": "v0.54.0", "fixed_version": "0.56.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56855" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78662", "package": "golang.org/x/crypto", "installed_version": "v0.54.0", "fixed_version": "0.56.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via channel request flooding", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78662" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78659", "package": "golang.org/x/net", "installed_version": "v0.56.0", "fixed_version": "0.60.0", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78659" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78659", "package": "golang.org/x/net", "installed_version": "v0.56.0", "fixed_version": "0.60.0", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78659" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78660", "package": "golang.org/x/net", "installed_version": "v0.56.0", "fixed_version": "0.60.0", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78660" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78660", "package": "golang.org/x/net", "installed_version": "v0.56.0", "fixed_version": "0.60.0", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78660" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78663", "package": "golang.org/x/net", "installed_version": "v0.56.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78663" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78663", "package": "golang.org/x/net", "installed_version": "v0.56.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78663" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97032", "package": "golang.org/x/net", "installed_version": "v0.56.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97032" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97032", "package": "golang.org/x/net", "installed_version": "v0.56.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97032" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84303", "package": "google.golang.org/grpc", "installed_version": "v1.82.1", "fixed_version": "1.83.1", "title": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, th ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84303" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56866", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56866" }, { "target": "app/docker-credential-portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56866", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56866" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56866", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56866" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78659", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78659" }, { "target": "app/docker-credential-portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78659", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78659" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78659", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78659" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78660", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78660" }, { "target": "app/docker-credential-portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78660", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78660" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78660", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78660" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78663", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78663" }, { "target": "app/docker-credential-portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78663", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78663" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78663", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78663" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94439", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94439" }, { "target": "app/docker-credential-portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94439", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94439" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94439", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94439" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94440", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94440" }, { "target": "app/docker-credential-portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94440", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94440" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94440", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94440" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94448", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94448" }, { "target": "app/docker-credential-portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94448", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94448" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94448", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94448" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97030", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97030" }, { "target": "app/docker-credential-portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97030", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97030" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97030", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97030" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97032", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97032" }, { "target": "app/docker-credential-portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97032", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97032" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97032", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97032" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-61712", "package": "github.com/moby/buildkit", "installed_version": "v0.25.1", "fixed_version": "0.31.1", "title": "github.com/moby/buildkit: BuildKit: Denial of Service via unbounded group parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-61712" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/exporters/otlp/otlptrace", "installed_version": "v1.43.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc", "installed_version": "v1.43.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp", "installed_version": "v1.43.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/sdk", "installed_version": "v1.43.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-56857", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "os: golang: golang: Directory traversal via Windows junction handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56857" }, { "target": "app/docker-credential-portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-56857", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "os: golang: golang: Directory traversal via Windows junction handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56857" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-56857", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "os: golang: golang: Directory traversal via Windows junction handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56857" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "GO-2026-5932", "package": "golang.org/x/crypto", "installed_version": "v0.54.0", "fixed_version": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "primary_url": null }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-78661", "package": "golang.org/x/net", "installed_version": "v0.56.0", "fixed_version": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78661" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-78661", "package": "golang.org/x/net", "installed_version": "v0.56.0", "fixed_version": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78661" }, { "target": "app/agent", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-97045", "package": "golang.org/x/net", "installed_version": "v0.56.0", "fixed_version": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97045" }, { "target": "app/healthy", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-97045", "package": "golang.org/x/net", "installed_version": "v0.56.0", "fixed_version": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97045" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/portainer/portainer-ce:2.45.0", "vulnerability_count": 54, "highest_severity": "HIGH", "findings": [ { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-95837", "package": "github.com/containerd/containerd/v2", "installed_version": "v2.2.5", "fixed_version": "2.2.7, 2.3.4", "title": "github.com/containerd/containerd: containerd: Privilege escalation via crafted container checkpoint restore", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95837" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2025-15558", "package": "github.com/docker/cli", "installed_version": "v28.5.1+incompatible", "fixed_version": "29.2.0", "title": "docker/cli: Docker CLI for Windows: Privilege escalation via malicious plugin binaries", "primary_url": "https://avd.aquasec.com/nvd/cve-2025-15558" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-41567", "package": "github.com/docker/docker", "installed_version": "v28.5.2+incompatible", "fixed_version": null, "title": "docker: Moby/Docker Engine: Arbitrary Code Execution via malicious container image and compressed archive upload", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41567" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-42306", "package": "github.com/docker/docker", "installed_version": "v28.5.2+incompatible", "fixed_version": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby container framework: Host file overwrite via race condition in docker cp mount setup", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-42306" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-33747", "package": "github.com/moby/buildkit", "installed_version": "v0.25.1", "fixed_version": "0.28.1", "title": "BuildKit: github.com/moby/buildkit: BuildKit: Arbitrary file write and code execution via untrusted frontend", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33747" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-33748", "package": "github.com/moby/buildkit", "installed_version": "v0.25.1", "fixed_version": "0.28.1", "title": "github.com/moby/buildkit: BuildKit: Unauthorized file access via Git URL fragment subdir components", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33748" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-17106", "package": "github.com/moby/go-archive", "installed_version": "v0.1.0", "fixed_version": "0.3.0", "title": "github.com/moby/go-archive: moby/go-archive: Arbitrary file write via link following in tar extraction", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-17106" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56854", "package": "golang.org/x/crypto", "installed_version": "v0.54.0", "fixed_version": "0.55.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56854" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56864", "package": "golang.org/x/mod", "installed_version": "v0.37.0", "fixed_version": "0.40.0", "title": "golang.org/x/mod/sumdb: golang.org/x/mod/sumdb: Integrity bypass via malicious GOSUMDB", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56864" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56865", "package": "golang.org/x/mod", "installed_version": "v0.37.0", "fixed_version": "0.40.0", "title": "golang.org/x/mod/sumdb/tlog: golang.org/x/mod/sumdb/tlog: Supply chain compromise via transparency log tile verification bypass", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56865" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78669", "package": "golang.org/x/net", "installed_version": "v0.56.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78669" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56851", "package": "golang.org/x/text", "installed_version": "v0.40.0", "fixed_version": "0.41.0", "title": "golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56851" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-84304", "package": "google.golang.org/grpc", "installed_version": "v1.82.1", "fixed_version": "1.83.1", "title": "google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84304" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-84445", "package": "google.golang.org/grpc", "installed_version": "v1.82.1", "fixed_version": "1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e", "title": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84445" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-111943", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.10, 1.27.3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-111943" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78667", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78667" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78669", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78669" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-97031", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97031" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53493", "package": "github.com/containerd/containerd", "installed_version": "v1.7.33", "fixed_version": "1.7.36", "title": "github.com/containerd/containerd: containerd: Denial of Service via crafted OCI image index", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53493" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53495", "package": "github.com/containerd/containerd", "installed_version": "v1.7.33", "fixed_version": "1.7.35", "title": "github.com/containerd/containerd: containerd: Denial of Service via CRI ExecSync goroutine leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53495" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95838", "package": "github.com/containerd/containerd", "installed_version": "v1.7.33", "fixed_version": "1.7.35", "title": "github.com/containerd/containerd: containerd: Denial of Service via repeated directory traversals during layer unpacking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95838" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53493", "package": "github.com/containerd/containerd/v2", "installed_version": "v2.2.5", "fixed_version": "2.0.13, 2.2.9, 2.3.6, 2.4.1", "title": "github.com/containerd/containerd: containerd: Denial of Service via crafted OCI image index", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53493" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-53495", "package": "github.com/containerd/containerd/v2", "installed_version": "v2.2.5", "fixed_version": "2.0.12, 2.2.8, 2.3.5", "title": "github.com/containerd/containerd: containerd: Denial of Service via CRI ExecSync goroutine leak", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-53495" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-95838", "package": "github.com/containerd/containerd/v2", "installed_version": "v2.2.5", "fixed_version": "2.0.12, 2.2.8, 2.3.5", "title": "github.com/containerd/containerd: containerd: Denial of Service via repeated directory traversals during layer unpacking", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-95838" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-85747", "package": "github.com/docker/distribution", "installed_version": "v2.8.3+incompatible", "fixed_version": null, "title": "Distribution is a toolkit to pack, ship, store, and deliver container ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-85747" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-33997", "package": "github.com/docker/docker", "installed_version": "v28.5.2+incompatible", "fixed_version": "29.3.1", "title": "moby: docker: github.com/moby/moby: Moby: Privilege validation bypass during plugin installation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33997" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-41568", "package": "github.com/docker/docker", "installed_version": "v28.5.2+incompatible", "fixed_version": null, "title": "github.com/docker/docker: github.com/moby/moby: Moby: Denial of Service via race condition in docker cp mount setup", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-41568" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-61711", "package": "github.com/moby/buildkit", "installed_version": "v0.25.1", "fixed_version": "0.31.1", "title": "github.com/moby/buildkit: BuildKit: Security bypass allows disabling container protections", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-61711" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-61801", "package": "github.com/moby/sys/user", "installed_version": "v0.4.0", "fixed_version": "0.4.1", "title": "github.com/moby/sys/user: moby/sys/user: Denial of Service via crafted user or group database files", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-61801" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56855", "package": "golang.org/x/crypto", "installed_version": "v0.54.0", "fixed_version": "0.56.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56855" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78662", "package": "golang.org/x/crypto", "installed_version": "v0.54.0", "fixed_version": "0.56.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via channel request flooding", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78662" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78659", "package": "golang.org/x/net", "installed_version": "v0.56.0", "fixed_version": "0.60.0", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78659" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78660", "package": "golang.org/x/net", "installed_version": "v0.56.0", "fixed_version": "0.60.0", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78660" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78663", "package": "golang.org/x/net", "installed_version": "v0.56.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78663" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97032", "package": "golang.org/x/net", "installed_version": "v0.56.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97032" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84303", "package": "google.golang.org/grpc", "installed_version": "v1.82.1", "fixed_version": "1.83.1", "title": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, th ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84303" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56866", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56866" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78659", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78659" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78660", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78660" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78663", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78663" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94439", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94439" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94440", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94440" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94448", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94448" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97030", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97030" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97032", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97032" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-61712", "package": "github.com/moby/buildkit", "installed_version": "v0.25.1", "fixed_version": "0.31.1", "title": "github.com/moby/buildkit: BuildKit: Denial of Service via unbounded group parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-61712" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/exporters/otlp/otlptrace", "installed_version": "v1.43.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc", "installed_version": "v1.43.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp", "installed_version": "v1.43.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/sdk", "installed_version": "v1.43.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-56857", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "os: golang: golang: Directory traversal via Windows junction handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56857" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "GO-2026-5932", "package": "golang.org/x/crypto", "installed_version": "v0.54.0", "fixed_version": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "primary_url": null }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-78661", "package": "golang.org/x/net", "installed_version": "v0.56.0", "fixed_version": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78661" }, { "target": "portainer", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-97045", "package": "golang.org/x/net", "installed_version": "v0.56.0", "fixed_version": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97045" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/prom/node-exporter:v1.12.1", "vulnerability_count": 34, "highest_severity": "HIGH", "findings": [ { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56854", "package": "golang.org/x/crypto", "installed_version": "v0.54.0", "fixed_version": "0.55.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56854" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78669", "package": "golang.org/x/net", "installed_version": "v0.57.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78669" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56851", "package": "golang.org/x/text", "installed_version": "v0.40.0", "fixed_version": "0.41.0", "title": "golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56851" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-111943", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.10, 1.27.3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-111943" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-33818", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.25.13, 1.26.6, 1.27.0-rc.3", "title": "encoding/asn1: golang: Go encoding/asn1: Denial of Service via excessive recursion in Unmarshal", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-33818" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-39821", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.25.13, 1.26.6, 1.27.0-rc.3", "title": "golang.org/x/net/idna: golang: net/http: golang.org/x/net/idna: Privilege escalation via incorrect Punycode label processing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-39821" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-46600", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.6, 1.27.0-rc.3", "title": "golang.org/x/net/dns/dnsmessage: golang.org/x/net/dns/dnsmessage: Denial of Service via invalid DNS record parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-46600" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56853", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.25.13, 1.26.6, 1.27.0-rc.3", "title": "net/http: golang: Go net/http: Unencrypted HTTP/2 connections vulnerable to Denial of Service", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56853" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56858", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.25.13, 1.26.6, 1.27.0-rc.3", "title": "html/template: golang: Go html/template: Cross-Site Scripting via pathological input", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56858" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56859", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.25.13, 1.26.6, 1.27.0-rc.3", "title": "encoding/xml: golang: Go: Denial of Service via XML decoding recursion depth issue", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56859" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56860", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.25.13, 1.26.6, 1.27.0-rc.3", "title": "net/url: golang: golang net/url: Denial of Service from quadratic complexity in path resolution", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56860" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56862", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.25.13, 1.26.6, 1.27.0-rc.3", "title": "crypto/tls: golang: Golang crypto/tls: Denial of Service via indefinite KeyUpdate messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56862" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78667", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78667" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78669", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78669" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-97031", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97031" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56855", "package": "golang.org/x/crypto", "installed_version": "v0.54.0", "fixed_version": "0.56.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56855" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78662", "package": "golang.org/x/crypto", "installed_version": "v0.54.0", "fixed_version": "0.56.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via channel request flooding", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78662" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78659", "package": "golang.org/x/net", "installed_version": "v0.57.0", "fixed_version": "0.60.0", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78659" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78660", "package": "golang.org/x/net", "installed_version": "v0.57.0", "fixed_version": "0.60.0", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78660" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78663", "package": "golang.org/x/net", "installed_version": "v0.57.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78663" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97032", "package": "golang.org/x/net", "installed_version": "v0.57.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97032" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56866", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56866" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78659", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78659" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78660", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78660" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78663", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78663" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94439", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94439" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94440", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94440" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94448", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94448" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97030", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97030" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97032", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97032" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-56857", "package": "stdlib", "installed_version": "v1.26.5", "fixed_version": "1.26.9, 1.27.2", "title": "os: golang: golang: Directory traversal via Windows junction handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56857" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "GO-2026-5932", "package": "golang.org/x/crypto", "installed_version": "v0.54.0", "fixed_version": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "primary_url": null }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-78661", "package": "golang.org/x/net", "installed_version": "v0.57.0", "fixed_version": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78661" }, { "target": "bin/node_exporter", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-97045", "package": "golang.org/x/net", "installed_version": "v0.57.0", "fixed_version": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97045" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/prom/prometheus:v3.14.0", "vulnerability_count": 62, "highest_severity": "HIGH", "findings": [ { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56854", "package": "golang.org/x/crypto", "installed_version": "v0.54.0", "fixed_version": "0.55.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56854" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56854", "package": "golang.org/x/crypto", "installed_version": "v0.54.0", "fixed_version": "0.55.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Authentication bypass due to unenforced source-address restrictions", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56854" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78669", "package": "golang.org/x/net", "installed_version": "v0.57.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78669" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78669", "package": "golang.org/x/net", "installed_version": "v0.57.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78669" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56851", "package": "golang.org/x/text", "installed_version": "v0.40.0", "fixed_version": "0.41.0", "title": "golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56851" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-56851", "package": "golang.org/x/text", "installed_version": "v0.40.0", "fixed_version": "0.41.0", "title": "golang.org/x/text: golang.org/x/text: Denial of Service via out-of-bounds slice error in Nickname profile", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56851" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-84304", "package": "google.golang.org/grpc", "installed_version": "v1.82.1", "fixed_version": "1.83.1", "title": "google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84304" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-84304", "package": "google.golang.org/grpc", "installed_version": "v1.82.1", "fixed_version": "1.83.1", "title": "google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84304" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-84445", "package": "google.golang.org/grpc", "installed_version": "v1.82.1", "fixed_version": "1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e", "title": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84445" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-84445", "package": "google.golang.org/grpc", "installed_version": "v1.82.1", "fixed_version": "1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e", "title": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84445" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-111943", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.10, 1.27.3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-111943" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-111943", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.10, 1.27.3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-111943" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78667", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78667" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78667", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78667" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78669", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78669" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78669", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78669" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-97031", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97031" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-97031", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97031" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56855", "package": "golang.org/x/crypto", "installed_version": "v0.54.0", "fixed_version": "0.56.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56855" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56855", "package": "golang.org/x/crypto", "installed_version": "v0.54.0", "fixed_version": "0.56.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56855" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78662", "package": "golang.org/x/crypto", "installed_version": "v0.54.0", "fixed_version": "0.56.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via channel request flooding", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78662" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78662", "package": "golang.org/x/crypto", "installed_version": "v0.54.0", "fixed_version": "0.56.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via channel request flooding", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78662" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78659", "package": "golang.org/x/net", "installed_version": "v0.57.0", "fixed_version": "0.60.0", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78659" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78659", "package": "golang.org/x/net", "installed_version": "v0.57.0", "fixed_version": "0.60.0", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78659" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78660", "package": "golang.org/x/net", "installed_version": "v0.57.0", "fixed_version": "0.60.0", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78660" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78660", "package": "golang.org/x/net", "installed_version": "v0.57.0", "fixed_version": "0.60.0", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78660" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78663", "package": "golang.org/x/net", "installed_version": "v0.57.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78663" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78663", "package": "golang.org/x/net", "installed_version": "v0.57.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78663" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97032", "package": "golang.org/x/net", "installed_version": "v0.57.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97032" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97032", "package": "golang.org/x/net", "installed_version": "v0.57.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97032" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84303", "package": "google.golang.org/grpc", "installed_version": "v1.82.1", "fixed_version": "1.83.1", "title": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, th ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84303" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84303", "package": "google.golang.org/grpc", "installed_version": "v1.82.1", "fixed_version": "1.83.1", "title": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, th ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84303" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56866", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56866" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56866", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56866" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78659", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78659" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78659", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78659" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78660", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78660" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78660", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78660" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78663", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78663" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78663", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78663" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94439", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94439" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94439", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94439" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94440", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94440" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94440", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94440" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94448", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94448" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94448", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94448" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97030", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97030" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97030", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97030" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97032", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97032" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97032", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97032" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/exporters/otlp/otlptrace", "installed_version": "v1.44.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc", "installed_version": "v1.44.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp", "installed_version": "v1.44.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/sdk", "installed_version": "v1.44.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-56857", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "os: golang: golang: Directory traversal via Windows junction handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56857" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-56857", "package": "stdlib", "installed_version": "v1.26.6", "fixed_version": "1.26.9, 1.27.2", "title": "os: golang: golang: Directory traversal via Windows junction handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56857" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "GO-2026-5932", "package": "golang.org/x/crypto", "installed_version": "v0.54.0", "fixed_version": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "primary_url": null }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "GO-2026-5932", "package": "golang.org/x/crypto", "installed_version": "v0.54.0", "fixed_version": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "primary_url": null }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-78661", "package": "golang.org/x/net", "installed_version": "v0.57.0", "fixed_version": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78661" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-78661", "package": "golang.org/x/net", "installed_version": "v0.57.0", "fixed_version": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78661" }, { "target": "bin/prometheus", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-97045", "package": "golang.org/x/net", "installed_version": "v0.57.0", "fixed_version": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97045" }, { "target": "bin/promtool", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-97045", "package": "golang.org/x/net", "installed_version": "v0.57.0", "fixed_version": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97045" } ] }, { "image": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12", "vulnerability_count": 64, "highest_severity": "CRITICAL", "findings": [ { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "CRITICAL", "vulnerability_id": "CVE-2026-88007", "package": "github.com/traefik/traefik/v3", "installed_version": "v3.7.12", "fixed_version": "3.7.13", "title": "github.com/traefik/traefik: Traefik HTTP/3 Backend NTLM Connection Reuse", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-88007" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-116587", "package": "github.com/go-jose/go-jose/v4", "installed_version": "v4.1.4", "fixed_version": "4.1.6", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via crafted RSA parameters in JWKs", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-116587" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-88004", "package": "github.com/traefik/traefik/v3", "installed_version": "v3.7.12", "fixed_version": "3.7.13", "title": "github.com/traefik/traefik: Traefik: Security bypass and identity spoofing via unsanitized request trailers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-88004" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-88008", "package": "github.com/traefik/traefik/v3", "installed_version": "v3.7.12", "fixed_version": "3.7.13", "title": "github.com/traefik/traefik: Traefik: Incorrect authorization due to HTTP/2 protocol confusion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-88008" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-88009", "package": "github.com/traefik/traefik/v3", "installed_version": "v3.7.12", "fixed_version": "3.7.13", "title": "github.com/traefik/traefik: Traefik: Authorization bypass and access-log evasion via crafted HTTP/1 request", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-88009" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78669", "package": "golang.org/x/net", "installed_version": "v0.58.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78669" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-84304", "package": "google.golang.org/grpc", "installed_version": "v1.82.1", "fixed_version": "1.83.1", "title": "google.golang.org/grpc: gRPC-Go: Denial of Service via HTTP/2 DATA Frame Fragmentation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84304" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-84445", "package": "google.golang.org/grpc", "installed_version": "v1.82.1", "fixed_version": "1.82.2, 1.83.2, 1.84.0-dev.0.20260825144003-d5a41119e0e3, 1.85.0-dev.0.20260825072537-93e31b48545e", "title": "google.golang.org/grpc: gRPC-Go: Denial of Service via malformed RPC requests", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84445" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "HIGH", "vulnerability_id": "CVE-2026-14456", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: OpenSSL: Denial of Service via unbounded memory growth in QUIC server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14456" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-111943", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.10, 1.27.3", "title": "crypto/x509: golang: crypto/x509: Man-in-the-middle attacks via untrusted intermediate certificates", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-111943" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78667", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Denial of Service via crafted HTTP Range headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78667" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-78669", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang.org/x/net/http2: net/http: Denial of Service via excessive HTTP/2 SETTINGS frames", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78669" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "HIGH", "vulnerability_id": "CVE-2026-97031", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "crypto/tls: golang: crypto/tls: Denial of Service via multiple ECH outer extension references", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97031" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-116585", "package": "github.com/go-jose/go-jose/v4", "installed_version": "v4.1.4", "fixed_version": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via empty ciphertext buffer during JWE decryption", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-116585" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-116586", "package": "github.com/go-jose/go-jose/v4", "installed_version": "v4.1.4", "fixed_version": "4.1.5", "title": "github.com/go-jose/go-jose: go-jose: Denial of Service via deeply nested JSON parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-116586" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-81871", "package": "go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc", "installed_version": "v0.20.0", "fixed_version": "0.21.0", "title": "go.opentelemetry.io/otel/exporters/otlp/otlplog/otlploggrpc: OpenTelemetry-Go: TLS certificate bypass allows log telemetry interception and alteration", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81871" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-81872", "package": "go.opentelemetry.io/otel/sdk/log", "installed_version": "v0.20.0", "fixed_version": "0.21.0", "title": "go.opentelemetry.io/otel/sdk/log: OpenTelemetry-Go: Denial of Service via attacker-driven log emission", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81872" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56855", "package": "golang.org/x/crypto", "installed_version": "v0.55.0", "fixed_version": "0.56.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via crafted messages", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56855" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78662", "package": "golang.org/x/crypto", "installed_version": "v0.55.0", "fixed_version": "0.56.0", "title": "golang.org/x/crypto/ssh: golang.org/x/crypto/ssh: Denial of Service via channel request flooding", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78662" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78659", "package": "golang.org/x/net", "installed_version": "v0.58.0", "fixed_version": "0.60.0", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78659" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78660", "package": "golang.org/x/net", "installed_version": "v0.58.0", "fixed_version": "0.60.0", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78660" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78663", "package": "golang.org/x/net", "installed_version": "v0.58.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78663" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97032", "package": "golang.org/x/net", "installed_version": "v0.58.0", "fixed_version": "0.60.0", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97032" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-84303", "package": "google.golang.org/grpc", "installed_version": "v1.82.1", "fixed_version": "1.83.1", "title": "gRPC-Go is the Go language implementation of gRPC. Prior to 1.83.1, th ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-84303" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "GHSA-2hw4-c9m4-f2fj", "package": "knative.dev/pkg", "installed_version": "v0.0.0-20251216153728-9c8140b780d1", "fixed_version": "0.0.0-20260531000007-52dbd5ece63f", "title": "knative.dev/pkg admission webhooks allow unbounded request-body memory exhaustion", "primary_url": "https://github.com/advisories/GHSA-2hw4-c9m4-f2fj" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-18798", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC server may trigger double free when processing INITIAL packet", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-18798" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63072", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: heap buffer overflow in CMS key unwrapping", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63072" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-63076", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: invalid pointer dereference in CMP server via crafted protectionAlg", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63076" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-56866", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang: Cross-user response poisoning via desynchronized HTTP CONNECT connections", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56866" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78659", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang.org/x/net/http2: golang: net/http: Denial of Service via HTTP/2 trailer header memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78659" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78660", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: golang.org/x/net/http2: net/http: HTTP response smuggling via malformed HTTP/2 framing headers", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78660" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-78663", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: golang: flow control limit bypass via double refund in HTTP/2 server", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78663" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94439", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: golang: net/http: HTTP request smuggling via improper handling of HTTP/1 CONNECT responses", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94439" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94440", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "net/textproto: mime/multipart: golang: golang: Denial of Service via memory limit bypass in multipart form parsing", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94440" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-94448", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "html/template: golang: golang: cross-site scripting via consecutive expressions in JavaScript template literals", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-94448" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97030", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "html/template: golang: html/template: Cross-site scripting via improper escaping of yield keyword", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97030" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-97032", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "net/http: net/http/internal/http2: golang: golang.org/x/net/http2: net/http: Denial of Service via concurrent HPACK encoder modification", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97032" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "MEDIUM", "vulnerability_id": "CVE-2026-85091", "package": "zlib", "installed_version": "1.3.2-r0", "fixed_version": "1.3.2-r1", "title": "zlib versions 1.3.1.2 through 1.3.2 contain a heap buffer overflow vul ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-85091" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/exporters/otlp/otlptrace", "installed_version": "v1.44.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracegrpc", "installed_version": "v1.44.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/exporters/otlp/otlptrace/otlptracehttp", "installed_version": "v1.44.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-81870", "package": "go.opentelemetry.io/otel/sdk", "installed_version": "v1.44.0", "fixed_version": "1.45.0", "title": "github.com/open-telemetry/opentelemetry-go: OpenTelemetry-Go: Information disclosure via exporter configuration logging", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-81870" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "libcrypto3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-14457", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: RPK server signature algorithm selection can dereference a missing certificate", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-14457" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-54874", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: excessive memory use buffering DTLS records for a future epoch", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-54874" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63073", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: untrusted sender DN used as format string in CMP response validation", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63073" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63074", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: CMP indefinite cache growth of ExtraCerts", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63074" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-63075", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: QUIC ACK-only packet retention can cause memory exhaustion", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-63075" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "LOW", "vulnerability_id": "CVE-2026-75803", "package": "libssl3", "installed_version": "3.5.7-r0", "fixed_version": "3.5.8-r0", "title": "openssl: openssl: AEAD forgeries possible with empty ciphertext in EVP_Cipher()", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-75803" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "LOW", "vulnerability_id": "CVE-2026-56857", "package": "stdlib", "installed_version": "v1.26.7", "fixed_version": "1.26.9, 1.27.2", "title": "os: golang: golang: Directory traversal via Windows junction handling", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-56857" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "GO-2026-5932", "package": "golang.org/x/crypto", "installed_version": "v0.55.0", "fixed_version": null, "title": "The golang.org/x/crypto/openpgp package is unmaintained, unsafe by design, and has known security issues", "primary_url": null }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-78661", "package": "golang.org/x/net", "installed_version": "v0.58.0", "fixed_version": "0.62.0", "title": "When coalescing adjacent text nodes in addText and fosterParent, appen ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-78661" }, { "target": "usr/local/bin/traefik", "source_class": "lang-pkgs", "source_type": "gobinary", "source_group": "other", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-97045", "package": "golang.org/x/net", "installed_version": "v0.58.0", "fixed_version": "0.62.0", "title": "In childTextNodesAreLiteral, walking up the tree previously stopped at ...", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-97045" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-107891", "package": "musl", "installed_version": "1.2.6-r2", "fixed_version": "1.2.6-r3", "title": "Title Not Available", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-107891" }, { "target": "docker.rtb-bl.de/pdm/hub/traefik:v3.7.12 (alpine 3.24.1)", "source_class": "os-pkgs", "source_type": "alpine", "source_group": "linux", "severity": "UNKNOWN", "vulnerability_id": "CVE-2026-107891", "package": "musl-utils", "installed_version": "1.2.6-r2", "fixed_version": "1.2.6-r3", "title": "Title Not Available", "primary_url": "https://avd.aquasec.com/nvd/cve-2026-107891" } ] } ] }