DeutschIn der Originalsprache angezeigt — eine vollständige Übersetzung ist für eine zukünftige Version geplant.
RealObjects PDFreactor: Mehrere Schwachstellen ermöglichen nicht spezifizierten Angriff
Advisory ansehen veröffentlicht 2026-08-16
Ein Angreifer kann mehrere Schwachstellen in RealObjects PDFreactor ausnutzen, um einen nicht näher spezifizierten Angriff durchzuführen.
01
beschreibt (35)
Zugehörige CVEs.
| ID | Schweregrad | ausnutzbar | ||
|---|---|---|---|---|
| CVE-2026-68497US | — | — | ||
jackson-databind binds a JSON string to a javax.xml.datatype.Duration or javax.xml.datatype.XMLGregorianCalendar field by passing the raw string verbatim to DatatypeFactory.newDura… | ||||
| CVE-2026-19032US | — | — | ||
jackson-databind's deserializer for java.nio.file.Path resolves an attacker-supplied URI without restricting the URI scheme. In JDKFromStringDeserializer.NioPathHelper.deserialize,… | ||||
| CVE-2026-65432US | — | — | ||
Apache CXF reads a top-level WSDL through its hardened StaxUtils path, which disables XML DTDs and external entities. However, any <wsdl:import> or <xsd:import> referenced from tha… | ||||
| CVE-2026-64958US | — | — | ||
An incomplete fix for CVE-2026-50645 means that it is still possible to perform a denial of service attack on Apache CXF by sending a message with many attachment headers. Users ar… | ||||
| CVE-2026-57819US | — | — | ||
Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. However, no default limit is set which m… | ||||
| CVE-2026-54225US | — | — | ||
Apache CXF allows to control the maximum attachment size via the "attachment-max-size". Prior to Apache CXF 4.2.3 and 4.1.8 and 3.6.12, there was no default placed on this size, me… | ||||
| CVE-2026-10050US | critical9.1 | — | ||
In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.
This was done because the initial specification for HTTP did n… | ||||
| CVE-2026-64607US | — | — | ||
HttpClient based on the classic i/o model fails to correctly release the underlying connection back to the connection manager if it encounters an invalid or unsupported `Content-En… | ||||
| CVE-2026-54082US | — | — | ||
veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity vulnerabili… | ||||
| CVE-2026-54081US | — | — | ||
veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/p… | ||||
| CVE-2026-54080US | — | — | ||
veraPDF PDF parser is a PDF parser for veraPDF. Prior to 1.30.2 and 1.31.23, veraPDF-parser contains a denial-of-service vulnerability in veraPDF-parser/src/main/java/org/verapdf/p… | ||||
| CVE-2026-54079US | — | — | ||
veraPDF validation provides PDF/A and PDF/UA validation, feature reporting, and metadata repair. From 1.17.35 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External… | ||||
| CVE-2026-54078US | — | — | ||
veraPDF validation model is an implementation of the veraPDF validation model. From 1.25.73 until 1.30.2 and 1.31.71, veraPDF-validation contains an XML External Entity (XXE) vulne… | ||||
| CVE-2026-60147US | — | — | ||
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Security). Supported versions that are affecte… | ||||
| CVE-2026-47063US | — | — | ||
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: Libraries). Supported versions that are affect… | ||||
| CVE-2026-47059US | — | — | ||
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are… | ||||
| CVE-2026-47027US | — | — | ||
Vulnerability in Oracle Java SE (component: Libraries). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Orac… | ||||
| CVE-2026-47021US | — | — | ||
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: 2D). Supported versions that are affected are… | ||||
| CVE-2026-47010US | — | — | ||
Vulnerability in the Oracle Java SE, Oracle GraalVM for JDK, Oracle GraalVM Enterprise Edition product of Oracle Java SE (component: ImageIO). Supported versions that are affected… | ||||
| CVE-2026-46968US | — | — | ||
Vulnerability in Oracle Java SE (component: JSSE). Supported versions that are affected are Oracle Java SE: 8u491, 8u491-perf, 11.0.31, 17.0.19, 21.0.11, 25.0.3, 26.0.1; Oracle Gr… | ||||
20 von 35 angezeigt
02
Referenzen
Externe Belege — Patches, Meldungen, Analysen.
- Red Hat Security Advisory RHSA-2026:71675 vom 2026-09-24external
- Red Hat Security Advisory RHSA-2026:77648 vom 2026-10-09external
- Red Hat Security Advisory RHSA-2026:83082 vom 2026-10-15external
- Red Hat Security Advisory RHSA-2026:83520 vom 2026-10-15external
- Red Hat Security Advisory RHSA-2026:83670 vom 2026-10-16external
- Red Hat Security Advisory RHSA-2026:88150 vom 2026-10-22external
- Red Hat Security Advisory RHSA-2026:89924 vom 2026-10-26external
- WID-SEC-W-2026-2867 - CSAF Versionself
scry
Advisories wie diese benennen die exponierten Produkte, die Angreifer auf Ihrer Angriffsfläche ins Visier nehmen. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.
Kostenloser Scan