111/111 images scanned. CRITICAL 879 (fixable 841), HIGH 8426 (fixable 7712).
| Component | Image | CRITICAL | HIGH | Fixable | CRITICAL CVEs (installed → fixed) |
|---|---|---|---|---|---|
| a1policymanagement | artifactory.devops.telekom.de/onap-repo/onap/ccsdk-oran-a1policymanagementservice:2.2.0 | 11 | 73 | 84 | CVE-2026-31789 libcrypto3 3.5.4-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 libssl3 3.5.4-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 10.1.46 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 10.1.46 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 10.1.46 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass CVE-2026-47890 org.springframework:spring-webflux 6.2.11 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-47892 org.springframework:spring-webflux 6.2.11 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.46 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.46 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.46 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass CVE-2026-75595 io.netty:netty-handler 4.1.127.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| aai | artifactory.devops.telekom.de/hub.docker.com/curlimages/curl:8.14.1 | 2 | 25 | 27 | CVE-2026-31789 libcrypto3 3.5.0-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 libssl3 3.5.0-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing |
| aai | artifactory.devops.telekom.de/onap-repo/onap/aai-graphadmin:1.18.0 | 7 | 53 | 60 | CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.56 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.56 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.56 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.56 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass CVE-2026-75595 io.netty:netty-handler 4.1.136.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| aai | artifactory.devops.telekom.de/onap-repo/onap/aai-haproxy:1.15.2 | 3 | 28 | 31 | CVE-2026-31789 libcrypto3 3.3.2-r1 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 libssl3 3.3.2-r1 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 openssl 3.3.2-r1 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing |
| aai | artifactory.devops.telekom.de/onap-repo/onap/aai-resources:1.18.0 | 8 | 34 | 42 | CVE-2026-33701 io.opentelemetry.javaagent:opentelemetry-javaagent 2.24.0 → 2.26.1 io.opentelemetry.javaagent/opentelemetry-javaagent: OpenTelemetry Java Instrumentation: Remote code execution via deserialization vulnerability in RMI CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.56 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.56 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.56 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.56 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass CVE-2026-75595 io.netty:netty-handler 4.1.136.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| aai | artifactory.devops.telekom.de/onap-repo/onap/aai-schema-service:1.14.0 | 14 | 116 | 130 | CVE-2025-24813 org.apache.tomcat.embed:tomcat-embed-core 10.1.24 → 11.0.3, 10.1.35, 9.0.99 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT CVE-2026-31789 libcrypto3 3.5.5-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 libssl3 3.5.5-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 openssl 3.5.5-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-33845 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 10.1.24 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-42010 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: gnutls: Authentication Bypass via NUL Character in Username CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 10.1.24 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 10.1.24 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass CVE-2026-47884 org.springframework:spring-webmvc 6.0.21 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass CVE-2026-75595 io.netty:netty-handler 4.1.110.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| aai | artifactory.devops.telekom.de/onap-repo/onap/aai-traversal:1.18.0 | 7 | 53 | 60 | CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.56 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.56 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.56 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.56 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass CVE-2026-75595 io.netty:netty-handler 4.1.136.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| aai | artifactory.devops.telekom.de/onap-repo/onap/babel:1.14.0 | 6 | 80 | 86 | CVE-2026-31789 libcrypto3 3.5.4-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 libssl3 3.5.4-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 openssl 3.5.4-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-33845 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment CVE-2026-42010 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: gnutls: Authentication Bypass via NUL Character in Username CVE-2026-47884 org.springframework:spring-webmvc 6.0.21 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView |
| aai | artifactory.devops.telekom.de/onap-repo/onap/model-loader:1.15.0 | 6 | 90 | 94 | CVE-2026-31789 libcrypto3 3.5.4-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 libssl3 3.5.4-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 openssl 3.5.4-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-33845 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment CVE-2026-42010 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: gnutls: Authentication Bypass via NUL Character in Username CVE-2026-47884 org.springframework:spring-webmvc 6.0.21 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView |
| aai | artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3 | 0 | 0 | 0 | |
| aai | artifactory.devops.telekom.de/onap-repo/onap/sparky-be:3.0.0 | 2 | 19 | 21 | CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments |
| cassandra | dockerhub.devops.telekom.de/k8ssandra/cass-management-api:4.1.8-ubi8 | 6 | 165 | 150 | CVE-2024-47561 org.apache.avro:avro 1.10.2 → 1.11.4 apache-avro: Schema parsing may trigger Remote Code Execution (RCE) CVE-2024-53990 org.asynchttpclient:async-http-client 2.12.1 → 2.12.4, 3.0.1 async-http-client: AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s CVE-2026-107282 org.asynchttpclient:async-http-client 2.12.1 → 3.0.13, 2.16.1 org.asynchttpclient/async-http-client: AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host CVE-2026-114406 ca-certificates 2024.2.69_v8.0.303-80.0.el8_10 → 2026.2.92_v9.0.319-81.3.el8_10 ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-75595 io.netty:netty-handler 4.1.124.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext CVE-2026-75595 io.netty:netty-handler 4.1.86.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| cassandra | dockerhub.devops.telekom.de/k8ssandra/k8ssandra-client:v0.5.0 | 4 | 105 | 94 | CVE-2024-41110 github.com/docker/docker v24.0.7+incompatible → 23.0.15, 26.1.5, 27.1.1, 25.0.6 moby: Authz zero length regression CVE-2025-68121 stdlib v1.22.5 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-114406 ca-certificates 2023.2.60_v7.0.306-80.0.el8_8 → 2026.2.92_v9.0.319-81.3.el8_10 ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-33186 google.golang.org/grpc v1.58.3 → 1.79.3 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation |
| cassandra | dockerhub.devops.telekom.de/k8ssandra/system-logger:v1.22.4 | 0 | 4 | 4 | |
| cds | artifactory.devops.telekom.de/hub.docker.com/busybox:1.37.0 | 0 | 0 | 0 | |
| cds | artifactory.devops.telekom.de/hub.docker.com/postgres:17.11 | 2 | 86 | 26 | CVE-2025-68121 stdlib v1.24.6 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-6653 libxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3 → no fix libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free |
| cds | artifactory.devops.telekom.de/onap-repo/onap/ccsdk-blueprintsprocessor:1.11.0 | 3 | 43 | 44 | CVE-2026-107726 com.hazelcast:hazelcast 5.4.0 → 5.7.0 com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client CVE-2026-47890 org.springframework:spring-webflux 6.2.11 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-47892 org.springframework:spring-webflux 6.2.11 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints |
| cds | artifactory.devops.telekom.de/onap-repo/onap/ccsdk-cds-ui-server:1.11.0 | 11 | 162 | 139 | CVE-2019-10744 lodash 3.10.1 → 4.17.12 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties CVE-2019-8457 libdb5.3 5.3.28+dfsg1-0.5 → no fix sqlite: heap out-of-bound read in function rtreenode() CVE-2021-44906 minimist 0.0.10 → 1.2.6, 0.2.4 minimist: prototype pollution CVE-2022-29078 ejs 2.7.4 → 3.1.7 ejs: server-side template injection in outputFunctionName CVE-2023-45853 zlib1g 1:1.2.11.dfsg-1+deb10u2 → no fix zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6 CVE-2024-21534 jsonpath-plus 1.1.0 → 10.2.0 jsonpath-plus: Remote Code Execution in jsonpath-plus via Improper Input Sanitization CVE-2024-57077 utils-extend 1.0.8 → no fix utils-extend Prototype Pollution CVE-2025-7783 form-data 2.3.3 → 2.5.4, 3.0.4, 4.0.4 form-data: Unsafe random function in form-data CVE-2026-41242 protobufjs 6.11.6 → 8.0.1, 7.5.5 protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields CVE-2026-59873 tar 6.1.11 → 7.5.19 tar: node-tar: Denial of Service via crafted gzip bomb CVE-2026-59873 tar 6.1.11 → 7.5.19 tar: node-tar: Denial of Service via crafted gzip bomb |
| cds | artifactory.devops.telekom.de/onap-repo/onap/ccsdk-commandexecutor:1.11.0 | 2 | 100 | 29 | CVE-2023-45853 zlib1g 1:1.2.13.dfsg-1 → no fix zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6 CVE-2025-7458 libsqlite3-0 3.40.1-2+deb12u2 → no fix sqlite: SQLite integer overflow |
| cds | artifactory.devops.telekom.de/onap-repo/onap/ccsdk-py-executor:1.11.0 | 2 | 93 | 34 | CVE-2023-45853 zlib1g 1:1.2.13.dfsg-1 → no fix zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6 CVE-2025-7458 libsqlite3-0 3.40.1-2+deb12u2 → no fix sqlite: SQLite integer overflow |
| cds | artifactory.devops.telekom.de/onap-repo/onap/ccsdk-sdclistener:1.11.0 | 3 | 35 | 36 | CVE-2026-107726 com.hazelcast:hazelcast 5.5.0 → 5.7.0 com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client CVE-2026-47890 org.springframework:spring-webflux 6.2.11 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-47892 org.springframework:spring-webflux 6.2.11 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints |
| cds | artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3 | 0 | 0 | 0 | |
| cps | artifactory.devops.telekom.de/hub.docker.com/alpine/psql:18.6 | 0 | 0 | 0 | |
| cps | artifactory.devops.telekom.de/hub.docker.com/timescale/timescaledb:2.16.1-pg14 | 11 | 210 | 220 | CVE-2023-24538 stdlib v1.18.2 → 1.19.8, 1.20.3 golang: html/template: backticks not treated as string delimiters CVE-2023-24540 stdlib v1.18.2 → 1.19.9, 1.20.4 golang: html/template: improper handling of JavaScript whitespace CVE-2024-24790 stdlib v1.18.2 → 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses CVE-2024-45491 libexpat 2.6.2-r0 → 2.6.3-r0 libexpat: Integer Overflow or Wraparound CVE-2024-45492 libexpat 2.6.2-r0 → 2.6.3-r0 libexpat: integer overflow CVE-2024-56171 libxml2 2.12.7-r0 → 2.12.7-r1 libxml2: Use-After-Free in libxml2 CVE-2025-68121 stdlib v1.18.2 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 stdlib v1.22.4 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 stdlib v1.22.4 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-31789 libcrypto3 3.3.1-r3 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 libssl3 3.3.1-r3 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing |
| cps | artifactory.devops.telekom.de/onap-repo/onap/cps-and-ncmp:3.7.0 | 8 | 76 | 82 | CVE-2024-45491 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: Integer Overflow or Wraparound CVE-2024-45492 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: integer overflow CVE-2026-107726 com.hazelcast:hazelcast 5.5.0 → 5.7.0 com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client CVE-2026-47884 org.springframework:spring-webmvc 6.2.9 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webflux 6.2.9 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-47890 org.springframework:spring-webmvc 6.2.9 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-47892 org.springframework:spring-webflux 6.2.9 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints CVE-2026-75595 io.netty:netty-handler 4.1.123.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| cps | artifactory.devops.telekom.de/onap-repo/onap/cps-temporal:1.2.1 | 22 | 103 | 121 | CVE-2016-1000027 org.springframework:spring-web 5.3.21 → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization CVE-2021-36159 apk-tools 2.10.5-r1 → 2.10.7-r0 libfetch: an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes leads to information leak or crash CVE-2021-3711 libcrypto1.1 1.1.1g-r0 → 1.1.1l-r0 openssl: SM2 Decryption Buffer Overflow CVE-2021-3711 libssl1.1 1.1.1g-r0 → 1.1.1l-r0 openssl: SM2 Decryption Buffer Overflow CVE-2021-3711 openssl 1.1.1i-r0 → 1.1.1l-r0 openssl: SM2 Decryption Buffer Overflow CVE-2022-31692 org.springframework.security:spring-security-core 5.6.6 → 5.7.5, 5.6.9 spring-security: Authorization rules can be bypassed via forward or include dispatcher types in Spring Security CVE-2022-37434 zlib 1.2.11-r3 → 1.2.12-r2 zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field CVE-2022-42889 org.apache.commons:commons-text 1.9 → 1.10.0 apache-commons-text: variable interpolation RCE CVE-2023-20860 org.springframework:spring-webmvc 5.3.21 → 6.0.7, 5.3.26 springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern CVE-2023-20873 org.springframework.boot:spring-boot-actuator-autoconfigure 2.6.9 → 3.0.6, 2.7.11, 2.6.15, 2.5.15 spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry CVE-2023-34034 org.springframework.security:spring-security-config 5.6.6 → 5.6.12, 5.7.10, 5.8.5, 6.0.5, 6.1.2 spring-security-webflux: path wildcard leads to security bypass CVE-2024-1597 org.postgresql:postgresql 42.3.6 → 42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2 pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE CVE-2024-38821 org.springframework.security:spring-security-web 5.6.6 → 5.7.13, 5.8.15, 6.2.7, 6.0.13, 6.1.11, 6.3.4 Spring-WebFlux: Authorization Bypass of Static Resources in WebFlux Applications CVE-2025-24813 org.apache.tomcat.embed:tomcat-embed-core 9.0.64 → 11.0.3, 10.1.35, 9.0.99 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT CVE-2026-22732 org.springframework.security:spring-security-web 5.6.6 → 6.5.9, 7.0.4 Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 9.0.64 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 9.0.64 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 9.0.64 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass CVE-2026-47884 org.springframework:spring-webmvc 5.3.21 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 9.0.64 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 9.0.64 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 9.0.64 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass |
| cps | artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3 | 0 | 0 | 0 | |
| dcae | artifactory.devops.telekom.de/hub.docker.com/busybox:1.37.0 | 0 | 0 | 0 | |
| dcae | artifactory.devops.telekom.de/hub.docker.com/postgres:17.11 | 2 | 86 | 26 | CVE-2025-68121 stdlib v1.24.6 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-6653 libxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3 → no fix libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free |
| dcae | artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3 | 0 | 0 | 0 | |
| dcae | artifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.collectors.hv-ves.hv-collector-main:1.11.1 | 6 | 96 | 100 | CVE-2026-31789 libcrypto3 3.5.5-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 libssl3 3.5.5-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 openssl 3.5.5-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-33845 gnutls 3.8.11-r0 → 3.8.13-r0 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment CVE-2026-42010 gnutls 3.8.11-r0 → 3.8.13-r0 gnutls: gnutls: Authentication Bypass via NUL Character in Username CVE-2026-75595 io.netty:netty-handler 4.1.79.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| dcae | artifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.collectors.ves.vescollector:1.12.6 | 17 | 143 | 157 | CVE-2016-1000027 org.springframework:spring-web 5.3.22 → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization CVE-2022-42889 org.apache.commons:commons-text 1.9 → 1.10.0 apache-commons-text: variable interpolation RCE CVE-2023-20860 org.springframework:spring-webmvc 5.3.22 → 6.0.7, 5.3.26 springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern CVE-2025-24813 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 11.0.3, 10.1.35, 9.0.99 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT CVE-2026-31789 libcrypto3 3.5.5-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 libssl3 3.5.5-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 openssl 3.5.5-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-33845 gnutls 3.8.11-r0 → 3.8.13-r0 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-42010 gnutls 3.8.11-r0 → 3.8.13-r0 gnutls: gnutls: Authentication Bypass via NUL Character in Username CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass CVE-2026-47884 org.springframework:spring-webmvc 5.3.22 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass CVE-2026-75595 io.netty:netty-handler 4.1.73.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| dcae | artifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.deployments.healthcheck-container:2.4.1 | 1 | 44 | 43 | CVE-2026-59873 tar 6.1.15 → 7.5.19 tar: node-tar: Denial of Service via crafted gzip bomb |
| dcae | artifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.platform.ves-openapi-manager:1.3.1 | 15 | 93 | 105 | CVE-2016-1000027 org.springframework:spring-web 5.3.22 → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization CVE-2021-36159 apk-tools 2.10.5-r1 → 2.10.7-r0 libfetch: an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes leads to information leak or crash CVE-2021-3711 libcrypto1.1 1.1.1g-r0 → 1.1.1l-r0 openssl: SM2 Decryption Buffer Overflow CVE-2021-3711 libssl1.1 1.1.1g-r0 → 1.1.1l-r0 openssl: SM2 Decryption Buffer Overflow CVE-2021-3711 openssl 1.1.1i-r0 → 1.1.1l-r0 openssl: SM2 Decryption Buffer Overflow CVE-2022-37434 zlib 1.2.11-r3 → 1.2.12-r2 zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field CVE-2023-20860 org.springframework:spring-webmvc 5.3.22 → 6.0.7, 5.3.26 springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern CVE-2025-24813 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 11.0.3, 10.1.35, 9.0.99 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass CVE-2026-47884 org.springframework:spring-webmvc 5.3.22 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass |
| dcae | artifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.services.datalake.exposure.service:1.2.0 | 10 | 46 | 53 | CVE-2016-1000027 org.springframework:spring-web 5.3.31 → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization CVE-2024-1597 org.postgresql:postgresql 42.2.18 → 42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2 pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE CVE-2025-24813 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 11.0.3, 10.1.35, 9.0.99 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass CVE-2026-47884 org.springframework:spring-webmvc 5.3.31 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass |
| dcae | artifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.services.datalakeadminui:1.2.0 | 1 | 59 | 1 | CVE-2026-6653 libxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3 → no fix libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free |
| dcae | artifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.services.datalakefeeder:1.2.0 | 26 | 238 | 256 | CVE-2014-125087 com.jamesmurty.utils:java-xmlbuilder 1.1 → 1.2 java-xmlbuilder: XMLBuilder2 is vulnerable to XML External Entity (XXE) injection CVE-2015-1832 org.apache.derby:derby 10.11.1.1 → 10.12.1.1 Derby: XXE attack possible by using XmlVTI and the XML datatype CVE-2016-1000027 org.springframework:spring-web 5.3.31 → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization CVE-2017-1000487 org.codehaus.plexus:plexus-utils 3.0.15 → 3.0.16 plexus-utils: Mishandled strings in Commandline class allow for command injection CVE-2019-10202 org.codehaus.jackson:jackson-mapper-asl 1.9.13 → no fix codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities CVE-2019-20444 io.netty:netty 3.10.5.Final → 4.0.0 netty: HTTP request smuggling CVE-2019-20444 io.netty:netty-codec-http 4.1.8.Final → 4.1.44 netty: HTTP request smuggling CVE-2022-46337 org.apache.derby:derby 10.11.1.1 → 10.14.2.1, 10.16.1.2, 10.15.2.1 A cleverly devised username might bypass LDAP authentication checks. I ... CVE-2023-44981 org.apache.zookeeper:zookeeper 3.4.10 → 3.7.2, 3.8.3, 3.9.1 zookeeper: Authorization Bypass in Apache ZooKeeper CVE-2024-1597 org.postgresql:postgresql 42.6.0 → 42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2 pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE CVE-2024-47561 org.apache.avro:avro 1.7.7 → 1.11.4 apache-avro: Schema parsing may trigger Remote Code Execution (RCE) CVE-2025-24813 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 11.0.3, 10.1.35, 9.0.99 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT CVE-2026-31789 libcrypto3 3.5.5-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 libssl3 3.5.5-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 openssl 3.5.5-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-33845 gnutls 3.8.11-r0 → 3.8.13-r0 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-42010 gnutls 3.8.11-r0 → 3.8.13-r0 gnutls: gnutls: Authentication Bypass via NUL Character in Username CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass CVE-2026-47884 org.springframework:spring-webmvc 5.3.31 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass CVE-2026-75595 io.netty:netty-handler 4.1.8.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext CVE-2026-75595 io.netty:netty-handler 4.1.80.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| dcae | artifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.services.prh.prh-app-server:1.13.0 | 12 | 85 | 95 | CVE-2026-33701 io.opentelemetry.javaagent:opentelemetry-javaagent 2.25.0 → 2.26.1 io.opentelemetry.javaagent/opentelemetry-javaagent: OpenTelemetry Java Instrumentation: Remote code execution via deserialization vulnerability in RMI CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 10.1.49 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 10.1.49 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 10.1.49 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass CVE-2026-47884 org.springframework:spring-webmvc 6.2.14 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webflux 6.2.14 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-47890 org.springframework:spring-webmvc 6.2.14 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-47892 org.springframework:spring-webflux 6.2.14 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.49 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.49 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.49 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass CVE-2026-75595 io.netty:netty-handler 4.1.128.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| entity | quay.io/strimzi/operator:0.45.0 | 2 | 138 | 125 | CVE-2026-114406 ca-certificates 2024.2.69_v8.0.303-91.4.el9_4 → 2026.2.92_v9.0.319-90.3.el9_8 ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-75595 io.netty:netty-handler 4.1.115.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| integration | artifactory.devops.telekom.de/tnap-docker/xtesting-healthcheck:master | 8 | 36 | 44 | CVE-2020-14343 PyYAML 5.3.1 → 5.4 PyYAML: incomplete fix for CVE-2020-1747 CVE-2022-1586 pcre2 10.36-r0 → 10.36-r1 pcre2: Out-of-bounds read in compile_xclass_matchingpath in pcre2_jit_compile.c CVE-2022-1587 pcre2 10.36-r0 → 10.36-r1 pcre2: Out-of-bounds read in get_recurse_data_length in pcre2_jit_compile.c CVE-2022-32207 libcurl 7.79.1-r0 → 7.79.1-r2 curl: Unpreserved file permissions CVE-2022-37434 zlib 1.2.12-r0 → 1.2.12-r2 zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field CVE-2024-49768 waitress 3.0.0 → 3.0.1 waitress: python-waitress: request processing race condition in HTTP pipelining with invalid first request CVE-2025-58367 deepdiff 6.3.0 → 8.6.1 DeepDiff is a project focused on Deep Difference and search of any Pyt ... GHSA-6q48-6c7w-9gw2 certifi 2021.10.8 → 2026.10.18 certifi bundles emSign root CAs with compromised intermediate CA keys |
| integration | artifactory.devops.telekom.de/tnap-docker/xtesting-smoke-usecases-robot-py3:master | 5 | 108 | 111 | CVE-2025-58367 deepdiff 8.4.2 → 8.6.1 DeepDiff is a project focused on Deep Difference and search of any Pyt ... CVE-2025-68121 stdlib v1.23.4 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 stdlib v1.23.3 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-33186 google.golang.org/grpc v1.65.0 → 1.79.3 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation GHSA-6q48-6c7w-9gw2 certifi 2026.7.22 → 2026.10.18 certifi bundles emSign root CAs with compromised intermediate CA keys |
| multicloud | artifactory.devops.telekom.de/onap-repo/memcached:alpine3.15 | 1 | 8 | 9 | CVE-2022-37434 zlib 1.2.12-r0 → 1.2.12-r2 zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field |
| multicloud | artifactory.devops.telekom.de/onap-repo/onap/multicloud/framework-artifactbroker:1.9.3 | 13 | 126 | 132 | CVE-2015-7501 commons-collections:commons-collections 3.2.1 → 3.2.2 apache-commons-collections: InvokerTransformer code execution during deserialisation CVE-2017-7657 org.eclipse.jetty:jetty-server 9.3.12.v20160915 → 9.2.25.v20180606, 9.3.24.v20180605 jetty: HTTP request smuggling CVE-2017-7658 org.eclipse.jetty:jetty-server 9.3.12.v20160915 → 9.2.25.v20180606, 9.3.24.v20180605, 9.4.11.v20180605 jetty: Incorrect header handling CVE-2019-17571 log4j:log4j 1.2.17 → no fix log4j: deserialization of untrusted data in SocketServer CVE-2022-23305 log4j:log4j 1.2.17 → no fix log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender CVE-2022-23307 log4j:log4j 1.2.17 → no fix log4j: Unsafe deserialization flaw in Chainsaw log viewer CVE-2022-36437 com.hazelcast:hazelcast 3.7.2 → 3.12.13, 4.1.10, 4.2.6, 5.0.4, 5.1.3 hazelcast: Hazelcast connection caching CVE-2026-107726 com.hazelcast:hazelcast 3.7.2 → 5.7.0 com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client CVE-2026-31789 libcrypto3 3.5.1-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 libssl3 3.5.1-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 openssl 3.5.1-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-33845 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment CVE-2026-42010 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: gnutls: Authentication Bypass via NUL Character in Username |
| multicloud | artifactory.devops.telekom.de/onap-repo/onap/multicloud/framework:1.9.2 | 15 | 63 | 78 | CVE-2020-14343 PyYAML 5.3.1 → 5.4 PyYAML: incomplete fix for CVE-2020-1747 CVE-2021-36159 apk-tools 2.12.5-r0 → 2.12.6-r0 libfetch: an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes leads to information leak or crash CVE-2022-22822 expat 2.2.10-r1 → 2.2.10-r2 expat: Integer overflow in addBinding in xmlparse.c CVE-2022-22823 expat 2.2.10-r1 → 2.2.10-r2 expat: Expat: Denial of Service vulnerability in XML parsing CVE-2022-22824 expat 2.2.10-r1 → 2.2.10-r2 expat: Expat: Denial of service and memory issues due to integer overflow CVE-2022-23852 expat 2.2.10-r1 → 2.2.10-r3 expat: Integer overflow in function XML_GetBuffer CVE-2022-25235 expat 2.2.10-r1 → 2.2.10-r4 expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution CVE-2022-25236 expat 2.2.10-r1 → 2.2.10-r4 expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution CVE-2022-25315 expat 2.2.10-r1 → 2.2.10-r4 expat: Integer overflow in storeRawNames() CVE-2022-28346 Django 3.2.7 → 2.2.28, 3.2.13, 4.0.4 Django: SQL injection in QuerySet.annotate(),aggregate() and extra() CVE-2022-28347 Django 3.2.7 → 2.2.28, 3.2.13, 4.0.4 Django: SQL injection via QuerySet.explain(options) on PostgreSQL CVE-2022-34265 Django 3.2.7 → 3.2.14, 4.0.6 python-django: Potential SQL injection via Trunc(kind) and Extract(lookup_name) arguments CVE-2022-37434 zlib 1.2.11-r3 → 1.2.12-r2 zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field CVE-2023-31047 Django 3.2.7 → 3.2.19, 4.1.9, 4.2.1 python-django: Potential bypass of validation when uploading multiple files using one form field CVE-2025-64459 Django 3.2.7 → 5.2.8, 5.1.14, 4.2.26 django: Django SQL injection |
| multicloud | artifactory.devops.telekom.de/onap-repo/onap/multicloud/k8s:0.12.0 | 6 | 121 | 123 | CVE-2022-1996 github.com/emicklei/go-restful v2.9.5+incompatible → 2.16.0 go-restful: Authorization Bypass Through User-Controlled Key CVE-2023-24538 stdlib v1.16.15 → 1.19.8, 1.20.3 golang: html/template: backticks not treated as string delimiters CVE-2023-24540 stdlib v1.16.15 → 1.19.9, 1.20.4 golang: html/template: improper handling of JavaScript whitespace CVE-2024-24790 stdlib v1.16.15 → 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses CVE-2025-68121 stdlib v1.16.15 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-33186 google.golang.org/grpc v1.42.0 → 1.79.3 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation |
| multicloud | artifactory.devops.telekom.de/onap-repo/onap/multicloud/openstack-fcaps:1.5.7 | 15 | 76 | 91 | CVE-2021-36159 apk-tools 2.12.5-r0 → 2.12.6-r0 libfetch: an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes leads to information leak or crash CVE-2022-22822 expat 2.2.10-r1 → 2.2.10-r2 expat: Integer overflow in addBinding in xmlparse.c CVE-2022-22823 expat 2.2.10-r1 → 2.2.10-r2 expat: Expat: Denial of Service vulnerability in XML parsing CVE-2022-22824 expat 2.2.10-r1 → 2.2.10-r2 expat: Expat: Denial of service and memory issues due to integer overflow CVE-2022-23852 expat 2.2.10-r1 → 2.2.10-r3 expat: Integer overflow in function XML_GetBuffer CVE-2022-25235 expat 2.2.10-r1 → 2.2.10-r4 expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution CVE-2022-25236 expat 2.2.10-r1 → 2.2.10-r4 expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution CVE-2022-25315 expat 2.2.10-r1 → 2.2.10-r4 expat: Integer overflow in storeRawNames() CVE-2022-28346 Django 3.2.7 → 2.2.28, 3.2.13, 4.0.4 Django: SQL injection in QuerySet.annotate(),aggregate() and extra() CVE-2022-28347 Django 3.2.7 → 2.2.28, 3.2.13, 4.0.4 Django: SQL injection via QuerySet.explain(options) on PostgreSQL CVE-2022-34265 Django 3.2.7 → 3.2.14, 4.0.6 python-django: Potential SQL injection via Trunc(kind) and Extract(lookup_name) arguments CVE-2022-37434 zlib 1.2.11-r3 → 1.2.12-r2 zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field CVE-2023-31047 Django 3.2.7 → 3.2.19, 4.1.9, 4.2.1 python-django: Potential bypass of validation when uploading multiple files using one form field CVE-2025-64459 Django 3.2.7 → 5.2.8, 5.1.14, 4.2.26 django: Django SQL injection GHSA-6q48-6c7w-9gw2 certifi 2021.10.8 → 2026.10.18 certifi bundles emSign root CAs with compromised intermediate CA keys |
| multicloud | artifactory.devops.telekom.de/onap-repo/rabbitmq:alpine | 0 | 0 | 0 | |
| multicloud | docker.io/bitnamilegacy/mongodb:8.0.9-debian-12-r4 | 28 | 580 | 537 | CVE-2023-45853 zlib1g 1:1.2.13.dfsg-1 → no fix zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6 CVE-2025-68121 stdlib v1.23.9 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 stdlib v1.23.9 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 stdlib v1.24.3 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 stdlib v1.23.8 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 stdlib v1.23.8 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 stdlib v1.23.8 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 stdlib v1.23.8 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 stdlib v1.23.8 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 stdlib v1.23.8 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 stdlib v1.23.8 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 stdlib v1.23.8 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-13221 libperl5.36 5.36.0-7+deb12u2 → 5.36.0-7+deb12u4 perl: Perl: Incorrect regular expression processing via large regular expressions CVE-2026-13221 perl 5.36.0-7+deb12u2 → 5.36.0-7+deb12u4 perl: Perl: Incorrect regular expression processing via large regular expressions CVE-2026-13221 perl-base 5.36.0-7+deb12u2 → 5.36.0-7+deb12u4 perl: Perl: Incorrect regular expression processing via large regular expressions CVE-2026-13221 perl-modules-5.36 5.36.0-7+deb12u2 → 5.36.0-7+deb12u4 perl: Perl: Incorrect regular expression processing via large regular expressions CVE-2026-31789 libssl3 3.0.16-1~deb12u1 → 3.0.19-1~deb12u2 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 openssl 3.0.16-1~deb12u1 → 3.0.19-1~deb12u2 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-33845 libgnutls30 3.7.9-2+deb12u4 → 3.7.9-2+deb12u7 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment CVE-2026-42010 libgnutls30 3.7.9-2+deb12u4 → 3.7.9-2+deb12u7 gnutls: gnutls: Authentication Bypass via NUL Character in Username CVE-2026-42496 libperl5.36 5.36.0-7+deb12u2 → 5.36.0-7+deb12u4 perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access CVE-2026-42496 perl 5.36.0-7+deb12u2 → 5.36.0-7+deb12u4 perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access CVE-2026-42496 perl-base 5.36.0-7+deb12u2 → 5.36.0-7+deb12u4 perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access CVE-2026-42496 perl-modules-5.36 5.36.0-7+deb12u2 → 5.36.0-7+deb12u4 perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access CVE-2026-8376 libperl5.36 5.36.0-7+deb12u2 → 5.36.0-7+deb12u4 perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds CVE-2026-8376 perl 5.36.0-7+deb12u2 → 5.36.0-7+deb12u4 perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds CVE-2026-8376 perl-base 5.36.0-7+deb12u2 → 5.36.0-7+deb12u4 perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds CVE-2026-8376 perl-modules-5.36 5.36.0-7+deb12u2 → 5.36.0-7+deb12u4 perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds |
| multicloud | quay.io/coreos/etcd:v3.2.32 | 1 | 9 | 10 | CVE-2021-36159 apk-tools 2.10.4-r2 → 2.10.7-r0 libfetch: an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes leads to information leak or crash |
| ncmp | artifactory.devops.telekom.de/onap-repo/onap/ncmp-dmi-plugin:1.7.0 | 12 | 61 | 71 | CVE-2024-45491 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: Integer Overflow or Wraparound CVE-2024-45492 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: integer overflow CVE-2025-41232 org.springframework.security:spring-security-core 6.4.4 → 6.4.6 Spring-Security: Spring Security authorization bypass for method security annotations on private methods CVE-2026-22732 org.springframework.security:spring-security-web 6.4.4 → 6.5.9, 7.0.4 Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 10.1.39 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 10.1.39 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 10.1.39 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass CVE-2026-47884 org.springframework:spring-webmvc 6.2.5 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webmvc 6.2.5 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.39 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.39 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.39 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass |
| ncmp | artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3 | 0 | 0 | 0 | |
| nengdb | artifactory.devops.telekom.de/hub.docker.com/mariadb:11.7.2 | 4 | 65 | 69 | CVE-2023-24538 stdlib v1.18.2 → 1.19.8, 1.20.3 golang: html/template: backticks not treated as string delimiters CVE-2023-24540 stdlib v1.18.2 → 1.19.9, 1.20.4 golang: html/template: improper handling of JavaScript whitespace CVE-2024-24790 stdlib v1.18.2 → 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses CVE-2025-68121 stdlib v1.18.2 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption |
| nengdb | artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3 | 0 | 0 | 0 | |
| network | artifactory.devops.telekom.de/onap-repo/onap/ccsdk-apps-ms-neng:1.4.0 | 30 | 189 | 218 | CVE-2016-1000027 org.springframework:spring-web 5.3.16 → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization CVE-2021-36159 apk-tools 2.10.5-r1 → 2.10.7-r0 libfetch: an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes leads to information leak or crash CVE-2021-3711 libcrypto1.1 1.1.1g-r0 → 1.1.1l-r0 openssl: SM2 Decryption Buffer Overflow CVE-2021-3711 libssl1.1 1.1.1g-r0 → 1.1.1l-r0 openssl: SM2 Decryption Buffer Overflow CVE-2021-3711 openssl 1.1.1i-r0 → 1.1.1l-r0 openssl: SM2 Decryption Buffer Overflow CVE-2021-42392 com.h2database:h2 1.4.200 → 2.0.206 h2: Remote Code Execution in Console CVE-2021-43527 nss 3.60-r1 → 3.60-r2 nss: Memory corruption in decodeECorDsaSignature with DSA signatures (and RSA-PSS) CVE-2022-0839 org.liquibase:liquibase-core 4.4.2.nordix → 4.8.0 liquibase: Improper Restriction of XML External Entity CVE-2022-22822 expat 2.2.9-r1 → 2.2.10-r0 expat: Integer overflow in addBinding in xmlparse.c CVE-2022-22823 expat 2.2.9-r1 → 2.2.10-r0 expat: Expat: Denial of Service vulnerability in XML parsing CVE-2022-22824 expat 2.2.9-r1 → 2.2.10-r0 expat: Expat: Denial of service and memory issues due to integer overflow CVE-2022-22965 org.springframework:spring-beans 5.3.16 → 5.2.20.RELEASE, 5.3.18 spring-framework: RCE via Data Binding on JDK 9+ CVE-2022-22965 org.springframework:spring-webmvc 5.3.16 → 5.2.20.RELEASE, 5.3.18 spring-framework: RCE via Data Binding on JDK 9+ CVE-2022-23221 com.h2database:h2 1.4.200 → 2.1.210 h2: Loading of custom classes from remote servers through JNDI CVE-2022-23852 expat 2.2.9-r1 → 2.2.10-r1 expat: Integer overflow in function XML_GetBuffer CVE-2022-25235 expat 2.2.9-r1 → 2.2.10-r2 expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution CVE-2022-25236 expat 2.2.9-r1 → 2.2.10-r2 expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution CVE-2022-25315 expat 2.2.9-r1 → 2.2.10-r2 expat: Integer overflow in storeRawNames() CVE-2022-27404 freetype 2.10.4-r0 → 2.10.4-r1 FreeType: Buffer overflow in sfnt_init_face CVE-2022-37434 zlib 1.2.11-r3 → 1.2.12-r2 zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field CVE-2023-20860 org.springframework:spring-webmvc 5.3.16 → 6.0.7, 5.3.26 springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern CVE-2023-20873 org.springframework.boot:spring-boot-actuator-autoconfigure 2.5.10 → 3.0.6, 2.7.11, 2.6.15, 2.5.15 spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry CVE-2025-24813 org.apache.tomcat.embed:tomcat-embed-core 9.0.58 → 11.0.3, 10.1.35, 9.0.99 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 9.0.58 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 9.0.58 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 9.0.58 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass CVE-2026-47884 org.springframework:spring-webmvc 5.3.16 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 9.0.58 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 9.0.58 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 9.0.58 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass |
| network | artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3 | 0 | 0 | 0 | |
| nginx | docker.io/bitnami/nginx:latest | 5 | 23 | 28 | CVE-2026-15176 nginx 1.31.6-1 → 1.30.6, 1.31.7 nginx: nginx: heap-based buffer overflow in ngx_http_core_module via alias with rewrite referencing $request_filename CVE-2026-18924 curl-libs 8.21.0-3.ph5 → 8.22.0-1.ph5 curl: libcurl: Use-after-free in HTTP/2 Server Push with shared connections CVE-2026-19931 curl-libs 8.21.0-3.ph5 → 8.22.0-1.ph5 curl: libcurl: Information disclosure via incorrect connection reuse with Negotiate authentication CVE-2026-93479 nginx 1.31.6-1 → 1.30.6, 1.31.7 nginx: NGINX map directive and regex matching vulnerability CVE-2026-97205 nginx 1.31.6-1 → 1.30.6, 1.31.7 nginx: NGINX ngx_http_core_module vulnerability |
| oauth2 | docker.io/library/alpine:latest | 0 | 0 | 0 | |
| oauth2 | quay.io/oauth2-proxy/oauth2-proxy:v7.13.0 | 4 | 53 | 56 | CVE-2025-68121 stdlib v1.25.4 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-33186 google.golang.org/grpc v1.73.0 → 1.79.3 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-34457 github.com/oauth2-proxy/oauth2-proxy/v7 v7.13.0 → 7.15.2 OAuth2 Proxy's Health Check User-Agent Matching Bypasses Authentication in auth_request Mode CVE-2026-40575 github.com/oauth2-proxy/oauth2-proxy/v7 v7.13.0 → 7.15.2 oauth2-proxy: github.com/oauth2-proxy/oauth2-proxy: OAuth2 Proxy: Authentication bypass due to spoofed X-Forwarded-Uri header |
| onap | artifactory.devops.telekom.de/hub.docker.com/adorsys/keycloak-config-cli:6.2.1-26.0.5 | 0 | 26 | 26 | |
| policy | artifactory.devops.telekom.de/hub.docker.com/busybox:1.37.0 | 0 | 0 | 0 | |
| policy | artifactory.devops.telekom.de/hub.docker.com/postgres:17.11 | 2 | 86 | 26 | CVE-2025-68121 stdlib v1.24.6 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-6653 libxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3 → no fix libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free |
| policy | artifactory.devops.telekom.de/onap-repo/library/postgres:17.11 | 2 | 86 | 26 | CVE-2025-68121 stdlib v1.24.6 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-6653 libxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3 → no fix libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free |
| policy | artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3 | 0 | 0 | 0 | |
| policy | artifactory.devops.telekom.de/onap-repo/onap/policy-apex-pdp:5.0.1 | 3 | 49 | 52 | CVE-2026-107726 com.hazelcast:hazelcast 5.5.0 → 5.7.0 com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client CVE-2026-75595 io.netty:netty-handler 4.2.15.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext CVE-2026-8763 org.bouncycastle:bc-fips 2.1.2 → 1.0.2.7, 2.0.2, 2.1.3 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI |
| policy | artifactory.devops.telekom.de/onap-repo/onap/policy-api:5.0.1 | 9 | 37 | 46 | CVE-2026-47884 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-47890 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-47892 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 11.0.22 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 11.0.22 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 11.0.22 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 11.0.22 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass CVE-2026-75595 io.netty:netty-handler 4.2.15.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| policy | artifactory.devops.telekom.de/onap-repo/onap/policy-clamp-ac-a1pms-ppnt:9.1.0 | 9 | 38 | 47 | CVE-2026-47884 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-47890 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-47892 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass CVE-2026-75595 io.netty:netty-handler 4.2.15.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| policy | artifactory.devops.telekom.de/onap-repo/onap/policy-clamp-ac-http-ppnt:9.1.0 | 9 | 38 | 47 | CVE-2026-47884 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-47890 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-47892 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass CVE-2026-75595 io.netty:netty-handler 4.2.15.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| policy | artifactory.devops.telekom.de/onap-repo/onap/policy-clamp-ac-k8s-ppnt:9.1.0 | 19 | 225 | 242 | CVE-2022-1996 github.com/emicklei/go-restful v2.9.5+incompatible → 2.16.0 go-restful: Authorization Bypass Through User-Controlled Key CVE-2022-21235 github.com/Masterminds/vcs v1.13.1 → 1.13.2 github.com/Masterminds/vcs: Command Injection via argument injection CVE-2022-23806 stdlib v1.15.7 → 1.16.14, 1.17.7 golang: crypto/elliptic: IsOnCurve returns true for invalid field elements CVE-2022-23806 stdlib v1.16.4 → 1.16.14, 1.17.7 golang: crypto/elliptic: IsOnCurve returns true for invalid field elements CVE-2023-24538 stdlib v1.15.7 → 1.19.8, 1.20.3 golang: html/template: backticks not treated as string delimiters CVE-2023-24538 stdlib v1.16.4 → 1.19.8, 1.20.3 golang: html/template: backticks not treated as string delimiters CVE-2023-24540 stdlib v1.15.7 → 1.19.9, 1.20.4 golang: html/template: improper handling of JavaScript whitespace CVE-2023-24540 stdlib v1.16.4 → 1.19.9, 1.20.4 golang: html/template: improper handling of JavaScript whitespace CVE-2024-24790 stdlib v1.15.7 → 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses CVE-2024-24790 stdlib v1.16.4 → 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses CVE-2025-68121 stdlib v1.15.7 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 stdlib v1.16.4 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-33186 google.golang.org/grpc v1.27.1 → 1.79.3 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-47884 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass |
| policy | artifactory.devops.telekom.de/onap-repo/onap/policy-clamp-ac-kserve-ppnt:9.1.0 | 8 | 34 | 42 | CVE-2025-14813 org.bouncycastle:bcprov-jdk18on 1.83 → 1.80.2, 1.81.1, 1.84 bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly CVE-2026-47884 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass CVE-2026-8763 org.bouncycastle:bcprov-jdk18on 1.83 → 1.85 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI |
| policy | artifactory.devops.telekom.de/onap-repo/onap/policy-clamp-ac-pf-ppnt:9.1.0 | 9 | 38 | 47 | CVE-2026-47884 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-47890 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-47892 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass CVE-2026-75595 io.netty:netty-handler 4.2.15.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| policy | artifactory.devops.telekom.de/onap-repo/onap/policy-clamp-runtime-acm:9.1.0 | 6 | 33 | 39 | CVE-2026-47884 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass |
| policy | artifactory.devops.telekom.de/onap-repo/onap/policy-db-migrator:5.0.1 | 0 | 56 | 56 | |
| policy | artifactory.devops.telekom.de/onap-repo/onap/policy-distribution:5.1.0 | 0 | 28 | 28 | |
| policy | artifactory.devops.telekom.de/onap-repo/onap/policy-opa-pdp:2.1.0 | 4 | 103 | 107 | CVE-2025-68121 stdlib v1.23.1 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 stdlib v1.23.12 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-33186 google.golang.org/grpc v1.67.0 → 1.79.3 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33186 google.golang.org/grpc v1.70.0 → 1.79.3 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation |
| policy | artifactory.devops.telekom.de/onap-repo/onap/policy-pap:5.0.1 | 6 | 34 | 40 | CVE-2026-47884 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 11.0.22 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 11.0.22 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 11.0.22 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 11.0.22 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass |
| policy | artifactory.devops.telekom.de/onap-repo/onap/policy-pdpd-cl:4.0.1 | 6 | 99 | 102 | CVE-2020-10683 dom4j:dom4j 1.1 → no fix dom4j: XML External Entity vulnerability in default SAX parser CVE-2021-26291 org.apache.maven:maven-core 3.1.1 → 3.8.1 maven: Block repositories using http by default CVE-2026-75595 io.netty:netty-handler 4.2.15.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext CVE-2026-75595 io.netty:netty-handler 4.2.15.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext CVE-2026-8763 org.bouncycastle:bc-fips 2.1.2 → 1.0.2.7, 2.0.2, 2.1.3 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI CVE-2026-8763 org.bouncycastle:bc-fips 2.1.2 → 1.0.2.7, 2.0.2, 2.1.3 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI |
| policy | artifactory.devops.telekom.de/onap-repo/onap/policy-xacml-pdp:5.0.1 | 0 | 30 | 30 | |
| portal | artifactory.devops.telekom.de/hub.docker.com/alpine/psql:18.6 | 0 | 0 | 0 | |
| portal | artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3 | 0 | 0 | 0 | |
| portal | artifactory.devops.telekom.de/onap-repo/onap/portal-ng/bff:0.5.1-20260925T0756 | 0 | 13 | 13 | |
| portal | artifactory.devops.telekom.de/onap-repo/onap/portal-ng/history:0.4.0-20260925T0802 | 3 | 20 | 23 | CVE-2026-47890 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-47892 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints CVE-2026-75595 io.netty:netty-handler 4.2.15.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| portal | artifactory.devops.telekom.de/onap-repo/onap/portal-ng/preferences:0.4.0-20260925T0757 | 3 | 20 | 23 | CVE-2026-47890 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-47892 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints CVE-2026-75595 io.netty:netty-handler 4.2.15.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| portal | artifactory.devops.telekom.de/onap-repo/onap/portal-ng/ui:0.2.0-20260923T0059 | 0 | 1 | 1 | |
| postgres | artifactory.devops.telekom.de/hub.docker.com/busybox:1.37.0 | 0 | 0 | 0 | |
| postgres | artifactory.devops.telekom.de/hub.docker.com/postgres:17.11 | 2 | 86 | 26 | CVE-2025-68121 stdlib v1.24.6 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-6653 libxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3 → no fix libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free |
| robot | artifactory.devops.telekom.de/onap-repo/onap/testsuite:1.14.1 | 14 | 187 | 199 | CVE-2022-23806 stdlib v1.17.5 → 1.16.14, 1.17.7 golang: crypto/elliptic: IsOnCurve returns true for invalid field elements CVE-2023-24538 stdlib v1.17.5 → 1.19.8, 1.20.3 golang: html/template: backticks not treated as string delimiters CVE-2023-24538 stdlib v1.17.11 → 1.19.8, 1.20.3 golang: html/template: backticks not treated as string delimiters CVE-2023-24540 stdlib v1.17.5 → 1.19.9, 1.20.4 golang: html/template: improper handling of JavaScript whitespace CVE-2023-24540 stdlib v1.17.11 → 1.19.9, 1.20.4 golang: html/template: improper handling of JavaScript whitespace CVE-2024-24790 stdlib v1.17.5 → 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses CVE-2024-24790 stdlib v1.17.11 → 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses CVE-2024-41110 github.com/docker/docker v20.10.12+incompatible → 23.0.15, 26.1.5, 27.1.1, 25.0.6 moby: Authz zero length regression CVE-2024-49768 waitress 3.0.0 → 3.0.1 waitress: python-waitress: request processing race condition in HTTP pipelining with invalid first request CVE-2025-58367 deepdiff 8.4.2 → 8.6.1 DeepDiff is a project focused on Deep Difference and search of any Pyt ... CVE-2025-68121 stdlib v1.17.5 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 stdlib v1.17.11 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-33186 google.golang.org/grpc v1.43.0 → 1.79.3 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation GHSA-6q48-6c7w-9gw2 certifi 2025.4.26 → 2026.10.18 certifi bundles emSign root CAs with compromised intermediate CA keys |
| sdc | artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3 | 0 | 0 | 0 | |
| sdc | artifactory.devops.telekom.de/onap-repo/onap/sdc-backend-all-plugins:1.19-20261028T120658Z | 9 | 69 | 75 | CVE-2015-7501 commons-collections:commons-collections 3.2.1 → 3.2.2 apache-commons-collections: InvokerTransformer code execution during deserialisation CVE-2016-1000027 org.springframework:spring-web 5.3.39 → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization CVE-2017-7657 org.eclipse.jetty:jetty-server 9.3.12.v20160915 → 9.2.25.v20180606, 9.3.24.v20180605 jetty: HTTP request smuggling CVE-2017-7658 org.eclipse.jetty:jetty-server 9.3.12.v20160915 → 9.2.25.v20180606, 9.3.24.v20180605, 9.4.11.v20180605 jetty: Incorrect header handling CVE-2022-36437 com.hazelcast:hazelcast 3.7.2 → 3.12.13, 4.1.10, 4.2.6, 5.0.4, 5.1.3 hazelcast: Hazelcast connection caching CVE-2026-107726 com.hazelcast:hazelcast 3.7.2 → 5.7.0 com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client CVE-2026-47884 org.springframework:spring-webmvc 5.3.39 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-49875 org.apache.cxf:cxf-core 3.6.3 → 4.2.2, 4.1.7, 3.6.12 cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening CVE-2026-75595 io.netty:netty-handler 4.1.92.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| sdc | artifactory.devops.telekom.de/onap-repo/onap/sdc-backend-init:1.19-20261028T120658Z | 0 | 2 | 2 | |
| sdc | artifactory.devops.telekom.de/onap-repo/onap/sdc-cassandra-init:1.19-20261028T120658Z | 6 | 41 | 47 | CVE-2017-7657 org.eclipse.jetty:jetty-server 9.3.12.v20160915 → 9.2.25.v20180606, 9.3.24.v20180605 jetty: HTTP request smuggling CVE-2017-7658 org.eclipse.jetty:jetty-server 9.3.12.v20160915 → 9.2.25.v20180606, 9.3.24.v20180605, 9.4.11.v20180605 jetty: Incorrect header handling CVE-2022-36437 com.hazelcast:hazelcast 3.7.2 → 3.12.13, 4.1.10, 4.2.6, 5.0.4, 5.1.3 hazelcast: Hazelcast connection caching CVE-2026-107726 com.hazelcast:hazelcast 3.7.2 → 5.7.0 com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client CVE-2026-49875 org.apache.cxf:cxf-core 3.6.3 → 4.2.2, 4.1.7, 3.6.12 cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening CVE-2026-75595 io.netty:netty-handler 4.1.92.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| sdc | artifactory.devops.telekom.de/onap-repo/onap/sdc-frontend:1.19-20261028T120658Z | 0 | 4 | 4 | |
| sdc | artifactory.devops.telekom.de/onap-repo/onap/sdc-helm-validator:1.3.4-20261026T151051Z | 8 | 37 | 43 | CVE-2016-1000027 org.springframework:spring-web 5.3.31 → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 9.0.99 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 9.0.99 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 9.0.99 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass CVE-2026-47884 org.springframework:spring-webmvc 5.3.31 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 9.0.99 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 9.0.99 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 9.0.99 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass |
| sdc | artifactory.devops.telekom.de/onap-repo/onap/sdc-onboard-backend:1.19-20261028T120658Z | 5 | 29 | 33 | CVE-2016-1000027 org.springframework:spring-web 5.3.39 → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization CVE-2026-47884 org.springframework:spring-webmvc 5.3.39 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-49875 org.apache.cxf:cxf-core 3.6.3 → 4.2.2, 4.1.7, 3.6.12 cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening CVE-2026-75595 io.netty:netty-handler 4.1.92.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext CVE-2026-84939 org.freemarker:freemarker 2.3.30 → 2.3.35 org.apache.freemarker/freemarker: Apache FreeMarker: Path traversal via malformed locale identifier |
| sdc | artifactory.devops.telekom.de/onap-repo/onap/sdc-onboard-cassandra-init:1.19-20261028T120658Z | 0 | 48 | 2 | |
| sdc | artifactory.devops.telekom.de/onap-repo/onap/sdc-workflow-backend:1.15-STAGING-20261020T081502Z | 3 | 38 | 40 | CVE-2016-1000027 org.springframework:spring-web 5.3.31 → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization CVE-2026-47884 org.springframework:spring-webmvc 5.3.31 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-75595 io.netty:netty-handler 4.1.101.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| sdc | artifactory.devops.telekom.de/onap-repo/onap/sdc-workflow-frontend:1.15-STAGING-20261020T081502Z | 5 | 78 | 83 | CVE-2026-31789 libcrypto3 3.5.1-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 libssl3 3.5.1-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 openssl 3.5.1-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-33845 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment CVE-2026-42010 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: gnutls: Authentication Bypass via NUL Character in Username |
| sdc | artifactory.devops.telekom.de/onap-repo/onap/sdc-workflow-init:1.15-STAGING-20261020T081502Z | 0 | 2 | 2 | |
| sdnc | artifactory.devops.telekom.de/hub.docker.com/busybox:1.37.0 | 0 | 0 | 0 | |
| sdnc | artifactory.devops.telekom.de/onap-repo/onap/ccsdk-dgbuilder-image:2.2.0 | 31 | 285 | 314 | CVE-2017-16042 growl 1.8.1 → 1.10.0 nodejs-growl: Does not properly sanitize input before passing it to exec CVE-2019-10744 lodash 0.9.2 → 4.17.12 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties CVE-2019-10744 lodash 0.9.2 → 4.17.12 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties CVE-2019-10744 lodash 1.3.1 → 4.17.12 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties CVE-2019-10744 lodash 2.4.2 → 4.17.12 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties CVE-2019-10744 lodash 2.4.2 → 4.17.12 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties CVE-2019-10744 lodash 2.4.2 → 4.17.12 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties CVE-2019-10744 lodash 2.4.2 → 4.17.12 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties CVE-2019-10744 lodash 3.7.0 → 4.17.12 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties CVE-2019-5413 morgan 1.3.2 → 1.9.1 nodejs-morgan: Unescaped input in compile() function CVE-2020-28282 getobject 0.1.0 → 1.0.0 nodejs-getobject: Prototype pollution could result in DoS and RCE CVE-2020-7769 nodemailer 1.3.0 → 6.4.16 This affects the package nodemailer before 6.4.16. Use of crafted reci ... CVE-2021-23358 underscore 1.6.0 → 1.12.1 nodejs-underscore: Arbitrary code execution via the template function CVE-2021-23358 underscore 1.7.0 → 1.12.1 nodejs-underscore: Arbitrary code execution via the template function CVE-2021-44906 minimist 0.0.8 → 1.2.6, 0.2.4 minimist: prototype pollution CVE-2022-42889 org.apache.commons:commons-text 1.9 → 1.10.0 apache-commons-text: variable interpolation RCE CVE-2025-55130 nodejs 22.15.1-r0 → 22.22.2-r0 nodejs: Nodejs file permissions bypass CVE-2025-7783 form-data 0.1.2 → 2.5.4, 3.0.4, 4.0.4 form-data: Unsafe random function in form-data CVE-2025-7783 form-data 0.1.4 → 2.5.4, 3.0.4, 4.0.4 form-data: Unsafe random function in form-data CVE-2026-31789 libcrypto3 3.3.5-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 libssl3 3.3.5-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 openssl 3.3.5-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-33845 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment CVE-2026-42010 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: gnutls: Authentication Bypass via NUL Character in Username CVE-2026-44170 mariadb-client 11.4.8-r0 → 11.4.11-r0 mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine CVE-2026-44170 mariadb-common 11.4.8-r0 → 11.4.11-r0 mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine CVE-2026-44170 mysql-client 11.4.8-r0 → 11.4.11-r0 mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine CVE-2026-44172 mariadb-client 11.4.8-r0 → 11.4.11-r0 mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() CVE-2026-44172 mariadb-common 11.4.8-r0 → 11.4.11-r0 mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() CVE-2026-44172 mysql-client 11.4.8-r0 → 11.4.11-r0 mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() CVE-2026-48930 nodejs 22.15.1-r0 → 22.23.0-r0 nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling |
| sdnc | artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3 | 0 | 0 | 0 | |
| sdnc | artifactory.devops.telekom.de/onap-repo/onap/sdnc-ansible-server-image:3.2.4 | 10 | 59 | 69 | CVE-2021-36159 apk-tools 2.10.5-r1 → 2.10.7-r0 libfetch: an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes leads to information leak or crash CVE-2022-22822 expat 2.2.9-r1 → 2.2.10-r0 expat: Integer overflow in addBinding in xmlparse.c CVE-2022-22823 expat 2.2.9-r1 → 2.2.10-r0 expat: Expat: Denial of Service vulnerability in XML parsing CVE-2022-22824 expat 2.2.9-r1 → 2.2.10-r0 expat: Expat: Denial of service and memory issues due to integer overflow CVE-2022-23852 expat 2.2.9-r1 → 2.2.10-r1 expat: Integer overflow in function XML_GetBuffer CVE-2022-25235 expat 2.2.9-r1 → 2.2.10-r2 expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution CVE-2022-25236 expat 2.2.9-r1 → 2.2.10-r2 expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution CVE-2022-25315 expat 2.2.9-r1 → 2.2.10-r2 expat: Integer overflow in storeRawNames() CVE-2022-37434 zlib 1.2.11-r3 → 1.2.12-r2 zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field GHSA-6q48-6c7w-9gw2 certifi 2026.2.25 → 2026.10.18 certifi bundles emSign root CAs with compromised intermediate CA keys |
| sdnc | artifactory.devops.telekom.de/onap-repo/onap/sdnc-image:3.2.4 | 70 | 384 | 416 | CVE-2016-1000027 org.springframework:spring-web 5.2.12.RELEASE → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization CVE-2016-1000027 org.springframework:spring-web 5.2.12.RELEASE → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization CVE-2019-17571 log4j:log4j 1.2.17 → no fix log4j: deserialization of untrusted data in SocketServer CVE-2019-17571 log4j:log4j 1.2.17 → no fix log4j: deserialization of untrusted data in SocketServer CVE-2019-17571 log4j:log4j 1.2.17 → no fix log4j: deserialization of untrusted data in SocketServer CVE-2019-17571 log4j:log4j 1.2.17 → no fix log4j: deserialization of untrusted data in SocketServer CVE-2019-17571 log4j:log4j 1.2.17 → no fix log4j: deserialization of untrusted data in SocketServer CVE-2019-17571 log4j:log4j 1.2.17 → no fix log4j: deserialization of untrusted data in SocketServer CVE-2020-11989 org.apache.shiro:shiro-core 1.3.2 → 1.5.3 shiro: spring dynamic controllers, a specially crafted request may cause an authentication bypass CVE-2020-11989 org.apache.shiro:shiro-core 1.3.2 → 1.5.3 shiro: spring dynamic controllers, a specially crafted request may cause an authentication bypass CVE-2020-11989 org.apache.shiro:shiro-core 1.3.2 → 1.5.3 shiro: spring dynamic controllers, a specially crafted request may cause an authentication bypass CVE-2020-11989 org.apache.shiro:shiro-core 1.3.2 → 1.5.3 shiro: spring dynamic controllers, a specially crafted request may cause an authentication bypass CVE-2020-1957 org.apache.shiro:shiro-core 1.3.2 → 1.5.2 shiro: Spring dynamic controllers, a specially crafted request may cause an authentication bypass CVE-2020-1957 org.apache.shiro:shiro-core 1.3.2 → 1.5.2 shiro: Spring dynamic controllers, a specially crafted request may cause an authentication bypass CVE-2020-1957 org.apache.shiro:shiro-core 1.3.2 → 1.5.2 shiro: Spring dynamic controllers, a specially crafted request may cause an authentication bypass CVE-2020-1957 org.apache.shiro:shiro-core 1.3.2 → 1.5.2 shiro: Spring dynamic controllers, a specially crafted request may cause an authentication bypass CVE-2021-41303 org.apache.shiro:shiro-core 1.3.2 → 1.8.0 shiro: specially crafted HTTP request may cause an authentication bypass CVE-2021-41303 org.apache.shiro:shiro-core 1.3.2 → 1.8.0 shiro: specially crafted HTTP request may cause an authentication bypass CVE-2021-41303 org.apache.shiro:shiro-core 1.3.2 → 1.8.0 shiro: specially crafted HTTP request may cause an authentication bypass CVE-2021-41303 org.apache.shiro:shiro-core 1.3.2 → 1.8.0 shiro: specially crafted HTTP request may cause an authentication bypass CVE-2022-22965 org.springframework:spring-beans 5.2.12.RELEASE → 5.2.20.RELEASE, 5.3.18 spring-framework: RCE via Data Binding on JDK 9+ CVE-2022-22965 org.springframework:spring-beans 5.2.12.RELEASE → 5.2.20.RELEASE, 5.3.18 spring-framework: RCE via Data Binding on JDK 9+ CVE-2022-23305 log4j:log4j 1.2.17 → no fix log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender CVE-2022-23305 log4j:log4j 1.2.17 → no fix log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender CVE-2022-23305 log4j:log4j 1.2.17 → no fix log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender CVE-2022-23305 log4j:log4j 1.2.17 → no fix log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender CVE-2022-23305 log4j:log4j 1.2.17 → no fix log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender CVE-2022-23305 log4j:log4j 1.2.17 → no fix log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender CVE-2022-23307 log4j:log4j 1.2.17 → no fix log4j: Unsafe deserialization flaw in Chainsaw log viewer CVE-2022-23307 log4j:log4j 1.2.17 → no fix log4j: Unsafe deserialization flaw in Chainsaw log viewer CVE-2022-23307 log4j:log4j 1.2.17 → no fix log4j: Unsafe deserialization flaw in Chainsaw log viewer CVE-2022-23307 log4j:log4j 1.2.17 → no fix log4j: Unsafe deserialization flaw in Chainsaw log viewer CVE-2022-23307 log4j:log4j 1.2.17 → no fix log4j: Unsafe deserialization flaw in Chainsaw log viewer CVE-2022-23307 log4j:log4j 1.2.17 → no fix log4j: Unsafe deserialization flaw in Chainsaw log viewer CVE-2022-32532 org.apache.shiro:shiro-core 1.3.2 → 1.9.1 shiro: authorization bypass due to possible misconfigured CVE-2022-32532 org.apache.shiro:shiro-core 1.3.2 → 1.9.1 shiro: authorization bypass due to possible misconfigured CVE-2022-32532 org.apache.shiro:shiro-core 1.3.2 → 1.9.1 shiro: authorization bypass due to possible misconfigured CVE-2022-32532 org.apache.shiro:shiro-core 1.3.2 → 1.9.1 shiro: authorization bypass due to possible misconfigured CVE-2022-40664 org.apache.shiro:shiro-core 1.3.2 → 1.10.0 shiro: Authentication Bypass Vulnerability CVE-2022-40664 org.apache.shiro:shiro-core 1.3.2 → 1.10.0 shiro: Authentication Bypass Vulnerability CVE-2022-40664 org.apache.shiro:shiro-core 1.3.2 → 1.10.0 shiro: Authentication Bypass Vulnerability CVE-2022-40664 org.apache.shiro:shiro-core 1.3.2 → 1.10.0 shiro: Authentication Bypass Vulnerability CVE-2022-42889 org.apache.commons:commons-text 1.9 → 1.10.0 apache-commons-text: variable interpolation RCE CVE-2022-42889 org.apache.commons:commons-text 1.9 → 1.10.0 apache-commons-text: variable interpolation RCE CVE-2022-42889 org.apache.commons:commons-text 1.9 → 1.10.0 apache-commons-text: variable interpolation RCE CVE-2022-42889 org.apache.commons:commons-text 1.9 → 1.10.0 apache-commons-text: variable interpolation RCE CVE-2025-14813 org.bouncycastle:bcprov-jdk18on 1.80 → 1.80.2, 1.81.1, 1.84 bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly CVE-2025-14813 org.bouncycastle:bcprov-jdk18on 1.80 → 1.80.2, 1.81.1, 1.84 bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly CVE-2025-14813 org.bouncycastle:bcprov-jdk18on 1.80 → 1.80.2, 1.81.1, 1.84 bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly CVE-2025-3277 sqlite-libs 3.48.0-r0 → 3.48.0-r1 SQLite: integer overflow in SQLite CVE-2025-55130 nodejs 22.15.1-r0 → 22.22.2-r0 nodejs: Nodejs file permissions bypass CVE-2026-31789 libcrypto3 3.3.3-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 libssl3 3.3.3-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 openssl 3.3.3-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-33701 io.opentelemetry.javaagent:opentelemetry-javaagent 2.24.0 → 2.26.1 io.opentelemetry.javaagent/opentelemetry-javaagent: OpenTelemetry Java Instrumentation: Remote code execution via deserialization vulnerability in RMI CVE-2026-33845 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment CVE-2026-42010 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: gnutls: Authentication Bypass via NUL Character in Username CVE-2026-44170 mariadb-client 11.4.8-r0 → 11.4.11-r0 mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine CVE-2026-44170 mariadb-common 11.4.8-r0 → 11.4.11-r0 mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine CVE-2026-44170 mysql-client 11.4.8-r0 → 11.4.11-r0 mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine CVE-2026-44172 mariadb-client 11.4.8-r0 → 11.4.11-r0 mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() CVE-2026-44172 mariadb-common 11.4.8-r0 → 11.4.11-r0 mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() CVE-2026-44172 mysql-client 11.4.8-r0 → 11.4.11-r0 mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() CVE-2026-48930 nodejs 22.15.1-r0 → 22.23.0-r0 nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling CVE-2026-75595 io.netty:netty-handler 4.1.119.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext CVE-2026-75595 io.netty:netty-handler 4.1.119.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext CVE-2026-75595 io.netty:netty-handler 4.1.68.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext CVE-2026-8763 org.bouncycastle:bcprov-jdk18on 1.80 → 1.85 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI CVE-2026-8763 org.bouncycastle:bcprov-jdk18on 1.80 → 1.85 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI CVE-2026-8763 org.bouncycastle:bcprov-jdk18on 1.80 → 1.85 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI |
| sdnc | artifactory.devops.telekom.de/onap-repo/onap/sdnc-ueb-listener-image:3.2.4 | 14 | 185 | 197 | CVE-2025-3277 sqlite-libs 3.48.0-r0 → 3.48.0-r1 SQLite: integer overflow in SQLite CVE-2025-55130 nodejs 22.15.1-r0 → 22.22.2-r0 nodejs: Nodejs file permissions bypass CVE-2026-31789 libcrypto3 3.3.3-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 libssl3 3.3.3-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 openssl 3.3.3-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-33845 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment CVE-2026-42010 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: gnutls: Authentication Bypass via NUL Character in Username CVE-2026-44170 mariadb-client 11.4.8-r0 → 11.4.11-r0 mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine CVE-2026-44170 mariadb-common 11.4.8-r0 → 11.4.11-r0 mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine CVE-2026-44170 mysql-client 11.4.8-r0 → 11.4.11-r0 mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine CVE-2026-44172 mariadb-client 11.4.8-r0 → 11.4.11-r0 mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() CVE-2026-44172 mariadb-common 11.4.8-r0 → 11.4.11-r0 mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() CVE-2026-44172 mysql-client 11.4.8-r0 → 11.4.11-r0 mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string() CVE-2026-48930 nodejs 22.15.1-r0 → 22.23.0-r0 nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling |
| sdnc | artifactory.devops.telekom.de/onap-repo/onap/sdnc-web-image:3.2.4 | 21 | 223 | 163 | CVE-2023-45853 zlib1g 1:1.2.13.dfsg-1 → no fix zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6 CVE-2024-56171 libxml2 2.9.14+dfsg-1.3~deb12u1 → 2.9.14+dfsg-1.3~deb12u2 libxml2: Use-After-Free in libxml2 CVE-2025-68121 stdlib v1.21.11 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-7458 libsqlite3-0 3.40.1-2+deb12u2 → no fix sqlite: SQLite integer overflow CVE-2026-13221 libperl5.36 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl: Perl: Incorrect regular expression processing via large regular expressions CVE-2026-13221 perl 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl: Perl: Incorrect regular expression processing via large regular expressions CVE-2026-13221 perl-base 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl: Perl: Incorrect regular expression processing via large regular expressions CVE-2026-13221 perl-modules-5.36 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl: Perl: Incorrect regular expression processing via large regular expressions CVE-2026-31789 libssl3 3.0.18-1~deb12u2 → 3.0.19-1~deb12u2 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 openssl 3.0.18-1~deb12u2 → 3.0.19-1~deb12u2 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-33845 libgnutls30 3.7.9-2+deb12u2 → 3.7.9-2+deb12u7 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment CVE-2026-42010 libgnutls30 3.7.9-2+deb12u2 → 3.7.9-2+deb12u7 gnutls: gnutls: Authentication Bypass via NUL Character in Username CVE-2026-42496 libperl5.36 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access CVE-2026-42496 perl 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access CVE-2026-42496 perl-base 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access CVE-2026-42496 perl-modules-5.36 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access CVE-2026-6653 libxml2 2.9.14+dfsg-1.3~deb12u1 → no fix libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free CVE-2026-8376 libperl5.36 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds CVE-2026-8376 perl 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds CVE-2026-8376 perl-base 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds CVE-2026-8376 perl-modules-5.36 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds |
| so | artifactory.devops.telekom.de/hub.docker.com/busybox:1.37.0 | 0 | 0 | 0 | |
| so | artifactory.devops.telekom.de/hub.docker.com/mariadb:11.7.2 | 4 | 65 | 69 | CVE-2023-24538 stdlib v1.18.2 → 1.19.8, 1.20.3 golang: html/template: backticks not treated as string delimiters CVE-2023-24540 stdlib v1.18.2 → 1.19.9, 1.20.4 golang: html/template: improper handling of JavaScript whitespace CVE-2024-24790 stdlib v1.18.2 → 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses CVE-2025-68121 stdlib v1.18.2 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption |
| so | artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3 | 0 | 0 | 0 | |
| so | artifactory.devops.telekom.de/onap-repo/onap/so/api-handler-infra:1.22.0 | 9 | 17 | 26 | CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webflux 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-47892 org.springframework:spring-webflux 6.2.19 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass CVE-2026-75595 io.netty:netty-handler 4.1.135.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| so | artifactory.devops.telekom.de/onap-repo/onap/so/bpmn-infra:1.22.0 | 9 | 22 | 31 | CVE-2018-1000844 com.squareup.retrofit2:retrofit 2.3.0 → 2.5.0 retrofit: XML external entity processing vulnerability in JAXB CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-49875 org.apache.cxf:cxf-core 4.0.5 → 4.2.2, 4.1.7, 3.6.12 cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass CVE-2026-75595 io.netty:netty-handler 4.1.135.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| so | artifactory.devops.telekom.de/onap-repo/onap/so/catalog-db-adapter:1.22.0 | 6 | 12 | 18 | CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass |
| so | artifactory.devops.telekom.de/onap-repo/onap/so/openstack-adapter:1.22.0 | 7 | 14 | 21 | CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-49875 org.apache.cxf:cxf-core 4.0.5 → 4.2.2, 4.1.7, 3.6.12 cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass |
| so | artifactory.devops.telekom.de/onap-repo/onap/so/request-db-adapter:1.22.0 | 7 | 16 | 23 | CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-49875 org.apache.cxf:cxf-core 4.0.5 → 4.2.2, 4.1.7, 3.6.12 cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass |
| so | artifactory.devops.telekom.de/onap-repo/onap/so/sdc-controller:1.22.0 | 6 | 12 | 18 | CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass |
| so | artifactory.devops.telekom.de/onap-repo/onap/so/sdnc-adapter:1.22.0 | 7 | 16 | 23 | CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-49875 org.apache.cxf:cxf-core 4.0.5 → 4.2.2, 4.1.7, 3.6.12 cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass |
| so | artifactory.devops.telekom.de/onap-repo/onap/so/so-admin-cockpit:1.10.0 | 25 | 202 | 226 | CVE-2016-1000027 org.springframework:spring-web 5.2.12.RELEASE → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization CVE-2019-20444 io.netty:netty-codec-http 4.1.42.Final → 4.1.44 netty: HTTP request smuggling CVE-2022-22965 org.springframework.boot:spring-boot-starter-web 2.3.7.RELEASE → 2.5.12, 2.6.6 spring-framework: RCE via Data Binding on JDK 9+ CVE-2022-22965 org.springframework:spring-beans 5.2.12.RELEASE → 5.2.20.RELEASE, 5.3.18 spring-framework: RCE via Data Binding on JDK 9+ CVE-2022-22965 org.springframework:spring-webmvc 5.2.12.RELEASE → 5.2.20.RELEASE, 5.3.18 spring-framework: RCE via Data Binding on JDK 9+ CVE-2022-22978 org.springframework.security:spring-security-core 5.3.6.RELEASE → 5.5.7, 5.6.4, 5.4.11 springframework: Authorization Bypass in RegexRequestMatcher CVE-2022-22978 org.springframework.security:spring-security-web 5.3.6.RELEASE → 5.5.7, 5.6.4, 5.4.11 springframework: Authorization Bypass in RegexRequestMatcher CVE-2023-20873 org.springframework.boot:spring-boot-actuator-autoconfigure 2.3.7.RELEASE → 3.0.6, 2.7.11, 2.6.15, 2.5.15 spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry CVE-2024-38821 org.springframework.security:spring-security-web 5.3.6.RELEASE → 5.7.13, 5.8.15, 6.2.7, 6.0.13, 6.1.11, 6.3.4 Spring-WebFlux: Authorization Bypass of Static Resources in WebFlux Applications CVE-2025-24813 org.apache.tomcat.embed:tomcat-embed-core 9.0.41 → 11.0.3, 10.1.35, 9.0.99 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT CVE-2026-22732 org.springframework.security:spring-security-web 5.3.6.RELEASE → 6.5.9, 7.0.4 Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers CVE-2026-31789 libcrypto3 3.3.3-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 libssl3 3.3.3-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 openssl 3.3.3-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-33845 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 9.0.41 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-42010 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: gnutls: Authentication Bypass via NUL Character in Username CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 9.0.41 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 9.0.41 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass CVE-2026-47884 org.springframework:spring-webmvc 5.2.12.RELEASE → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 9.0.41 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 9.0.41 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 9.0.41 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass CVE-2026-75595 io.netty:netty-handler 4.1.42.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext CVE-2026-75595 io.netty:netty-handler 4.1.55.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| so | artifactory.devops.telekom.de/onap-repo/onap/so/so-cnf-adapter:1.17.1 | 8 | 16 | 24 | CVE-2026-33701 io.opentelemetry.javaagent:opentelemetry-javaagent 2.25.0 → 2.26.1 io.opentelemetry.javaagent/opentelemetry-javaagent: OpenTelemetry Java Instrumentation: Remote code execution via deserialization vulnerability in RMI CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-49875 org.apache.cxf:cxf-core 4.0.5 → 4.2.2, 4.1.7, 3.6.12 cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass |
| so | artifactory.devops.telekom.de/onap-repo/onap/so/so-cnfm-as-lcm:1.17.1 | 22 | 203 | 223 | CVE-2022-1996 github.com/emicklei/go-restful v2.9.5+incompatible → 2.16.0 go-restful: Authorization Bypass Through User-Controlled Key CVE-2022-21235 github.com/Masterminds/vcs v1.13.1 → 1.13.2 github.com/Masterminds/vcs: Command Injection via argument injection CVE-2022-23806 stdlib v1.15.7 → 1.16.14, 1.17.7 golang: crypto/elliptic: IsOnCurve returns true for invalid field elements CVE-2022-23806 stdlib v1.16.4 → 1.16.14, 1.17.7 golang: crypto/elliptic: IsOnCurve returns true for invalid field elements CVE-2023-24538 stdlib v1.15.7 → 1.19.8, 1.20.3 golang: html/template: backticks not treated as string delimiters CVE-2023-24538 stdlib v1.16.4 → 1.19.8, 1.20.3 golang: html/template: backticks not treated as string delimiters CVE-2023-24540 stdlib v1.15.7 → 1.19.9, 1.20.4 golang: html/template: improper handling of JavaScript whitespace CVE-2023-24540 stdlib v1.16.4 → 1.19.9, 1.20.4 golang: html/template: improper handling of JavaScript whitespace CVE-2024-24790 stdlib v1.15.7 → 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses CVE-2024-24790 stdlib v1.16.4 → 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses CVE-2025-14813 org.bouncycastle:bcprov-jdk18on 1.76 → 1.80.2, 1.81.1, 1.84 bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly CVE-2025-68121 stdlib v1.15.7 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2025-68121 stdlib v1.16.4 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-33186 google.golang.org/grpc v1.27.1 → 1.79.3 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation CVE-2026-33701 io.opentelemetry.javaagent:opentelemetry-javaagent 2.25.0 → 2.26.1 io.opentelemetry.javaagent/opentelemetry-javaagent: OpenTelemetry Java Instrumentation: Remote code execution via deserialization vulnerability in RMI CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass CVE-2026-8763 org.bouncycastle:bcprov-jdk18on 1.76 → 1.85 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI |
| so | artifactory.devops.telekom.de/onap-repo/onap/so/so-etsi-nfvo-ns-lcm:1.13.1 | 6 | 13 | 19 | CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass |
| so | artifactory.devops.telekom.de/onap-repo/onap/so/so-etsi-sol003-adapter:1.13.1 | 6 | 12 | 18 | CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass |
| so | artifactory.devops.telekom.de/onap-repo/onap/so/so-etsi-sol005-adapter:1.13.1 | 7 | 16 | 23 | CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-49875 org.apache.cxf:cxf-core 4.0.5 → 4.2.2, 4.1.7, 3.6.12 cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass |
| so | artifactory.devops.telekom.de/onap-repo/onap/so/so-nssmf-adapter:1.15.1 | 7 | 16 | 23 | CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-49875 org.apache.cxf:cxf-core 4.0.5 → 4.2.2, 4.1.7, 3.6.12 cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass |
| so | artifactory.devops.telekom.de/onap-repo/onap/so/so-oof-adapter:1.14.1 | 10 | 19 | 29 | CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-47890 org.springframework:spring-webflux 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments CVE-2026-47892 org.springframework:spring-webflux 6.2.19 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints CVE-2026-49875 org.apache.cxf:cxf-core 4.0.5 → 4.2.2, 4.1.7, 3.6.12 cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass CVE-2026-75595 io.netty:netty-handler 4.1.135.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| uui | artifactory.devops.telekom.de/hub.docker.com/alpine/psql:18.6 | 0 | 0 | 0 | |
| uui | artifactory.devops.telekom.de/hub.docker.com/busybox:1.37.0 | 0 | 0 | 0 | |
| uui | artifactory.devops.telekom.de/hub.docker.com/postgres:17.11 | 2 | 86 | 26 | CVE-2025-68121 stdlib v1.24.6 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-6653 libxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3 → no fix libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free |
| uui | artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3 | 0 | 0 | 0 | |
| uui | artifactory.devops.telekom.de/onap-repo/onap/usecase-ui-intent-analysis:16.0.1 | 17 | 104 | 121 | CVE-2015-7501 commons-collections:commons-collections 3.2.1 → 3.2.2 apache-commons-collections: InvokerTransformer code execution during deserialisation CVE-2017-7657 org.eclipse.jetty:jetty-server 9.3.12.v20160915 → 9.2.25.v20180606, 9.3.24.v20180605 jetty: HTTP request smuggling CVE-2017-7658 org.eclipse.jetty:jetty-server 9.3.12.v20160915 → 9.2.25.v20180606, 9.3.24.v20180605, 9.4.11.v20180605 jetty: Incorrect header handling CVE-2022-36437 com.hazelcast:hazelcast 3.7.2 → 3.12.13, 4.1.10, 4.2.6, 5.0.4, 5.1.3 hazelcast: Hazelcast connection caching CVE-2022-42889 org.apache.commons:commons-text 1.9 → 1.10.0 apache-commons-text: variable interpolation RCE CVE-2024-45491 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: Integer Overflow or Wraparound CVE-2024-45492 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: integer overflow CVE-2025-24813 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 11.0.3, 10.1.35, 9.0.99 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT CVE-2026-107726 com.hazelcast:hazelcast 3.7.2 → 5.7.0 com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass CVE-2026-47884 org.springframework:spring-webmvc 6.0.12 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass CVE-2026-75595 io.netty:netty-handler 4.1.97.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| uui | artifactory.devops.telekom.de/onap-repo/onap/usecase-ui-llm-adaptation:16.0.1 | 4 | 62 | 66 | CVE-2024-45491 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: Integer Overflow or Wraparound CVE-2024-45492 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: integer overflow CVE-2026-47892 org.springframework:spring-webflux 6.0.12 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints CVE-2026-75595 io.netty:netty-handler 4.1.97.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| uui | artifactory.devops.telekom.de/onap-repo/onap/usecase-ui-nlp:1.0.5 | 14 | 168 | 181 | CVE-2020-13092 scikit-learn 0.21.2 → no fix scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute ... CVE-2021-41208 tensorflow 1.14.0 → 2.6.1, 2.5.2, 2.4.4 Incomplete validation in boosted trees code CVE-2022-21797 joblib 0.13.2 → 1.2.0 The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary ... CVE-2022-22817 Pillow 8.4.0 → 9.0.1 python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions CVE-2022-45907 torch 1.10.1+cpu → 1.13.1 In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line c ... CVE-2023-25668 tensorflow 1.14.0 → 2.11.1 CVE-2023-25668 affecting package tensorflow for versions less than 2.11.1-1 CVE-2023-50447 Pillow 8.4.0 → 10.2.0 pillow: Arbitrary Code Execution via the environment parameter CVE-2025-32434 torch 1.10.1+cpu → 2.6.0 PyTorch is a Python package that provides tensor computation with stro ... CVE-2026-112393 Pillow 8.4.0 → 13.0.0 Pillow is a Python imaging library. From 2.0.0 until 13.0.0, Pillow ha ... CVE-2026-112398 Pillow 8.4.0 → 13.0.0 Pillow is a Python imaging library. Prior to 13.0.0, Pillow's FlashPix ... CVE-2026-112403 Pillow 8.4.0 → 13.0.0 Pillow is a Python imaging library. Prior to 13.0.0, Pillow's JPEG dec ... CVE-2026-112900 Pillow 8.4.0 → 13.0.0 Pillow is a Python imaging library. From 2.6.0 until 13.0.0, Pillow is ... GHSA-6q48-6c7w-9gw2 certifi 2023.5.7 → 2026.10.18 certifi bundles emSign root CAs with compromised intermediate CA keys GHSA-h6gw-r52c-724r tensorflow 1.14.0 → 2.5.3, 2.6.3, 2.7.1 NULL Pointer Dereference and Access of Uninitialized Pointer in TensorFlow |
| uui | artifactory.devops.telekom.de/onap-repo/onap/usecase-ui-server:16.0.1 | 10 | 63 | 73 | CVE-2024-45491 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: Integer Overflow or Wraparound CVE-2024-45492 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: integer overflow CVE-2025-24813 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 11.0.3, 10.1.35, 9.0.99 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass CVE-2026-47884 org.springframework:spring-webmvc 6.0.12 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass |
| uui | artifactory.devops.telekom.de/onap-repo/onap/usecase-ui:16.0.1 | 11 | 38 | 49 | CVE-2024-45491 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: Integer Overflow or Wraparound CVE-2024-45492 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: integer overflow CVE-2024-52316 org.apache.tomcat:tomcat-catalina 10.1.2 → 9.0.96, 10.1.30, 11.0.1 tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API CVE-2025-24813 org.apache.tomcat:tomcat-catalina 10.1.2 → 11.0.3, 10.1.35, 9.0.99 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT CVE-2026-41293 org.apache.tomcat:tomcat-coyote 10.1.2 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated CVE-2026-43512 org.apache.tomcat:tomcat-catalina 10.1.2 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication CVE-2026-43515 org.apache.tomcat:tomcat-catalina 10.1.2 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass CVE-2026-53434 org.apache.tomcat:tomcat-util 10.1.2 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Error condition not handled when configuring CRLs CVE-2026-65182 org.apache.tomcat:tomcat-catalina 10.1.2 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control CVE-2026-65905 org.apache.tomcat:tomcat-catalina 10.1.2 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator CVE-2026-68525 org.apache.tomcat:tomcat-catalina 10.1.2 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass |
| k8ssandra (datastore) | artifactory.devops.telekom.de/hub.docker.com/thelastpickle/cassandra-reaper:3.8.0 | 3 | 47 | 50 | CVE-2026-31789 libcrypto3 3.3.2-r4 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 libssl3 3.3.2-r4 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-75595 io.netty:netty-handler 4.1.94.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| kafka (datastore) | quay.io/strimzi/kafka-bridge:0.31.1 | 2 | 137 | 124 | CVE-2026-114406 ca-certificates 2024.2.69_v8.0.303-91.4.el9_4 → 2026.2.92_v9.0.319-90.3.el9_8 ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-75595 io.netty:netty-handler 4.1.115.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| kafka (datastore) | quay.io/strimzi/kafka:0.45.0-kafka-3.9.0 | 4 | 237 | 217 | CVE-2025-68121 stdlib v1.23.0 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption CVE-2026-114406 ca-certificates 2024.2.69_v8.0.303-91.4.el9_4 → 2026.2.92_v9.0.319-90.3.el9_8 ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns CVE-2026-75595 io.netty:netty-handler 4.1.100.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext CVE-2026-75595 io.netty:netty-handler 4.1.111.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext |
| mariadb (datastore) | artifactory.devops.telekom.de/hub.docker.com/mariadb:11.7.2 | 4 | 65 | 69 | CVE-2023-24538 stdlib v1.18.2 → 1.19.8, 1.20.3 golang: html/template: backticks not treated as string delimiters CVE-2023-24540 stdlib v1.18.2 → 1.19.9, 1.20.4 golang: html/template: improper handling of JavaScript whitespace CVE-2024-24790 stdlib v1.18.2 → 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses CVE-2025-68121 stdlib v1.18.2 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption |
| mariadb (datastore) | docker-registry3.mariadb.com/mariadb-operator/mariadb-operator:0.38.1 | 1 | 47 | 48 | CVE-2025-68121 stdlib v1.24.2 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption |
| redis (datastore) | public.ecr.aws/docker/library/redis:8.2.2-alpine | 2 | 25 | 27 | CVE-2026-31789 libcrypto3 3.5.4-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing CVE-2026-31789 libssl3 3.5.4-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing |