{ "images_total": 111, "images_scanned": 111, "not_scanned": [], "not_scanned_reasons": {}, "excluded": [ "artifactory.devops.telekom.de/hub.docker.com/istio/proxyv2:*" ], "components": [ { "name": "a1policymanagement", "datastore": false, "images": [ { "critical": 11, "high": 73, "fixable_critical": 11, "fixable_high": 73, "cves": [ { "id": "CVE-2026-31789", "package": "libcrypto3", "installed": "3.5.4-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "libssl3", "installed": "3.5.4-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.46", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "link": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.46", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "link": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.46", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webflux", "installed": "6.2.11", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-47892", "package": "org.springframework:spring-webflux", "installed": "6.2.11", "fixed": "7.0.9", "title": "org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints", "link": "https://avd.aquasec.com/nvd/cve-2026-47892" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.46", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.46", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.46", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.127.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/ccsdk-oran-a1policymanagementservice:2.2.0" } ] }, { "name": "aai", "datastore": false, "images": [ { "critical": 2, "high": 25, "fixable_critical": 2, "fixable_high": 25, "cves": [ { "id": "CVE-2026-31789", "package": "libcrypto3", "installed": "3.5.0-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "libssl3", "installed": "3.5.0-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" } ], "ref": "artifactory.devops.telekom.de/hub.docker.com/curlimages/curl:8.14.1" }, { "critical": 8, "high": 54, "fixable_critical": 8, "fixable_high": 54, "cves": [ { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r0", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.56", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.56", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.56", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.56", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.136.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/aai-graphadmin:1.18.0" }, { "critical": 3, "high": 28, "fixable_critical": 3, "fixable_high": 28, "cves": [ { "id": "CVE-2026-31789", "package": "libcrypto3", "installed": "3.3.2-r1", "fixed": "3.3.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "libssl3", "installed": "3.3.2-r1", "fixed": "3.3.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "openssl", "installed": "3.3.2-r1", "fixed": "3.3.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/aai-haproxy:1.15.2" }, { "critical": 9, "high": 35, "fixable_critical": 9, "fixable_high": 35, "cves": [ { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r0", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-33701", "package": "io.opentelemetry.javaagent:opentelemetry-javaagent", "installed": "2.24.0", "fixed": "2.26.1", "title": "io.opentelemetry.javaagent/opentelemetry-javaagent: OpenTelemetry Java Instrumentation: Remote code execution via deserialization vulnerability in RMI", "link": "https://avd.aquasec.com/nvd/cve-2026-33701" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.56", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.56", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.56", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.56", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.136.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/aai-resources:1.18.0" }, { "critical": 14, "high": 118, "fixable_critical": 14, "fixable_high": 118, "cves": [ { "id": "CVE-2025-24813", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.24", "fixed": "11.0.3, 10.1.35, 9.0.99", "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "link": "https://avd.aquasec.com/nvd/cve-2025-24813" }, { "id": "CVE-2026-31789", "package": "libcrypto3", "installed": "3.5.5-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "libssl3", "installed": "3.5.5-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "openssl", "installed": "3.5.5-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-33845", "package": "gnutls", "installed": "3.8.8-r0", "fixed": "3.8.13-r0", "title": "gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment", "link": "https://avd.aquasec.com/nvd/cve-2026-33845" }, { "id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.24", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "link": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "id": "CVE-2026-42010", "package": "gnutls", "installed": "3.8.8-r0", "fixed": "3.8.13-r0", "title": "gnutls: gnutls: Authentication Bypass via NUL Character in Username", "link": "https://avd.aquasec.com/nvd/cve-2026-42010" }, { "id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.24", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "link": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.24", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.0.21", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.24", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.24", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.24", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.110.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/aai-schema-service:1.14.0" }, { "critical": 8, "high": 54, "fixable_critical": 8, "fixable_high": 54, "cves": [ { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r0", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.56", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.56", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.56", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.56", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.136.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/aai-traversal:1.18.0" }, { "critical": 6, "high": 82, "fixable_critical": 6, "fixable_high": 82, "cves": [ { "id": "CVE-2026-31789", "package": "libcrypto3", "installed": "3.5.4-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "libssl3", "installed": "3.5.4-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "openssl", "installed": "3.5.4-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-33845", "package": "gnutls", "installed": "3.8.8-r0", "fixed": "3.8.13-r0", "title": "gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment", "link": "https://avd.aquasec.com/nvd/cve-2026-33845" }, { "id": "CVE-2026-42010", "package": "gnutls", "installed": "3.8.8-r0", "fixed": "3.8.13-r0", "title": "gnutls: gnutls: Authentication Bypass via NUL Character in Username", "link": "https://avd.aquasec.com/nvd/cve-2026-42010" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.0.21", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/babel:1.14.0" }, { "critical": 6, "high": 92, "fixable_critical": 6, "fixable_high": 90, "cves": [ { "id": "CVE-2026-31789", "package": "libcrypto3", "installed": "3.5.4-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "libssl3", "installed": "3.5.4-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "openssl", "installed": "3.5.4-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-33845", "package": "gnutls", "installed": "3.8.8-r0", "fixed": "3.8.13-r0", "title": "gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment", "link": "https://avd.aquasec.com/nvd/cve-2026-33845" }, { "id": "CVE-2026-42010", "package": "gnutls", "installed": "3.8.8-r0", "fixed": "3.8.13-r0", "title": "gnutls: gnutls: Authentication Bypass via NUL Character in Username", "link": "https://avd.aquasec.com/nvd/cve-2026-42010" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.0.21", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/model-loader:1.15.0" }, { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3" }, { "critical": 3, "high": 20, "fixable_critical": 3, "fixable_high": 20, "cves": [ { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r1", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/sparky-be:3.0.0" } ] }, { "name": "cassandra", "datastore": false, "images": [ { "critical": 6, "high": 168, "fixable_critical": 6, "fixable_high": 150, "cves": [ { "id": "CVE-2024-47561", "package": "org.apache.avro:avro", "installed": "1.10.2", "fixed": "1.11.4", "title": "apache-avro: Schema parsing may trigger Remote Code Execution (RCE)", "link": "https://avd.aquasec.com/nvd/cve-2024-47561" }, { "id": "CVE-2024-53990", "package": "org.asynchttpclient:async-http-client", "installed": "2.12.1", "fixed": "2.12.4, 3.0.1", "title": "async-http-client: AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s", "link": "https://avd.aquasec.com/nvd/cve-2024-53990" }, { "id": "CVE-2026-107282", "package": "org.asynchttpclient:async-http-client", "installed": "2.12.1", "fixed": "3.0.13, 2.16.1", "title": "org.asynchttpclient/async-http-client: AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host", "link": "https://avd.aquasec.com/nvd/cve-2026-107282" }, { "id": "CVE-2026-114406", "package": "ca-certificates", "installed": "2024.2.69_v8.0.303-80.0.el8_10", "fixed": "2026.2.92_v9.0.319-81.3.el8_10", "title": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns", "link": "https://avd.aquasec.com/nvd/cve-2026-114406" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.124.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.86.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "dockerhub.devops.telekom.de/k8ssandra/cass-management-api:4.1.8-ubi8" }, { "critical": 4, "high": 108, "fixable_critical": 4, "fixable_high": 95, "cves": [ { "id": "CVE-2024-41110", "package": "github.com/docker/docker", "installed": "v24.0.7+incompatible", "fixed": "23.0.15, 26.1.5, 27.1.1, 25.0.6", "title": "moby: Authz zero length regression", "link": "https://avd.aquasec.com/nvd/cve-2024-41110" }, { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.22.5", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2026-114406", "package": "ca-certificates", "installed": "2023.2.60_v7.0.306-80.0.el8_8", "fixed": "2026.2.92_v9.0.319-81.3.el8_10", "title": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns", "link": "https://avd.aquasec.com/nvd/cve-2026-114406" }, { "id": "CVE-2026-33186", "package": "google.golang.org/grpc", "installed": "v1.58.3", "fixed": "1.79.3", "title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation", "link": "https://avd.aquasec.com/nvd/cve-2026-33186" } ], "ref": "dockerhub.devops.telekom.de/k8ssandra/k8ssandra-client:v0.5.0" }, { "critical": 0, "high": 4, "fixable_critical": 0, "fixable_high": 4, "cves": [], "ref": "dockerhub.devops.telekom.de/k8ssandra/system-logger:v1.22.4" } ] }, { "name": "cds", "datastore": false, "images": [ { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/hub.docker.com/busybox:1.37.0" }, { "critical": 2, "high": 87, "fixable_critical": 1, "fixable_high": 25, "cves": [ { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.24.6", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2026-6653", "package": "libxml2", "installed": "2.12.7+dfsg+really2.9.14-2.1+deb13u3", "fixed": "", "title": "libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free", "link": "https://avd.aquasec.com/nvd/cve-2026-6653" } ], "ref": "artifactory.devops.telekom.de/hub.docker.com/postgres:17.11" }, { "critical": 4, "high": 44, "fixable_critical": 4, "fixable_high": 42, "cves": [ { "id": "CVE-2026-107726", "package": "com.hazelcast:hazelcast", "installed": "5.4.0", "fixed": "5.7.0", "title": "com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client", "link": "https://avd.aquasec.com/nvd/cve-2026-107726" }, { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r1", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webflux", "installed": "6.2.11", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-47892", "package": "org.springframework:spring-webflux", "installed": "6.2.11", "fixed": "7.0.9", "title": "org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints", "link": "https://avd.aquasec.com/nvd/cve-2026-47892" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/ccsdk-blueprintsprocessor:1.11.0" }, { "critical": 11, "high": 162, "fixable_critical": 8, "fixable_high": 132, "cves": [ { "id": "CVE-2019-10744", "package": "lodash", "installed": "3.10.1", "fixed": "4.17.12", "title": "nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties", "link": "https://avd.aquasec.com/nvd/cve-2019-10744" }, { "id": "CVE-2019-8457", "package": "libdb5.3", "installed": "5.3.28+dfsg1-0.5", "fixed": "", "title": "sqlite: heap out-of-bound read in function rtreenode()", "link": "https://avd.aquasec.com/nvd/cve-2019-8457" }, { "id": "CVE-2021-44906", "package": "minimist", "installed": "0.0.10", "fixed": "1.2.6, 0.2.4", "title": "minimist: prototype pollution", "link": "https://avd.aquasec.com/nvd/cve-2021-44906" }, { "id": "CVE-2022-29078", "package": "ejs", "installed": "2.7.4", "fixed": "3.1.7", "title": "ejs: server-side template injection in outputFunctionName", "link": "https://avd.aquasec.com/nvd/cve-2022-29078" }, { "id": "CVE-2023-45853", "package": "zlib1g", "installed": "1:1.2.11.dfsg-1+deb10u2", "fixed": "", "title": "zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6", "link": "https://avd.aquasec.com/nvd/cve-2023-45853" }, { "id": "CVE-2024-21534", "package": "jsonpath-plus", "installed": "1.1.0", "fixed": "10.2.0", "title": "jsonpath-plus: Remote Code Execution in jsonpath-plus via Improper Input Sanitization", "link": "https://avd.aquasec.com/nvd/cve-2024-21534" }, { "id": "CVE-2024-57077", "package": "utils-extend", "installed": "1.0.8", "fixed": "", "title": "utils-extend Prototype Pollution", "link": "https://avd.aquasec.com/nvd/cve-2024-57077" }, { "id": "CVE-2025-7783", "package": "form-data", "installed": "2.3.3", "fixed": "2.5.4, 3.0.4, 4.0.4", "title": "form-data: Unsafe random function in form-data", "link": "https://avd.aquasec.com/nvd/cve-2025-7783" }, { "id": "CVE-2026-41242", "package": "protobufjs", "installed": "6.11.6", "fixed": "8.0.1, 7.5.5", "title": "protobufjs: protobufjs: Arbitrary code execution via injected protobuf definition type fields", "link": "https://avd.aquasec.com/nvd/cve-2026-41242" }, { "id": "CVE-2026-59873", "package": "tar", "installed": "6.1.11", "fixed": "7.5.19", "title": "tar: node-tar: Denial of Service via crafted gzip bomb", "link": "https://avd.aquasec.com/nvd/cve-2026-59873" }, { "id": "CVE-2026-59873", "package": "tar", "installed": "6.1.11", "fixed": "7.5.19", "title": "tar: node-tar: Denial of Service via crafted gzip bomb", "link": "https://avd.aquasec.com/nvd/cve-2026-59873" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/ccsdk-cds-ui-server:1.11.0" }, { "critical": 3, "high": 78, "fixable_critical": 1, "fixable_high": 28, "cves": [ { "id": "CVE-2023-45853", "package": "zlib1g", "installed": "1:1.2.13.dfsg-1", "fixed": "", "title": "zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6", "link": "https://avd.aquasec.com/nvd/cve-2023-45853" }, { "id": "CVE-2025-7458", "package": "libsqlite3-0", "installed": "3.40.1-2+deb12u2", "fixed": "", "title": "sqlite: SQLite integer overflow", "link": "https://avd.aquasec.com/nvd/cve-2025-7458" }, { "id": "CVE-2026-111497", "package": "libbrotli1", "installed": "1.0.9-2+b6", "fixed": "1.0.9-2+deb12u1", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/ccsdk-commandexecutor:1.11.0" }, { "critical": 2, "high": 72, "fixable_critical": 0, "fixable_high": 34, "cves": [ { "id": "CVE-2023-45853", "package": "zlib1g", "installed": "1:1.2.13.dfsg-1", "fixed": "", "title": "zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6", "link": "https://avd.aquasec.com/nvd/cve-2023-45853" }, { "id": "CVE-2025-7458", "package": "libsqlite3-0", "installed": "3.40.1-2+deb12u2", "fixed": "", "title": "sqlite: SQLite integer overflow", "link": "https://avd.aquasec.com/nvd/cve-2025-7458" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/ccsdk-py-executor:1.11.0" }, { "critical": 4, "high": 36, "fixable_critical": 4, "fixable_high": 34, "cves": [ { "id": "CVE-2026-107726", "package": "com.hazelcast:hazelcast", "installed": "5.5.0", "fixed": "5.7.0", "title": "com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client", "link": "https://avd.aquasec.com/nvd/cve-2026-107726" }, { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r1", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webflux", "installed": "6.2.11", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-47892", "package": "org.springframework:spring-webflux", "installed": "6.2.11", "fixed": "7.0.9", "title": "org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints", "link": "https://avd.aquasec.com/nvd/cve-2026-47892" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/ccsdk-sdclistener:1.11.0" }, { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3" } ] }, { "name": "cps", "datastore": false, "images": [ { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/hub.docker.com/alpine/psql:18.6" }, { "critical": 11, "high": 210, "fixable_critical": 11, "fixable_high": 209, "cves": [ { "id": "CVE-2023-24538", "package": "stdlib", "installed": "v1.18.2", "fixed": "1.19.8, 1.20.3", "title": "golang: html/template: backticks not treated as string delimiters", "link": "https://avd.aquasec.com/nvd/cve-2023-24538" }, { "id": "CVE-2023-24540", "package": "stdlib", "installed": "v1.18.2", "fixed": "1.19.9, 1.20.4", "title": "golang: html/template: improper handling of JavaScript whitespace", "link": "https://avd.aquasec.com/nvd/cve-2023-24540" }, { "id": "CVE-2024-24790", "package": "stdlib", "installed": "v1.18.2", "fixed": "1.21.11, 1.22.4", "title": "golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses", "link": "https://avd.aquasec.com/nvd/cve-2024-24790" }, { "id": "CVE-2024-45491", "package": "libexpat", "installed": "2.6.2-r0", "fixed": "2.6.3-r0", "title": "libexpat: Integer Overflow or Wraparound", "link": "https://avd.aquasec.com/nvd/cve-2024-45491" }, { "id": "CVE-2024-45492", "package": "libexpat", "installed": "2.6.2-r0", "fixed": "2.6.3-r0", "title": "libexpat: integer overflow", "link": "https://avd.aquasec.com/nvd/cve-2024-45492" }, { "id": "CVE-2024-56171", "package": "libxml2", "installed": "2.12.7-r0", "fixed": "2.12.7-r1", "title": "libxml2: Use-After-Free in libxml2", "link": "https://avd.aquasec.com/nvd/cve-2024-56171" }, { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.18.2", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.22.4", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.22.4", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2026-31789", "package": "libcrypto3", "installed": "3.3.1-r3", "fixed": "3.3.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "libssl3", "installed": "3.3.1-r3", "fixed": "3.3.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" } ], "ref": "artifactory.devops.telekom.de/hub.docker.com/timescale/timescaledb:2.16.1-pg14" }, { "critical": 8, "high": 76, "fixable_critical": 8, "fixable_high": 74, "cves": [ { "id": "CVE-2024-45491", "package": "libexpat", "installed": "2.5.0-r0", "fixed": "2.6.3-r0", "title": "libexpat: Integer Overflow or Wraparound", "link": "https://avd.aquasec.com/nvd/cve-2024-45491" }, { "id": "CVE-2024-45492", "package": "libexpat", "installed": "2.5.0-r0", "fixed": "2.6.3-r0", "title": "libexpat: integer overflow", "link": "https://avd.aquasec.com/nvd/cve-2024-45492" }, { "id": "CVE-2026-107726", "package": "com.hazelcast:hazelcast", "installed": "5.5.0", "fixed": "5.7.0", "title": "com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client", "link": "https://avd.aquasec.com/nvd/cve-2026-107726" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.2.9", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webflux", "installed": "6.2.9", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "6.2.9", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-47892", "package": "org.springframework:spring-webflux", "installed": "6.2.9", "fixed": "7.0.9", "title": "org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints", "link": "https://avd.aquasec.com/nvd/cve-2026-47892" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.123.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/cps-and-ncmp:3.7.0" }, { "critical": 22, "high": 103, "fixable_critical": 22, "fixable_high": 99, "cves": [ { "id": "CVE-2016-1000027", "package": "org.springframework:spring-web", "installed": "5.3.21", "fixed": "6.0.0", "title": "spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization", "link": "https://avd.aquasec.com/nvd/cve-2016-1000027" }, { "id": "CVE-2021-36159", "package": "apk-tools", "installed": "2.10.5-r1", "fixed": "2.10.7-r0", "title": "libfetch: an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes leads to information leak or crash", "link": "https://avd.aquasec.com/nvd/cve-2021-36159" }, { "id": "CVE-2021-3711", "package": "libcrypto1.1", "installed": "1.1.1g-r0", "fixed": "1.1.1l-r0", "title": "openssl: SM2 Decryption Buffer Overflow", "link": "https://avd.aquasec.com/nvd/cve-2021-3711" }, { "id": "CVE-2021-3711", "package": "libssl1.1", "installed": "1.1.1g-r0", "fixed": "1.1.1l-r0", "title": "openssl: SM2 Decryption Buffer Overflow", "link": "https://avd.aquasec.com/nvd/cve-2021-3711" }, { "id": "CVE-2021-3711", "package": "openssl", "installed": "1.1.1i-r0", "fixed": "1.1.1l-r0", "title": "openssl: SM2 Decryption Buffer Overflow", "link": "https://avd.aquasec.com/nvd/cve-2021-3711" }, { "id": "CVE-2022-31692", "package": "org.springframework.security:spring-security-core", "installed": "5.6.6", "fixed": "5.7.5, 5.6.9", "title": "spring-security: Authorization rules can be bypassed via forward or include dispatcher types in Spring Security", "link": "https://avd.aquasec.com/nvd/cve-2022-31692" }, { "id": "CVE-2022-37434", "package": "zlib", "installed": "1.2.11-r3", "fixed": "1.2.12-r2", "title": "zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field", "link": "https://avd.aquasec.com/nvd/cve-2022-37434" }, { "id": "CVE-2022-42889", "package": "org.apache.commons:commons-text", "installed": "1.9", "fixed": "1.10.0", "title": "apache-commons-text: variable interpolation RCE", "link": "https://avd.aquasec.com/nvd/cve-2022-42889" }, { "id": "CVE-2023-20860", "package": "org.springframework:spring-webmvc", "installed": "5.3.21", "fixed": "6.0.7, 5.3.26", "title": "springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern", "link": "https://avd.aquasec.com/nvd/cve-2023-20860" }, { "id": "CVE-2023-20873", "package": "org.springframework.boot:spring-boot-actuator-autoconfigure", "installed": "2.6.9", "fixed": "3.0.6, 2.7.11, 2.6.15, 2.5.15", "title": "spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry", "link": "https://avd.aquasec.com/nvd/cve-2023-20873" }, { "id": "CVE-2023-34034", "package": "org.springframework.security:spring-security-config", "installed": "5.6.6", "fixed": "5.6.12, 5.7.10, 5.8.5, 6.0.5, 6.1.2", "title": "spring-security-webflux: path wildcard leads to security bypass", "link": "https://avd.aquasec.com/nvd/cve-2023-34034" }, { "id": "CVE-2024-1597", "package": "org.postgresql:postgresql", "installed": "42.3.6", "fixed": "42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2", "title": "pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE", "link": "https://avd.aquasec.com/nvd/cve-2024-1597" }, { "id": "CVE-2024-38821", "package": "org.springframework.security:spring-security-web", "installed": "5.6.6", "fixed": "5.7.13, 5.8.15, 6.2.7, 6.0.13, 6.1.11, 6.3.4", "title": "Spring-WebFlux: Authorization Bypass of Static Resources in WebFlux Applications", "link": "https://avd.aquasec.com/nvd/cve-2024-38821" }, { "id": "CVE-2025-24813", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.64", "fixed": "11.0.3, 10.1.35, 9.0.99", "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "link": "https://avd.aquasec.com/nvd/cve-2025-24813" }, { "id": "CVE-2026-22732", "package": "org.springframework.security:spring-security-web", "installed": "5.6.6", "fixed": "6.5.9, 7.0.4", "title": "Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers", "link": "https://avd.aquasec.com/nvd/cve-2026-22732" }, { "id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.64", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "link": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.64", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "link": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.64", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "5.3.21", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.64", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.64", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.64", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/cps-temporal:1.2.1" }, { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3" } ] }, { "name": "dcae", "datastore": false, "images": [ { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/hub.docker.com/busybox:1.37.0" }, { "critical": 2, "high": 87, "fixable_critical": 1, "fixable_high": 25, "cves": [ { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.24.6", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2026-6653", "package": "libxml2", "installed": "2.12.7+dfsg+really2.9.14-2.1+deb13u3", "fixed": "", "title": "libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free", "link": "https://avd.aquasec.com/nvd/cve-2026-6653" } ], "ref": "artifactory.devops.telekom.de/hub.docker.com/postgres:17.11" }, { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3" }, { "critical": 7, "high": 97, "fixable_critical": 7, "fixable_high": 95, "cves": [ { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r0", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-31789", "package": "libcrypto3", "installed": "3.5.5-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "libssl3", "installed": "3.5.5-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "openssl", "installed": "3.5.5-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-33845", "package": "gnutls", "installed": "3.8.11-r0", "fixed": "3.8.13-r0", "title": "gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment", "link": "https://avd.aquasec.com/nvd/cve-2026-33845" }, { "id": "CVE-2026-42010", "package": "gnutls", "installed": "3.8.11-r0", "fixed": "3.8.13-r0", "title": "gnutls: gnutls: Authentication Bypass via NUL Character in Username", "link": "https://avd.aquasec.com/nvd/cve-2026-42010" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.79.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.collectors.hv-ves.hv-collector-main:1.11.1" }, { "critical": 18, "high": 144, "fixable_critical": 18, "fixable_high": 141, "cves": [ { "id": "CVE-2016-1000027", "package": "org.springframework:spring-web", "installed": "5.3.22", "fixed": "6.0.0", "title": "spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization", "link": "https://avd.aquasec.com/nvd/cve-2016-1000027" }, { "id": "CVE-2022-42889", "package": "org.apache.commons:commons-text", "installed": "1.9", "fixed": "1.10.0", "title": "apache-commons-text: variable interpolation RCE", "link": "https://avd.aquasec.com/nvd/cve-2022-42889" }, { "id": "CVE-2023-20860", "package": "org.springframework:spring-webmvc", "installed": "5.3.22", "fixed": "6.0.7, 5.3.26", "title": "springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern", "link": "https://avd.aquasec.com/nvd/cve-2023-20860" }, { "id": "CVE-2025-24813", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.65", "fixed": "11.0.3, 10.1.35, 9.0.99", "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "link": "https://avd.aquasec.com/nvd/cve-2025-24813" }, { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r0", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-31789", "package": "libcrypto3", "installed": "3.5.5-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "libssl3", "installed": "3.5.5-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "openssl", "installed": "3.5.5-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-33845", "package": "gnutls", "installed": "3.8.11-r0", "fixed": "3.8.13-r0", "title": "gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment", "link": "https://avd.aquasec.com/nvd/cve-2026-33845" }, { "id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.65", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "link": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "id": "CVE-2026-42010", "package": "gnutls", "installed": "3.8.11-r0", "fixed": "3.8.13-r0", "title": "gnutls: gnutls: Authentication Bypass via NUL Character in Username", "link": "https://avd.aquasec.com/nvd/cve-2026-42010" }, { "id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.65", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "link": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.65", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "5.3.22", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.65", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.65", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.65", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.73.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.collectors.ves.vescollector:1.12.6" }, { "critical": 1, "high": 43, "fixable_critical": 1, "fixable_high": 42, "cves": [ { "id": "CVE-2026-59873", "package": "tar", "installed": "6.1.15", "fixed": "7.5.19", "title": "tar: node-tar: Denial of Service via crafted gzip bomb", "link": "https://avd.aquasec.com/nvd/cve-2026-59873" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.deployments.healthcheck-container:2.4.1" }, { "critical": 15, "high": 93, "fixable_critical": 15, "fixable_high": 90, "cves": [ { "id": "CVE-2016-1000027", "package": "org.springframework:spring-web", "installed": "5.3.22", "fixed": "6.0.0", "title": "spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization", "link": "https://avd.aquasec.com/nvd/cve-2016-1000027" }, { "id": "CVE-2021-36159", "package": "apk-tools", "installed": "2.10.5-r1", "fixed": "2.10.7-r0", "title": "libfetch: an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes leads to information leak or crash", "link": "https://avd.aquasec.com/nvd/cve-2021-36159" }, { "id": "CVE-2021-3711", "package": "libcrypto1.1", "installed": "1.1.1g-r0", "fixed": "1.1.1l-r0", "title": "openssl: SM2 Decryption Buffer Overflow", "link": "https://avd.aquasec.com/nvd/cve-2021-3711" }, { "id": "CVE-2021-3711", "package": "libssl1.1", "installed": "1.1.1g-r0", "fixed": "1.1.1l-r0", "title": "openssl: SM2 Decryption Buffer Overflow", "link": "https://avd.aquasec.com/nvd/cve-2021-3711" }, { "id": "CVE-2021-3711", "package": "openssl", "installed": "1.1.1i-r0", "fixed": "1.1.1l-r0", "title": "openssl: SM2 Decryption Buffer Overflow", "link": "https://avd.aquasec.com/nvd/cve-2021-3711" }, { "id": "CVE-2022-37434", "package": "zlib", "installed": "1.2.11-r3", "fixed": "1.2.12-r2", "title": "zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field", "link": "https://avd.aquasec.com/nvd/cve-2022-37434" }, { "id": "CVE-2023-20860", "package": "org.springframework:spring-webmvc", "installed": "5.3.22", "fixed": "6.0.7, 5.3.26", "title": "springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern", "link": "https://avd.aquasec.com/nvd/cve-2023-20860" }, { "id": "CVE-2025-24813", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.65", "fixed": "11.0.3, 10.1.35, 9.0.99", "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "link": "https://avd.aquasec.com/nvd/cve-2025-24813" }, { "id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.65", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "link": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.65", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "link": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.65", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "5.3.22", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.65", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.65", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.65", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.platform.ves-openapi-manager:1.3.1" }, { "critical": 11, "high": 47, "fixable_critical": 11, "fixable_high": 44, "cves": [ { "id": "CVE-2016-1000027", "package": "org.springframework:spring-web", "installed": "5.3.31", "fixed": "6.0.0", "title": "spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization", "link": "https://avd.aquasec.com/nvd/cve-2016-1000027" }, { "id": "CVE-2024-1597", "package": "org.postgresql:postgresql", "installed": "42.2.18", "fixed": "42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2", "title": "pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE", "link": "https://avd.aquasec.com/nvd/cve-2024-1597" }, { "id": "CVE-2025-24813", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.83", "fixed": "11.0.3, 10.1.35, 9.0.99", "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "link": "https://avd.aquasec.com/nvd/cve-2025-24813" }, { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r1", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.83", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "link": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.83", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "link": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.83", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "5.3.31", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.83", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.83", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.83", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.services.datalake.exposure.service:1.2.0" }, { "critical": 2, "high": 61, "fixable_critical": 1, "fixable_high": 0, "cves": [ { "id": "CVE-2026-111497", "package": "libbrotli1", "installed": "1.1.0-2+b7", "fixed": "1.1.0-2+deb13u1", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-6653", "package": "libxml2", "installed": "2.12.7+dfsg+really2.9.14-2.1+deb13u3", "fixed": "", "title": "libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free", "link": "https://avd.aquasec.com/nvd/cve-2026-6653" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.services.datalakeadminui:1.2.0" }, { "critical": 27, "high": 239, "fixable_critical": 26, "fixable_high": 232, "cves": [ { "id": "CVE-2014-125087", "package": "com.jamesmurty.utils:java-xmlbuilder", "installed": "1.1", "fixed": "1.2", "title": "java-xmlbuilder: XMLBuilder2 is vulnerable to XML External Entity (XXE) injection", "link": "https://avd.aquasec.com/nvd/cve-2014-125087" }, { "id": "CVE-2015-1832", "package": "org.apache.derby:derby", "installed": "10.11.1.1", "fixed": "10.12.1.1", "title": "Derby: XXE attack possible by using XmlVTI and the XML datatype", "link": "https://avd.aquasec.com/nvd/cve-2015-1832" }, { "id": "CVE-2016-1000027", "package": "org.springframework:spring-web", "installed": "5.3.31", "fixed": "6.0.0", "title": "spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization", "link": "https://avd.aquasec.com/nvd/cve-2016-1000027" }, { "id": "CVE-2017-1000487", "package": "org.codehaus.plexus:plexus-utils", "installed": "3.0.15", "fixed": "3.0.16", "title": "plexus-utils: Mishandled strings in Commandline class allow for command injection", "link": "https://avd.aquasec.com/nvd/cve-2017-1000487" }, { "id": "CVE-2019-10202", "package": "org.codehaus.jackson:jackson-mapper-asl", "installed": "1.9.13", "fixed": "", "title": "codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities", "link": "https://avd.aquasec.com/nvd/cve-2019-10202" }, { "id": "CVE-2019-20444", "package": "io.netty:netty", "installed": "3.10.5.Final", "fixed": "4.0.0", "title": "netty: HTTP request smuggling", "link": "https://avd.aquasec.com/nvd/cve-2019-20444" }, { "id": "CVE-2019-20444", "package": "io.netty:netty-codec-http", "installed": "4.1.8.Final", "fixed": "4.1.44", "title": "netty: HTTP request smuggling", "link": "https://avd.aquasec.com/nvd/cve-2019-20444" }, { "id": "CVE-2022-46337", "package": "org.apache.derby:derby", "installed": "10.11.1.1", "fixed": "10.14.2.1, 10.16.1.2, 10.15.2.1", "title": "A cleverly devised username might bypass LDAP authentication checks. I ...", "link": "https://avd.aquasec.com/nvd/cve-2022-46337" }, { "id": "CVE-2023-44981", "package": "org.apache.zookeeper:zookeeper", "installed": "3.4.10", "fixed": "3.7.2, 3.8.3, 3.9.1", "title": "zookeeper: Authorization Bypass in Apache ZooKeeper", "link": "https://avd.aquasec.com/nvd/cve-2023-44981" }, { "id": "CVE-2024-1597", "package": "org.postgresql:postgresql", "installed": "42.6.0", "fixed": "42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2", "title": "pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE", "link": "https://avd.aquasec.com/nvd/cve-2024-1597" }, { "id": "CVE-2024-47561", "package": "org.apache.avro:avro", "installed": "1.7.7", "fixed": "1.11.4", "title": "apache-avro: Schema parsing may trigger Remote Code Execution (RCE)", "link": "https://avd.aquasec.com/nvd/cve-2024-47561" }, { "id": "CVE-2025-24813", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.83", "fixed": "11.0.3, 10.1.35, 9.0.99", "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "link": "https://avd.aquasec.com/nvd/cve-2025-24813" }, { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r0", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-31789", "package": "libcrypto3", "installed": "3.5.5-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "libssl3", "installed": "3.5.5-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "openssl", "installed": "3.5.5-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-33845", "package": "gnutls", "installed": "3.8.11-r0", "fixed": "3.8.13-r0", "title": "gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment", "link": "https://avd.aquasec.com/nvd/cve-2026-33845" }, { "id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.83", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "link": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "id": "CVE-2026-42010", "package": "gnutls", "installed": "3.8.11-r0", "fixed": "3.8.13-r0", "title": "gnutls: gnutls: Authentication Bypass via NUL Character in Username", "link": "https://avd.aquasec.com/nvd/cve-2026-42010" }, { "id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.83", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "link": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.83", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "5.3.31", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.83", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.83", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.83", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.8.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.80.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.services.datalakefeeder:1.2.0" }, { "critical": 13, "high": 86, "fixable_critical": 13, "fixable_high": 84, "cves": [ { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r0", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-33701", "package": "io.opentelemetry.javaagent:opentelemetry-javaagent", "installed": "2.25.0", "fixed": "2.26.1", "title": "io.opentelemetry.javaagent/opentelemetry-javaagent: OpenTelemetry Java Instrumentation: Remote code execution via deserialization vulnerability in RMI", "link": "https://avd.aquasec.com/nvd/cve-2026-33701" }, { "id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.49", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "link": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.49", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "link": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.49", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.2.14", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webflux", "installed": "6.2.14", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "6.2.14", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-47892", "package": "org.springframework:spring-webflux", "installed": "6.2.14", "fixed": "7.0.9", "title": "org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints", "link": "https://avd.aquasec.com/nvd/cve-2026-47892" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.49", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.49", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.49", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.128.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.services.prh.prh-app-server:1.13.0" } ] }, { "name": "entity", "datastore": false, "images": [ { "critical": 2, "high": 140, "fixable_critical": 2, "fixable_high": 124, "cves": [ { "id": "CVE-2026-114406", "package": "ca-certificates", "installed": "2024.2.69_v8.0.303-91.4.el9_4", "fixed": "2026.2.92_v9.0.319-90.3.el9_8", "title": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns", "link": "https://avd.aquasec.com/nvd/cve-2026-114406" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.115.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "quay.io/strimzi/operator:0.45.0" } ] }, { "name": "integration", "datastore": false, "images": [ { "critical": 8, "high": 36, "fixable_critical": 8, "fixable_high": 36, "cves": [ { "id": "CVE-2020-14343", "package": "PyYAML", "installed": "5.3.1", "fixed": "5.4", "title": "PyYAML: incomplete fix for CVE-2020-1747", "link": "https://avd.aquasec.com/nvd/cve-2020-14343" }, { "id": "CVE-2022-1586", "package": "pcre2", "installed": "10.36-r0", "fixed": "10.36-r1", "title": "pcre2: Out-of-bounds read in compile_xclass_matchingpath in pcre2_jit_compile.c", "link": "https://avd.aquasec.com/nvd/cve-2022-1586" }, { "id": "CVE-2022-1587", "package": "pcre2", "installed": "10.36-r0", "fixed": "10.36-r1", "title": "pcre2: Out-of-bounds read in get_recurse_data_length in pcre2_jit_compile.c", "link": "https://avd.aquasec.com/nvd/cve-2022-1587" }, { "id": "CVE-2022-32207", "package": "libcurl", "installed": "7.79.1-r0", "fixed": "7.79.1-r2", "title": "curl: Unpreserved file permissions", "link": "https://avd.aquasec.com/nvd/cve-2022-32207" }, { "id": "CVE-2022-37434", "package": "zlib", "installed": "1.2.12-r0", "fixed": "1.2.12-r2", "title": "zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field", "link": "https://avd.aquasec.com/nvd/cve-2022-37434" }, { "id": "CVE-2024-49768", "package": "waitress", "installed": "3.0.0", "fixed": "3.0.1", "title": "waitress: python-waitress: request processing race condition in HTTP pipelining with invalid first request", "link": "https://avd.aquasec.com/nvd/cve-2024-49768" }, { "id": "CVE-2025-58367", "package": "deepdiff", "installed": "6.3.0", "fixed": "8.6.1", "title": "DeepDiff is a project focused on Deep Difference and search of any Pyt ...", "link": "https://avd.aquasec.com/nvd/cve-2025-58367" }, { "id": "GHSA-6q48-6c7w-9gw2", "package": "certifi", "installed": "2021.10.8", "fixed": "2026.10.18", "title": "certifi bundles emSign root CAs with compromised intermediate CA keys", "link": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2" } ], "ref": "artifactory.devops.telekom.de/tnap-docker/xtesting-healthcheck:master" }, { "critical": 4, "high": 108, "fixable_critical": 4, "fixable_high": 106, "cves": [ { "id": "CVE-2025-58367", "package": "deepdiff", "installed": "8.4.2", "fixed": "8.6.1", "title": "DeepDiff is a project focused on Deep Difference and search of any Pyt ...", "link": "https://avd.aquasec.com/nvd/cve-2025-58367" }, { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.23.4", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.23.3", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2026-33186", "package": "google.golang.org/grpc", "installed": "v1.65.0", "fixed": "1.79.3", "title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation", "link": "https://avd.aquasec.com/nvd/cve-2026-33186" } ], "ref": "artifactory.devops.telekom.de/tnap-docker/xtesting-smoke-usecases-robot-py3:master" } ] }, { "name": "multicloud", "datastore": false, "images": [ { "critical": 1, "high": 28, "fixable_critical": 1, "fixable_high": 28, "cves": [ { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.24.6", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" } ], "ref": "artifactory.devops.telekom.de/hub.docker.com/mongo:8.0.34" }, { "critical": 1, "high": 8, "fixable_critical": 1, "fixable_high": 8, "cves": [ { "id": "CVE-2022-37434", "package": "zlib", "installed": "1.2.12-r0", "fixed": "1.2.12-r2", "title": "zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field", "link": "https://avd.aquasec.com/nvd/cve-2022-37434" } ], "ref": "artifactory.devops.telekom.de/onap-repo/memcached:alpine3.15" }, { "critical": 9, "high": 52, "fixable_critical": 6, "fixable_high": 48, "cves": [ { "id": "CVE-2015-7501", "package": "commons-collections:commons-collections", "installed": "3.2.1", "fixed": "3.2.2", "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation", "link": "https://avd.aquasec.com/nvd/cve-2015-7501" }, { "id": "CVE-2017-7657", "package": "org.eclipse.jetty:jetty-server", "installed": "9.3.12.v20160915", "fixed": "9.2.25.v20180606, 9.3.24.v20180605", "title": "jetty: HTTP request smuggling", "link": "https://avd.aquasec.com/nvd/cve-2017-7657" }, { "id": "CVE-2017-7658", "package": "org.eclipse.jetty:jetty-server", "installed": "9.3.12.v20160915", "fixed": "9.2.25.v20180606, 9.3.24.v20180605, 9.4.11.v20180605", "title": "jetty: Incorrect header handling", "link": "https://avd.aquasec.com/nvd/cve-2017-7658" }, { "id": "CVE-2019-17571", "package": "log4j:log4j", "installed": "1.2.17", "fixed": "", "title": "log4j: deserialization of untrusted data in SocketServer", "link": "https://avd.aquasec.com/nvd/cve-2019-17571" }, { "id": "CVE-2022-23305", "package": "log4j:log4j", "installed": "1.2.17", "fixed": "", "title": "log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender", "link": "https://avd.aquasec.com/nvd/cve-2022-23305" }, { "id": "CVE-2022-23307", "package": "log4j:log4j", "installed": "1.2.17", "fixed": "", "title": "log4j: Unsafe deserialization flaw in Chainsaw log viewer", "link": "https://avd.aquasec.com/nvd/cve-2022-23307" }, { "id": "CVE-2022-36437", "package": "com.hazelcast:hazelcast", "installed": "3.7.2", "fixed": "3.12.13, 4.1.10, 4.2.6, 5.0.4, 5.1.3", "title": "hazelcast: Hazelcast connection caching", "link": "https://avd.aquasec.com/nvd/cve-2022-36437" }, { "id": "CVE-2026-107726", "package": "com.hazelcast:hazelcast", "installed": "3.7.2", "fixed": "5.7.0", "title": "com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client", "link": "https://avd.aquasec.com/nvd/cve-2026-107726" }, { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r1", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/multicloud/framework-artifactbroker:1.9.4" }, { "critical": 15, "high": 63, "fixable_critical": 15, "fixable_high": 63, "cves": [ { "id": "CVE-2020-14343", "package": "PyYAML", "installed": "5.3.1", "fixed": "5.4", "title": "PyYAML: incomplete fix for CVE-2020-1747", "link": "https://avd.aquasec.com/nvd/cve-2020-14343" }, { "id": "CVE-2021-36159", "package": "apk-tools", "installed": "2.12.5-r0", "fixed": "2.12.6-r0", "title": "libfetch: an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes leads to information leak or crash", "link": "https://avd.aquasec.com/nvd/cve-2021-36159" }, { "id": "CVE-2022-22822", "package": "expat", "installed": "2.2.10-r1", "fixed": "2.2.10-r2", "title": "expat: Integer overflow in addBinding in xmlparse.c", "link": "https://avd.aquasec.com/nvd/cve-2022-22822" }, { "id": "CVE-2022-22823", "package": "expat", "installed": "2.2.10-r1", "fixed": "2.2.10-r2", "title": "expat: Expat: Denial of Service vulnerability in XML parsing", "link": "https://avd.aquasec.com/nvd/cve-2022-22823" }, { "id": "CVE-2022-22824", "package": "expat", "installed": "2.2.10-r1", "fixed": "2.2.10-r2", "title": "expat: Expat: Denial of service and memory issues due to integer overflow", "link": "https://avd.aquasec.com/nvd/cve-2022-22824" }, { "id": "CVE-2022-23852", "package": "expat", "installed": "2.2.10-r1", "fixed": "2.2.10-r3", "title": "expat: Integer overflow in function XML_GetBuffer", "link": "https://avd.aquasec.com/nvd/cve-2022-23852" }, { "id": "CVE-2022-25235", "package": "expat", "installed": "2.2.10-r1", "fixed": "2.2.10-r4", "title": "expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution", "link": "https://avd.aquasec.com/nvd/cve-2022-25235" }, { "id": "CVE-2022-25236", "package": "expat", "installed": "2.2.10-r1", "fixed": "2.2.10-r4", "title": "expat: Namespace-separator characters in \"xmlns[:prefix]\" attribute values can lead to arbitrary code execution", "link": "https://avd.aquasec.com/nvd/cve-2022-25236" }, { "id": "CVE-2022-25315", "package": "expat", "installed": "2.2.10-r1", "fixed": "2.2.10-r4", "title": "expat: Integer overflow in storeRawNames()", "link": "https://avd.aquasec.com/nvd/cve-2022-25315" }, { "id": "CVE-2022-28346", "package": "Django", "installed": "3.2.7", "fixed": "2.2.28, 3.2.13, 4.0.4", "title": "Django: SQL injection in QuerySet.annotate(),aggregate() and extra()", "link": "https://avd.aquasec.com/nvd/cve-2022-28346" }, { "id": "CVE-2022-28347", "package": "Django", "installed": "3.2.7", "fixed": "2.2.28, 3.2.13, 4.0.4", "title": "Django: SQL injection via QuerySet.explain(options) on PostgreSQL", "link": "https://avd.aquasec.com/nvd/cve-2022-28347" }, { "id": "CVE-2022-34265", "package": "Django", "installed": "3.2.7", "fixed": "3.2.14, 4.0.6", "title": "python-django: Potential SQL injection via Trunc(kind) and Extract(lookup_name) arguments", "link": "https://avd.aquasec.com/nvd/cve-2022-34265" }, { "id": "CVE-2022-37434", "package": "zlib", "installed": "1.2.11-r3", "fixed": "1.2.12-r2", "title": "zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field", "link": "https://avd.aquasec.com/nvd/cve-2022-37434" }, { "id": "CVE-2023-31047", "package": "Django", "installed": "3.2.7", "fixed": "3.2.19, 4.1.9, 4.2.1", "title": "python-django: Potential bypass of validation when uploading multiple files using one form field", "link": "https://avd.aquasec.com/nvd/cve-2023-31047" }, { "id": "CVE-2025-64459", "package": "Django", "installed": "3.2.7", "fixed": "5.2.8, 5.1.14, 4.2.26", "title": "django: Django SQL injection", "link": "https://avd.aquasec.com/nvd/cve-2025-64459" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/multicloud/framework:1.9.2" }, { "critical": 6, "high": 107, "fixable_critical": 6, "fixable_high": 103, "cves": [ { "id": "CVE-2022-1996", "package": "github.com/emicklei/go-restful", "installed": "v2.9.5+incompatible", "fixed": "2.16.0", "title": "go-restful: Authorization Bypass Through User-Controlled Key", "link": "https://avd.aquasec.com/nvd/cve-2022-1996" }, { "id": "CVE-2023-24538", "package": "stdlib", "installed": "v1.17.13", "fixed": "1.19.8, 1.20.3", "title": "golang: html/template: backticks not treated as string delimiters", "link": "https://avd.aquasec.com/nvd/cve-2023-24538" }, { "id": "CVE-2023-24540", "package": "stdlib", "installed": "v1.17.13", "fixed": "1.19.9, 1.20.4", "title": "golang: html/template: improper handling of JavaScript whitespace", "link": "https://avd.aquasec.com/nvd/cve-2023-24540" }, { "id": "CVE-2024-24790", "package": "stdlib", "installed": "v1.17.13", "fixed": "1.21.11, 1.22.4", "title": "golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses", "link": "https://avd.aquasec.com/nvd/cve-2024-24790" }, { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.17.13", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2026-33186", "package": "google.golang.org/grpc", "installed": "v1.42.0", "fixed": "1.79.3", "title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation", "link": "https://avd.aquasec.com/nvd/cve-2026-33186" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/multicloud/k8s:0.13.0" }, { "critical": 15, "high": 76, "fixable_critical": 15, "fixable_high": 76, "cves": [ { "id": "CVE-2021-36159", "package": "apk-tools", "installed": "2.12.5-r0", "fixed": "2.12.6-r0", "title": "libfetch: an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes leads to information leak or crash", "link": "https://avd.aquasec.com/nvd/cve-2021-36159" }, { "id": "CVE-2022-22822", "package": "expat", "installed": "2.2.10-r1", "fixed": "2.2.10-r2", "title": "expat: Integer overflow in addBinding in xmlparse.c", "link": "https://avd.aquasec.com/nvd/cve-2022-22822" }, { "id": "CVE-2022-22823", "package": "expat", "installed": "2.2.10-r1", "fixed": "2.2.10-r2", "title": "expat: Expat: Denial of Service vulnerability in XML parsing", "link": "https://avd.aquasec.com/nvd/cve-2022-22823" }, { "id": "CVE-2022-22824", "package": "expat", "installed": "2.2.10-r1", "fixed": "2.2.10-r2", "title": "expat: Expat: Denial of service and memory issues due to integer overflow", "link": "https://avd.aquasec.com/nvd/cve-2022-22824" }, { "id": "CVE-2022-23852", "package": "expat", "installed": "2.2.10-r1", "fixed": "2.2.10-r3", "title": "expat: Integer overflow in function XML_GetBuffer", "link": "https://avd.aquasec.com/nvd/cve-2022-23852" }, { "id": "CVE-2022-25235", "package": "expat", "installed": "2.2.10-r1", "fixed": "2.2.10-r4", "title": "expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution", "link": "https://avd.aquasec.com/nvd/cve-2022-25235" }, { "id": "CVE-2022-25236", "package": "expat", "installed": "2.2.10-r1", "fixed": "2.2.10-r4", "title": "expat: Namespace-separator characters in \"xmlns[:prefix]\" attribute values can lead to arbitrary code execution", "link": "https://avd.aquasec.com/nvd/cve-2022-25236" }, { "id": "CVE-2022-25315", "package": "expat", "installed": "2.2.10-r1", "fixed": "2.2.10-r4", "title": "expat: Integer overflow in storeRawNames()", "link": "https://avd.aquasec.com/nvd/cve-2022-25315" }, { "id": "CVE-2022-28346", "package": "Django", "installed": "3.2.7", "fixed": "2.2.28, 3.2.13, 4.0.4", "title": "Django: SQL injection in QuerySet.annotate(),aggregate() and extra()", "link": "https://avd.aquasec.com/nvd/cve-2022-28346" }, { "id": "CVE-2022-28347", "package": "Django", "installed": "3.2.7", "fixed": "2.2.28, 3.2.13, 4.0.4", "title": "Django: SQL injection via QuerySet.explain(options) on PostgreSQL", "link": "https://avd.aquasec.com/nvd/cve-2022-28347" }, { "id": "CVE-2022-34265", "package": "Django", "installed": "3.2.7", "fixed": "3.2.14, 4.0.6", "title": "python-django: Potential SQL injection via Trunc(kind) and Extract(lookup_name) arguments", "link": "https://avd.aquasec.com/nvd/cve-2022-34265" }, { "id": "CVE-2022-37434", "package": "zlib", "installed": "1.2.11-r3", "fixed": "1.2.12-r2", "title": "zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field", "link": "https://avd.aquasec.com/nvd/cve-2022-37434" }, { "id": "CVE-2023-31047", "package": "Django", "installed": "3.2.7", "fixed": "3.2.19, 4.1.9, 4.2.1", "title": "python-django: Potential bypass of validation when uploading multiple files using one form field", "link": "https://avd.aquasec.com/nvd/cve-2023-31047" }, { "id": "CVE-2025-64459", "package": "Django", "installed": "3.2.7", "fixed": "5.2.8, 5.1.14, 4.2.26", "title": "django: Django SQL injection", "link": "https://avd.aquasec.com/nvd/cve-2025-64459" }, { "id": "GHSA-6q48-6c7w-9gw2", "package": "certifi", "installed": "2021.10.8", "fixed": "2026.10.18", "title": "certifi bundles emSign root CAs with compromised intermediate CA keys", "link": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/multicloud/openstack-fcaps:1.5.7" }, { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/onap-repo/rabbitmq:alpine" }, { "critical": 1, "high": 9, "fixable_critical": 1, "fixable_high": 9, "cves": [ { "id": "CVE-2021-36159", "package": "apk-tools", "installed": "2.10.4-r2", "fixed": "2.10.7-r0", "title": "libfetch: an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes leads to information leak or crash", "link": "https://avd.aquasec.com/nvd/cve-2021-36159" } ], "ref": "quay.io/coreos/etcd:v3.2.32" } ] }, { "name": "ncmp", "datastore": false, "images": [ { "critical": 12, "high": 61, "fixable_critical": 12, "fixable_high": 59, "cves": [ { "id": "CVE-2024-45491", "package": "libexpat", "installed": "2.5.0-r0", "fixed": "2.6.3-r0", "title": "libexpat: Integer Overflow or Wraparound", "link": "https://avd.aquasec.com/nvd/cve-2024-45491" }, { "id": "CVE-2024-45492", "package": "libexpat", "installed": "2.5.0-r0", "fixed": "2.6.3-r0", "title": "libexpat: integer overflow", "link": "https://avd.aquasec.com/nvd/cve-2024-45492" }, { "id": "CVE-2025-41232", "package": "org.springframework.security:spring-security-core", "installed": "6.4.4", "fixed": "6.4.6", "title": "Spring-Security: Spring Security authorization bypass for method security annotations on private methods", "link": "https://avd.aquasec.com/nvd/cve-2025-41232" }, { "id": "CVE-2026-22732", "package": "org.springframework.security:spring-security-web", "installed": "6.4.4", "fixed": "6.5.9, 7.0.4", "title": "Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers", "link": "https://avd.aquasec.com/nvd/cve-2026-22732" }, { "id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.39", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "link": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.39", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "link": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.39", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.2.5", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "6.2.5", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.39", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.39", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.39", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/ncmp-dmi-plugin:1.7.0" }, { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3" } ] }, { "name": "nengdb", "datastore": false, "images": [ { "critical": 4, "high": 65, "fixable_critical": 4, "fixable_high": 65, "cves": [ { "id": "CVE-2023-24538", "package": "stdlib", "installed": "v1.18.2", "fixed": "1.19.8, 1.20.3", "title": "golang: html/template: backticks not treated as string delimiters", "link": "https://avd.aquasec.com/nvd/cve-2023-24538" }, { "id": "CVE-2023-24540", "package": "stdlib", "installed": "v1.18.2", "fixed": "1.19.9, 1.20.4", "title": "golang: html/template: improper handling of JavaScript whitespace", "link": "https://avd.aquasec.com/nvd/cve-2023-24540" }, { "id": "CVE-2024-24790", "package": "stdlib", "installed": "v1.18.2", "fixed": "1.21.11, 1.22.4", "title": "golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses", "link": "https://avd.aquasec.com/nvd/cve-2024-24790" }, { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.18.2", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" } ], "ref": "artifactory.devops.telekom.de/hub.docker.com/mariadb:11.7.2" }, { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3" } ] }, { "name": "network", "datastore": false, "images": [ { "critical": 30, "high": 189, "fixable_critical": 30, "fixable_high": 188, "cves": [ { "id": "CVE-2016-1000027", "package": "org.springframework:spring-web", "installed": "5.3.16", "fixed": "6.0.0", "title": "spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization", "link": "https://avd.aquasec.com/nvd/cve-2016-1000027" }, { "id": "CVE-2021-36159", "package": "apk-tools", "installed": "2.10.5-r1", "fixed": "2.10.7-r0", "title": "libfetch: an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes leads to information leak or crash", "link": "https://avd.aquasec.com/nvd/cve-2021-36159" }, { "id": "CVE-2021-3711", "package": "libcrypto1.1", "installed": "1.1.1g-r0", "fixed": "1.1.1l-r0", "title": "openssl: SM2 Decryption Buffer Overflow", "link": "https://avd.aquasec.com/nvd/cve-2021-3711" }, { "id": "CVE-2021-3711", "package": "libssl1.1", "installed": "1.1.1g-r0", "fixed": "1.1.1l-r0", "title": "openssl: SM2 Decryption Buffer Overflow", "link": "https://avd.aquasec.com/nvd/cve-2021-3711" }, { "id": "CVE-2021-3711", "package": "openssl", "installed": "1.1.1i-r0", "fixed": "1.1.1l-r0", "title": "openssl: SM2 Decryption Buffer Overflow", "link": "https://avd.aquasec.com/nvd/cve-2021-3711" }, { "id": "CVE-2021-42392", "package": "com.h2database:h2", "installed": "1.4.200", "fixed": "2.0.206", "title": "h2: Remote Code Execution in Console", "link": "https://avd.aquasec.com/nvd/cve-2021-42392" }, { "id": "CVE-2021-43527", "package": "nss", "installed": "3.60-r1", "fixed": "3.60-r2", "title": "nss: Memory corruption in decodeECorDsaSignature with DSA signatures (and RSA-PSS)", "link": "https://avd.aquasec.com/nvd/cve-2021-43527" }, { "id": "CVE-2022-0839", "package": "org.liquibase:liquibase-core", "installed": "4.4.2.nordix", "fixed": "4.8.0", "title": "liquibase: Improper Restriction of XML External Entity", "link": "https://avd.aquasec.com/nvd/cve-2022-0839" }, { "id": "CVE-2022-22822", "package": "expat", "installed": "2.2.9-r1", "fixed": "2.2.10-r0", "title": "expat: Integer overflow in addBinding in xmlparse.c", "link": "https://avd.aquasec.com/nvd/cve-2022-22822" }, { "id": "CVE-2022-22823", "package": "expat", "installed": "2.2.9-r1", "fixed": "2.2.10-r0", "title": "expat: Expat: Denial of Service vulnerability in XML parsing", "link": "https://avd.aquasec.com/nvd/cve-2022-22823" }, { "id": "CVE-2022-22824", "package": "expat", "installed": "2.2.9-r1", "fixed": "2.2.10-r0", "title": "expat: Expat: Denial of service and memory issues due to integer overflow", "link": "https://avd.aquasec.com/nvd/cve-2022-22824" }, { "id": "CVE-2022-22965", "package": "org.springframework:spring-beans", "installed": "5.3.16", "fixed": "5.2.20.RELEASE, 5.3.18", "title": "spring-framework: RCE via Data Binding on JDK 9+", "link": "https://avd.aquasec.com/nvd/cve-2022-22965" }, { "id": "CVE-2022-22965", "package": "org.springframework:spring-webmvc", "installed": "5.3.16", "fixed": "5.2.20.RELEASE, 5.3.18", "title": "spring-framework: RCE via Data Binding on JDK 9+", "link": "https://avd.aquasec.com/nvd/cve-2022-22965" }, { "id": "CVE-2022-23221", "package": "com.h2database:h2", "installed": "1.4.200", "fixed": "2.1.210", "title": "h2: Loading of custom classes from remote servers through JNDI", "link": "https://avd.aquasec.com/nvd/cve-2022-23221" }, { "id": "CVE-2022-23852", "package": "expat", "installed": "2.2.9-r1", "fixed": "2.2.10-r1", "title": "expat: Integer overflow in function XML_GetBuffer", "link": "https://avd.aquasec.com/nvd/cve-2022-23852" }, { "id": "CVE-2022-25235", "package": "expat", "installed": "2.2.9-r1", "fixed": "2.2.10-r2", "title": "expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution", "link": "https://avd.aquasec.com/nvd/cve-2022-25235" }, { "id": "CVE-2022-25236", "package": "expat", "installed": "2.2.9-r1", "fixed": "2.2.10-r2", "title": "expat: Namespace-separator characters in \"xmlns[:prefix]\" attribute values can lead to arbitrary code execution", "link": "https://avd.aquasec.com/nvd/cve-2022-25236" }, { "id": "CVE-2022-25315", "package": "expat", "installed": "2.2.9-r1", "fixed": "2.2.10-r2", "title": "expat: Integer overflow in storeRawNames()", "link": "https://avd.aquasec.com/nvd/cve-2022-25315" }, { "id": "CVE-2022-27404", "package": "freetype", "installed": "2.10.4-r0", "fixed": "2.10.4-r1", "title": "FreeType: Buffer overflow in sfnt_init_face", "link": "https://avd.aquasec.com/nvd/cve-2022-27404" }, { "id": "CVE-2022-37434", "package": "zlib", "installed": "1.2.11-r3", "fixed": "1.2.12-r2", "title": "zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field", "link": "https://avd.aquasec.com/nvd/cve-2022-37434" }, { "id": "CVE-2023-20860", "package": "org.springframework:spring-webmvc", "installed": "5.3.16", "fixed": "6.0.7, 5.3.26", "title": "springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern", "link": "https://avd.aquasec.com/nvd/cve-2023-20860" }, { "id": "CVE-2023-20873", "package": "org.springframework.boot:spring-boot-actuator-autoconfigure", "installed": "2.5.10", "fixed": "3.0.6, 2.7.11, 2.6.15, 2.5.15", "title": "spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry", "link": "https://avd.aquasec.com/nvd/cve-2023-20873" }, { "id": "CVE-2025-24813", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.58", "fixed": "11.0.3, 10.1.35, 9.0.99", "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "link": "https://avd.aquasec.com/nvd/cve-2025-24813" }, { "id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.58", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "link": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.58", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "link": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.58", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "5.3.16", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.58", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.58", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.58", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/ccsdk-apps-ms-neng:1.4.0" }, { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3" } ] }, { "name": "nginx", "datastore": false, "images": [ { "critical": 3, "high": 15, "fixable_critical": 3, "fixable_high": 15, "cves": [ { "id": "CVE-2026-15176", "package": "nginx", "installed": "1.31.6-1", "fixed": "1.30.6, 1.31.7", "title": "nginx: nginx: heap-based buffer overflow in ngx_http_core_module via alias with rewrite referencing $request_filename", "link": "https://avd.aquasec.com/nvd/cve-2026-15176" }, { "id": "CVE-2026-93479", "package": "nginx", "installed": "1.31.6-1", "fixed": "1.30.6, 1.31.7", "title": "nginx: NGINX map directive and regex matching vulnerability", "link": "https://avd.aquasec.com/nvd/cve-2026-93479" }, { "id": "CVE-2026-97205", "package": "nginx", "installed": "1.31.6-1", "fixed": "1.30.6, 1.31.7", "title": "nginx: NGINX ngx_http_core_module vulnerability", "link": "https://avd.aquasec.com/nvd/cve-2026-97205" } ], "ref": "docker.io/bitnami/nginx:latest" } ] }, { "name": "oauth2", "datastore": false, "images": [ { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "docker.io/library/alpine:latest" }, { "critical": 4, "high": 53, "fixable_critical": 4, "fixable_high": 52, "cves": [ { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.25.4", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2026-33186", "package": "google.golang.org/grpc", "installed": "v1.73.0", "fixed": "1.79.3", "title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation", "link": "https://avd.aquasec.com/nvd/cve-2026-33186" }, { "id": "CVE-2026-34457", "package": "github.com/oauth2-proxy/oauth2-proxy/v7", "installed": "v7.13.0", "fixed": "7.15.2", "title": " OAuth2 Proxy's Health Check User-Agent Matching Bypasses Authentication in auth_request Mode", "link": "https://avd.aquasec.com/nvd/cve-2026-34457" }, { "id": "CVE-2026-40575", "package": "github.com/oauth2-proxy/oauth2-proxy/v7", "installed": "v7.13.0", "fixed": "7.15.2", "title": "oauth2-proxy: github.com/oauth2-proxy/oauth2-proxy: OAuth2 Proxy: Authentication bypass due to spoofed X-Forwarded-Uri header", "link": "https://avd.aquasec.com/nvd/cve-2026-40575" } ], "ref": "quay.io/oauth2-proxy/oauth2-proxy:v7.13.0" } ] }, { "name": "onap", "datastore": false, "images": [ { "critical": 0, "high": 27, "fixable_critical": 0, "fixable_high": 27, "cves": [], "ref": "artifactory.devops.telekom.de/hub.docker.com/adorsys/keycloak-config-cli:6.2.1-26.0.5" } ] }, { "name": "policy", "datastore": false, "images": [ { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/hub.docker.com/busybox:1.37.0" }, { "critical": 2, "high": 87, "fixable_critical": 1, "fixable_high": 25, "cves": [ { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.24.6", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2026-6653", "package": "libxml2", "installed": "2.12.7+dfsg+really2.9.14-2.1+deb13u3", "fixed": "", "title": "libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free", "link": "https://avd.aquasec.com/nvd/cve-2026-6653" } ], "ref": "artifactory.devops.telekom.de/hub.docker.com/postgres:17.11" }, { "critical": 2, "high": 87, "fixable_critical": 1, "fixable_high": 25, "cves": [ { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.24.6", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2026-6653", "package": "libxml2", "installed": "2.12.7+dfsg+really2.9.14-2.1+deb13u3", "fixed": "", "title": "libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free", "link": "https://avd.aquasec.com/nvd/cve-2026-6653" } ], "ref": "artifactory.devops.telekom.de/onap-repo/library/postgres:17.11" }, { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3" }, { "critical": 3, "high": 49, "fixable_critical": 3, "fixable_high": 49, "cves": [ { "id": "CVE-2026-107726", "package": "com.hazelcast:hazelcast", "installed": "5.5.0", "fixed": "5.7.0", "title": "com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client", "link": "https://avd.aquasec.com/nvd/cve-2026-107726" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.2.15.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "id": "CVE-2026-8763", "package": "org.bouncycastle:bc-fips", "installed": "2.1.2", "fixed": "1.0.2.7, 2.0.2, 2.1.3", "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI", "link": "https://avd.aquasec.com/nvd/cve-2026-8763" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/policy-apex-pdp:5.0.1" }, { "critical": 9, "high": 37, "fixable_critical": 9, "fixable_high": 37, "cves": [ { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webflux", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-47892", "package": "org.springframework:spring-webflux", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints", "link": "https://avd.aquasec.com/nvd/cve-2026-47892" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.22", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.22", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.22", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.22", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.2.15.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/policy-api:5.0.1" }, { "critical": 9, "high": 38, "fixable_critical": 9, "fixable_high": 38, "cves": [ { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webflux", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-47892", "package": "org.springframework:spring-webflux", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints", "link": "https://avd.aquasec.com/nvd/cve-2026-47892" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.2.15.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/policy-clamp-ac-a1pms-ppnt:9.1.0" }, { "critical": 9, "high": 38, "fixable_critical": 9, "fixable_high": 38, "cves": [ { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webflux", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-47892", "package": "org.springframework:spring-webflux", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints", "link": "https://avd.aquasec.com/nvd/cve-2026-47892" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.2.15.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/policy-clamp-ac-http-ppnt:9.1.0" }, { "critical": 19, "high": 225, "fixable_critical": 19, "fixable_high": 223, "cves": [ { "id": "CVE-2022-1996", "package": "github.com/emicklei/go-restful", "installed": "v2.9.5+incompatible", "fixed": "2.16.0", "title": "go-restful: Authorization Bypass Through User-Controlled Key", "link": "https://avd.aquasec.com/nvd/cve-2022-1996" }, { "id": "CVE-2022-21235", "package": "github.com/Masterminds/vcs", "installed": "v1.13.1", "fixed": "1.13.2", "title": "github.com/Masterminds/vcs: Command Injection via argument injection", "link": "https://avd.aquasec.com/nvd/cve-2022-21235" }, { "id": "CVE-2022-23806", "package": "stdlib", "installed": "v1.15.7", "fixed": "1.16.14, 1.17.7", "title": "golang: crypto/elliptic: IsOnCurve returns true for invalid field elements", "link": "https://avd.aquasec.com/nvd/cve-2022-23806" }, { "id": "CVE-2022-23806", "package": "stdlib", "installed": "v1.16.4", "fixed": "1.16.14, 1.17.7", "title": "golang: crypto/elliptic: IsOnCurve returns true for invalid field elements", "link": "https://avd.aquasec.com/nvd/cve-2022-23806" }, { "id": "CVE-2023-24538", "package": "stdlib", "installed": "v1.15.7", "fixed": "1.19.8, 1.20.3", "title": "golang: html/template: backticks not treated as string delimiters", "link": "https://avd.aquasec.com/nvd/cve-2023-24538" }, { "id": "CVE-2023-24538", "package": "stdlib", "installed": "v1.16.4", "fixed": "1.19.8, 1.20.3", "title": "golang: html/template: backticks not treated as string delimiters", "link": "https://avd.aquasec.com/nvd/cve-2023-24538" }, { "id": "CVE-2023-24540", "package": "stdlib", "installed": "v1.15.7", "fixed": "1.19.9, 1.20.4", "title": "golang: html/template: improper handling of JavaScript whitespace", "link": "https://avd.aquasec.com/nvd/cve-2023-24540" }, { "id": "CVE-2023-24540", "package": "stdlib", "installed": "v1.16.4", "fixed": "1.19.9, 1.20.4", "title": "golang: html/template: improper handling of JavaScript whitespace", "link": "https://avd.aquasec.com/nvd/cve-2023-24540" }, { "id": "CVE-2024-24790", "package": "stdlib", "installed": "v1.15.7", "fixed": "1.21.11, 1.22.4", "title": "golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses", "link": "https://avd.aquasec.com/nvd/cve-2024-24790" }, { "id": "CVE-2024-24790", "package": "stdlib", "installed": "v1.16.4", "fixed": "1.21.11, 1.22.4", "title": "golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses", "link": "https://avd.aquasec.com/nvd/cve-2024-24790" }, { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.15.7", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.16.4", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2026-33186", "package": "google.golang.org/grpc", "installed": "v1.27.1", "fixed": "1.79.3", "title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation", "link": "https://avd.aquasec.com/nvd/cve-2026-33186" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/policy-clamp-ac-k8s-ppnt:9.1.0" }, { "critical": 8, "high": 34, "fixable_critical": 8, "fixable_high": 34, "cves": [ { "id": "CVE-2025-14813", "package": "org.bouncycastle:bcprov-jdk18on", "installed": "1.83", "fixed": "1.80.2, 1.81.1, 1.84", "title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly", "link": "https://avd.aquasec.com/nvd/cve-2025-14813" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "id": "CVE-2026-8763", "package": "org.bouncycastle:bcprov-jdk18on", "installed": "1.83", "fixed": "1.85", "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI", "link": "https://avd.aquasec.com/nvd/cve-2026-8763" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/policy-clamp-ac-kserve-ppnt:9.1.0" }, { "critical": 9, "high": 38, "fixable_critical": 9, "fixable_high": 38, "cves": [ { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webflux", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-47892", "package": "org.springframework:spring-webflux", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints", "link": "https://avd.aquasec.com/nvd/cve-2026-47892" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.2.15.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/policy-clamp-ac-pf-ppnt:9.1.0" }, { "critical": 6, "high": 33, "fixable_critical": 6, "fixable_high": 33, "cves": [ { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.24", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/policy-clamp-runtime-acm:9.1.0" }, { "critical": 0, "high": 56, "fixable_critical": 0, "fixable_high": 56, "cves": [], "ref": "artifactory.devops.telekom.de/onap-repo/onap/policy-db-migrator:5.0.1" }, { "critical": 0, "high": 28, "fixable_critical": 0, "fixable_high": 28, "cves": [], "ref": "artifactory.devops.telekom.de/onap-repo/onap/policy-distribution:5.1.0" }, { "critical": 4, "high": 103, "fixable_critical": 4, "fixable_high": 103, "cves": [ { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.23.1", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.23.12", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2026-33186", "package": "google.golang.org/grpc", "installed": "v1.67.0", "fixed": "1.79.3", "title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation", "link": "https://avd.aquasec.com/nvd/cve-2026-33186" }, { "id": "CVE-2026-33186", "package": "google.golang.org/grpc", "installed": "v1.70.0", "fixed": "1.79.3", "title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation", "link": "https://avd.aquasec.com/nvd/cve-2026-33186" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/policy-opa-pdp:2.1.0" }, { "critical": 6, "high": 34, "fixable_critical": 6, "fixable_high": 34, "cves": [ { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.22", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.22", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.22", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "11.0.22", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/policy-pap:5.0.1" }, { "critical": 6, "high": 99, "fixable_critical": 5, "fixable_high": 97, "cves": [ { "id": "CVE-2020-10683", "package": "dom4j:dom4j", "installed": "1.1", "fixed": "", "title": "dom4j: XML External Entity vulnerability in default SAX parser", "link": "https://avd.aquasec.com/nvd/cve-2020-10683" }, { "id": "CVE-2021-26291", "package": "org.apache.maven:maven-core", "installed": "3.1.1", "fixed": "3.8.1", "title": "maven: Block repositories using http by default", "link": "https://avd.aquasec.com/nvd/cve-2021-26291" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.2.15.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.2.15.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "id": "CVE-2026-8763", "package": "org.bouncycastle:bc-fips", "installed": "2.1.2", "fixed": "1.0.2.7, 2.0.2, 2.1.3", "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI", "link": "https://avd.aquasec.com/nvd/cve-2026-8763" }, { "id": "CVE-2026-8763", "package": "org.bouncycastle:bc-fips", "installed": "2.1.2", "fixed": "1.0.2.7, 2.0.2, 2.1.3", "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI", "link": "https://avd.aquasec.com/nvd/cve-2026-8763" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/policy-pdpd-cl:4.0.1" }, { "critical": 0, "high": 30, "fixable_critical": 0, "fixable_high": 30, "cves": [], "ref": "artifactory.devops.telekom.de/onap-repo/onap/policy-xacml-pdp:5.0.1" } ] }, { "name": "portal", "datastore": false, "images": [ { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/hub.docker.com/alpine/psql:18.6" }, { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3" }, { "critical": 1, "high": 14, "fixable_critical": 1, "fixable_high": 14, "cves": [ { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r1", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/portal-ng/bff:0.5.1-20260925T0756" }, { "critical": 4, "high": 21, "fixable_critical": 4, "fixable_high": 21, "cves": [ { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r1", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webflux", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-47892", "package": "org.springframework:spring-webflux", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints", "link": "https://avd.aquasec.com/nvd/cve-2026-47892" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.2.15.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/portal-ng/history:0.4.0-20260925T0802" }, { "critical": 4, "high": 21, "fixable_critical": 4, "fixable_high": 21, "cves": [ { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r1", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webflux", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-47892", "package": "org.springframework:spring-webflux", "installed": "7.0.8", "fixed": "7.0.9", "title": "org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints", "link": "https://avd.aquasec.com/nvd/cve-2026-47892" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.2.15.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/portal-ng/preferences:0.4.0-20260925T0757" }, { "critical": 0, "high": 1, "fixable_critical": 0, "fixable_high": 1, "cves": [], "ref": "artifactory.devops.telekom.de/onap-repo/onap/portal-ng/ui:0.2.0-20260923T0059" } ] }, { "name": "postgres", "datastore": false, "images": [ { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/hub.docker.com/busybox:1.37.0" }, { "critical": 2, "high": 87, "fixable_critical": 1, "fixable_high": 25, "cves": [ { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.24.6", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2026-6653", "package": "libxml2", "installed": "2.12.7+dfsg+really2.9.14-2.1+deb13u3", "fixed": "", "title": "libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free", "link": "https://avd.aquasec.com/nvd/cve-2026-6653" } ], "ref": "artifactory.devops.telekom.de/hub.docker.com/postgres:17.11" } ] }, { "name": "robot", "datastore": false, "images": [ { "critical": 14, "high": 187, "fixable_critical": 14, "fixable_high": 185, "cves": [ { "id": "CVE-2022-23806", "package": "stdlib", "installed": "v1.17.5", "fixed": "1.16.14, 1.17.7", "title": "golang: crypto/elliptic: IsOnCurve returns true for invalid field elements", "link": "https://avd.aquasec.com/nvd/cve-2022-23806" }, { "id": "CVE-2023-24538", "package": "stdlib", "installed": "v1.17.5", "fixed": "1.19.8, 1.20.3", "title": "golang: html/template: backticks not treated as string delimiters", "link": "https://avd.aquasec.com/nvd/cve-2023-24538" }, { "id": "CVE-2023-24538", "package": "stdlib", "installed": "v1.17.11", "fixed": "1.19.8, 1.20.3", "title": "golang: html/template: backticks not treated as string delimiters", "link": "https://avd.aquasec.com/nvd/cve-2023-24538" }, { "id": "CVE-2023-24540", "package": "stdlib", "installed": "v1.17.5", "fixed": "1.19.9, 1.20.4", "title": "golang: html/template: improper handling of JavaScript whitespace", "link": "https://avd.aquasec.com/nvd/cve-2023-24540" }, { "id": "CVE-2023-24540", "package": "stdlib", "installed": "v1.17.11", "fixed": "1.19.9, 1.20.4", "title": "golang: html/template: improper handling of JavaScript whitespace", "link": "https://avd.aquasec.com/nvd/cve-2023-24540" }, { "id": "CVE-2024-24790", "package": "stdlib", "installed": "v1.17.5", "fixed": "1.21.11, 1.22.4", "title": "golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses", "link": "https://avd.aquasec.com/nvd/cve-2024-24790" }, { "id": "CVE-2024-24790", "package": "stdlib", "installed": "v1.17.11", "fixed": "1.21.11, 1.22.4", "title": "golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses", "link": "https://avd.aquasec.com/nvd/cve-2024-24790" }, { "id": "CVE-2024-41110", "package": "github.com/docker/docker", "installed": "v20.10.12+incompatible", "fixed": "23.0.15, 26.1.5, 27.1.1, 25.0.6", "title": "moby: Authz zero length regression", "link": "https://avd.aquasec.com/nvd/cve-2024-41110" }, { "id": "CVE-2024-49768", "package": "waitress", "installed": "3.0.0", "fixed": "3.0.1", "title": "waitress: python-waitress: request processing race condition in HTTP pipelining with invalid first request", "link": "https://avd.aquasec.com/nvd/cve-2024-49768" }, { "id": "CVE-2025-58367", "package": "deepdiff", "installed": "8.4.2", "fixed": "8.6.1", "title": "DeepDiff is a project focused on Deep Difference and search of any Pyt ...", "link": "https://avd.aquasec.com/nvd/cve-2025-58367" }, { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.17.5", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.17.11", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2026-33186", "package": "google.golang.org/grpc", "installed": "v1.43.0", "fixed": "1.79.3", "title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation", "link": "https://avd.aquasec.com/nvd/cve-2026-33186" }, { "id": "GHSA-6q48-6c7w-9gw2", "package": "certifi", "installed": "2025.4.26", "fixed": "2026.10.18", "title": "certifi bundles emSign root CAs with compromised intermediate CA keys", "link": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/testsuite:1.14.1" } ] }, { "name": "sdc", "datastore": false, "images": [ { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3" }, { "critical": 9, "high": 66, "fixable_critical": 9, "fixable_high": 63, "cves": [ { "id": "CVE-2015-7501", "package": "commons-collections:commons-collections", "installed": "3.2.1", "fixed": "3.2.2", "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation", "link": "https://avd.aquasec.com/nvd/cve-2015-7501" }, { "id": "CVE-2016-1000027", "package": "org.springframework:spring-web", "installed": "5.3.39", "fixed": "6.0.0", "title": "spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization", "link": "https://avd.aquasec.com/nvd/cve-2016-1000027" }, { "id": "CVE-2017-7657", "package": "org.eclipse.jetty:jetty-server", "installed": "9.3.12.v20160915", "fixed": "9.2.25.v20180606, 9.3.24.v20180605", "title": "jetty: HTTP request smuggling", "link": "https://avd.aquasec.com/nvd/cve-2017-7657" }, { "id": "CVE-2017-7658", "package": "org.eclipse.jetty:jetty-server", "installed": "9.3.12.v20160915", "fixed": "9.2.25.v20180606, 9.3.24.v20180605, 9.4.11.v20180605", "title": "jetty: Incorrect header handling", "link": "https://avd.aquasec.com/nvd/cve-2017-7658" }, { "id": "CVE-2022-36437", "package": "com.hazelcast:hazelcast", "installed": "3.7.2", "fixed": "3.12.13, 4.1.10, 4.2.6, 5.0.4, 5.1.3", "title": "hazelcast: Hazelcast connection caching", "link": "https://avd.aquasec.com/nvd/cve-2022-36437" }, { "id": "CVE-2026-107726", "package": "com.hazelcast:hazelcast", "installed": "3.7.2", "fixed": "5.7.0", "title": "com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client", "link": "https://avd.aquasec.com/nvd/cve-2026-107726" }, { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r1", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-49875", "package": "org.apache.cxf:cxf-core", "installed": "3.6.3", "fixed": "4.2.2, 4.1.7, 3.6.12", "title": "cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening", "link": "https://avd.aquasec.com/nvd/cve-2026-49875" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.92.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/sdc-backend-all-plugins:1.20-20261103T095353Z" }, { "critical": 0, "high": 2, "fixable_critical": 0, "fixable_high": 2, "cves": [], "ref": "artifactory.devops.telekom.de/onap-repo/onap/sdc-backend-init:1.20-20261103T095353Z" }, { "critical": 6, "high": 41, "fixable_critical": 6, "fixable_high": 41, "cves": [ { "id": "CVE-2017-7657", "package": "org.eclipse.jetty:jetty-server", "installed": "9.3.12.v20160915", "fixed": "9.2.25.v20180606, 9.3.24.v20180605", "title": "jetty: HTTP request smuggling", "link": "https://avd.aquasec.com/nvd/cve-2017-7657" }, { "id": "CVE-2017-7658", "package": "org.eclipse.jetty:jetty-server", "installed": "9.3.12.v20160915", "fixed": "9.2.25.v20180606, 9.3.24.v20180605, 9.4.11.v20180605", "title": "jetty: Incorrect header handling", "link": "https://avd.aquasec.com/nvd/cve-2017-7658" }, { "id": "CVE-2022-36437", "package": "com.hazelcast:hazelcast", "installed": "3.7.2", "fixed": "3.12.13, 4.1.10, 4.2.6, 5.0.4, 5.1.3", "title": "hazelcast: Hazelcast connection caching", "link": "https://avd.aquasec.com/nvd/cve-2022-36437" }, { "id": "CVE-2026-107726", "package": "com.hazelcast:hazelcast", "installed": "3.7.2", "fixed": "5.7.0", "title": "com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client", "link": "https://avd.aquasec.com/nvd/cve-2026-107726" }, { "id": "CVE-2026-49875", "package": "org.apache.cxf:cxf-core", "installed": "3.6.3", "fixed": "4.2.2, 4.1.7, 3.6.12", "title": "cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening", "link": "https://avd.aquasec.com/nvd/cve-2026-49875" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.92.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/sdc-cassandra-init:1.20-20261103T095353Z" }, { "critical": 0, "high": 4, "fixable_critical": 0, "fixable_high": 4, "cves": [], "ref": "artifactory.devops.telekom.de/onap-repo/onap/sdc-frontend:1.20-20261103T095353Z" }, { "critical": 8, "high": 39, "fixable_critical": 8, "fixable_high": 37, "cves": [ { "id": "CVE-2016-1000027", "package": "org.springframework:spring-web", "installed": "5.3.31", "fixed": "6.0.0", "title": "spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization", "link": "https://avd.aquasec.com/nvd/cve-2016-1000027" }, { "id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.99", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "link": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.99", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "link": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.99", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "5.3.31", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.99", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.99", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.99", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/sdc-helm-validator:1.3.5" }, { "critical": 5, "high": 29, "fixable_critical": 5, "fixable_high": 28, "cves": [ { "id": "CVE-2016-1000027", "package": "org.springframework:spring-web", "installed": "5.3.39", "fixed": "6.0.0", "title": "spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization", "link": "https://avd.aquasec.com/nvd/cve-2016-1000027" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "5.3.39", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-49875", "package": "org.apache.cxf:cxf-core", "installed": "3.6.3", "fixed": "4.2.2, 4.1.7, 3.6.12", "title": "cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening", "link": "https://avd.aquasec.com/nvd/cve-2026-49875" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.92.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "id": "CVE-2026-84939", "package": "org.freemarker:freemarker", "installed": "2.3.30", "fixed": "2.3.35", "title": "org.apache.freemarker/freemarker: Apache FreeMarker: Path traversal via malformed locale identifier", "link": "https://avd.aquasec.com/nvd/cve-2026-84939" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/sdc-onboard-backend:1.20-20261103T095353Z" }, { "critical": 0, "high": 49, "fixable_critical": 0, "fixable_high": 2, "cves": [], "ref": "artifactory.devops.telekom.de/onap-repo/onap/sdc-onboard-cassandra-init:1.20-20261103T095353Z" }, { "critical": 4, "high": 39, "fixable_critical": 4, "fixable_high": 38, "cves": [ { "id": "CVE-2016-1000027", "package": "org.springframework:spring-web", "installed": "5.3.31", "fixed": "6.0.0", "title": "spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization", "link": "https://avd.aquasec.com/nvd/cve-2016-1000027" }, { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r1", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "5.3.31", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.101.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/sdc-workflow-backend:1.15.0" }, { "critical": 5, "high": 80, "fixable_critical": 5, "fixable_high": 80, "cves": [ { "id": "CVE-2026-31789", "package": "libcrypto3", "installed": "3.5.1-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "libssl3", "installed": "3.5.1-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "openssl", "installed": "3.5.1-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-33845", "package": "gnutls", "installed": "3.8.8-r0", "fixed": "3.8.13-r0", "title": "gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment", "link": "https://avd.aquasec.com/nvd/cve-2026-33845" }, { "id": "CVE-2026-42010", "package": "gnutls", "installed": "3.8.8-r0", "fixed": "3.8.13-r0", "title": "gnutls: gnutls: Authentication Bypass via NUL Character in Username", "link": "https://avd.aquasec.com/nvd/cve-2026-42010" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/sdc-workflow-frontend:1.15.0" }, { "critical": 0, "high": 2, "fixable_critical": 0, "fixable_high": 2, "cves": [], "ref": "artifactory.devops.telekom.de/onap-repo/onap/sdc-workflow-init:1.15.0" } ] }, { "name": "sdnc", "datastore": false, "images": [ { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/hub.docker.com/busybox:1.37.0" }, { "critical": 32, "high": 286, "fixable_critical": 32, "fixable_high": 284, "cves": [ { "id": "CVE-2017-16042", "package": "growl", "installed": "1.8.1", "fixed": "1.10.0", "title": "nodejs-growl: Does not properly sanitize input before passing it to exec", "link": "https://avd.aquasec.com/nvd/cve-2017-16042" }, { "id": "CVE-2019-10744", "package": "lodash", "installed": "0.9.2", "fixed": "4.17.12", "title": "nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties", "link": "https://avd.aquasec.com/nvd/cve-2019-10744" }, { "id": "CVE-2019-10744", "package": "lodash", "installed": "0.9.2", "fixed": "4.17.12", "title": "nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties", "link": "https://avd.aquasec.com/nvd/cve-2019-10744" }, { "id": "CVE-2019-10744", "package": "lodash", "installed": "1.3.1", "fixed": "4.17.12", "title": "nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties", "link": "https://avd.aquasec.com/nvd/cve-2019-10744" }, { "id": "CVE-2019-10744", "package": "lodash", "installed": "2.4.2", "fixed": "4.17.12", "title": "nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties", "link": "https://avd.aquasec.com/nvd/cve-2019-10744" }, { "id": "CVE-2019-10744", "package": "lodash", "installed": "2.4.2", "fixed": "4.17.12", "title": "nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties", "link": "https://avd.aquasec.com/nvd/cve-2019-10744" }, { "id": "CVE-2019-10744", "package": "lodash", "installed": "2.4.2", "fixed": "4.17.12", "title": "nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties", "link": "https://avd.aquasec.com/nvd/cve-2019-10744" }, { "id": "CVE-2019-10744", "package": "lodash", "installed": "2.4.2", "fixed": "4.17.12", "title": "nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties", "link": "https://avd.aquasec.com/nvd/cve-2019-10744" }, { "id": "CVE-2019-10744", "package": "lodash", "installed": "3.7.0", "fixed": "4.17.12", "title": "nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties", "link": "https://avd.aquasec.com/nvd/cve-2019-10744" }, { "id": "CVE-2019-5413", "package": "morgan", "installed": "1.3.2", "fixed": "1.9.1", "title": "nodejs-morgan: Unescaped input in compile() function", "link": "https://avd.aquasec.com/nvd/cve-2019-5413" }, { "id": "CVE-2020-28282", "package": "getobject", "installed": "0.1.0", "fixed": "1.0.0", "title": "nodejs-getobject: Prototype pollution could result in DoS and RCE", "link": "https://avd.aquasec.com/nvd/cve-2020-28282" }, { "id": "CVE-2020-7769", "package": "nodemailer", "installed": "1.3.0", "fixed": "6.4.16", "title": "This affects the package nodemailer before 6.4.16. Use of crafted reci ...", "link": "https://avd.aquasec.com/nvd/cve-2020-7769" }, { "id": "CVE-2021-23358", "package": "underscore", "installed": "1.6.0", "fixed": "1.12.1", "title": "nodejs-underscore: Arbitrary code execution via the template function", "link": "https://avd.aquasec.com/nvd/cve-2021-23358" }, { "id": "CVE-2021-23358", "package": "underscore", "installed": "1.7.0", "fixed": "1.12.1", "title": "nodejs-underscore: Arbitrary code execution via the template function", "link": "https://avd.aquasec.com/nvd/cve-2021-23358" }, { "id": "CVE-2021-44906", "package": "minimist", "installed": "0.0.8", "fixed": "1.2.6, 0.2.4", "title": "minimist: prototype pollution", "link": "https://avd.aquasec.com/nvd/cve-2021-44906" }, { "id": "CVE-2022-42889", "package": "org.apache.commons:commons-text", "installed": "1.9", "fixed": "1.10.0", "title": "apache-commons-text: variable interpolation RCE", "link": "https://avd.aquasec.com/nvd/cve-2022-42889" }, { "id": "CVE-2025-55130", "package": "nodejs", "installed": "22.15.1-r0", "fixed": "22.22.2-r0", "title": "nodejs: Nodejs file permissions bypass", "link": "https://avd.aquasec.com/nvd/cve-2025-55130" }, { "id": "CVE-2025-7783", "package": "form-data", "installed": "0.1.2", "fixed": "2.5.4, 3.0.4, 4.0.4", "title": "form-data: Unsafe random function in form-data", "link": "https://avd.aquasec.com/nvd/cve-2025-7783" }, { "id": "CVE-2025-7783", "package": "form-data", "installed": "0.1.4", "fixed": "2.5.4, 3.0.4, 4.0.4", "title": "form-data: Unsafe random function in form-data", "link": "https://avd.aquasec.com/nvd/cve-2025-7783" }, { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.1.0-r2", "fixed": "1.1.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-31789", "package": "libcrypto3", "installed": "3.3.5-r0", "fixed": "3.3.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "libssl3", "installed": "3.3.5-r0", "fixed": "3.3.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "openssl", "installed": "3.3.5-r0", "fixed": "3.3.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-33845", "package": "gnutls", "installed": "3.8.8-r0", "fixed": "3.8.13-r0", "title": "gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment", "link": "https://avd.aquasec.com/nvd/cve-2026-33845" }, { "id": "CVE-2026-42010", "package": "gnutls", "installed": "3.8.8-r0", "fixed": "3.8.13-r0", "title": "gnutls: gnutls: Authentication Bypass via NUL Character in Username", "link": "https://avd.aquasec.com/nvd/cve-2026-42010" }, { "id": "CVE-2026-44170", "package": "mariadb-client", "installed": "11.4.8-r0", "fixed": "11.4.11-r0", "title": "mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine", "link": "https://avd.aquasec.com/nvd/cve-2026-44170" }, { "id": "CVE-2026-44170", "package": "mariadb-common", "installed": "11.4.8-r0", "fixed": "11.4.11-r0", "title": "mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine", "link": "https://avd.aquasec.com/nvd/cve-2026-44170" }, { "id": "CVE-2026-44170", "package": "mysql-client", "installed": "11.4.8-r0", "fixed": "11.4.11-r0", "title": "mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine", "link": "https://avd.aquasec.com/nvd/cve-2026-44170" }, { "id": "CVE-2026-44172", "package": "mariadb-client", "installed": "11.4.8-r0", "fixed": "11.4.11-r0", "title": "mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()", "link": "https://avd.aquasec.com/nvd/cve-2026-44172" }, { "id": "CVE-2026-44172", "package": "mariadb-common", "installed": "11.4.8-r0", "fixed": "11.4.11-r0", "title": "mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()", "link": "https://avd.aquasec.com/nvd/cve-2026-44172" }, { "id": "CVE-2026-44172", "package": "mysql-client", "installed": "11.4.8-r0", "fixed": "11.4.11-r0", "title": "mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()", "link": "https://avd.aquasec.com/nvd/cve-2026-44172" }, { "id": "CVE-2026-48930", "package": "nodejs", "installed": "22.15.1-r0", "fixed": "22.23.0-r0", "title": "nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling", "link": "https://avd.aquasec.com/nvd/cve-2026-48930" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/ccsdk-dgbuilder-image:2.2.0" }, { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3" }, { "critical": 10, "high": 59, "fixable_critical": 10, "fixable_high": 59, "cves": [ { "id": "CVE-2021-36159", "package": "apk-tools", "installed": "2.10.5-r1", "fixed": "2.10.7-r0", "title": "libfetch: an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes leads to information leak or crash", "link": "https://avd.aquasec.com/nvd/cve-2021-36159" }, { "id": "CVE-2022-22822", "package": "expat", "installed": "2.2.9-r1", "fixed": "2.2.10-r0", "title": "expat: Integer overflow in addBinding in xmlparse.c", "link": "https://avd.aquasec.com/nvd/cve-2022-22822" }, { "id": "CVE-2022-22823", "package": "expat", "installed": "2.2.9-r1", "fixed": "2.2.10-r0", "title": "expat: Expat: Denial of Service vulnerability in XML parsing", "link": "https://avd.aquasec.com/nvd/cve-2022-22823" }, { "id": "CVE-2022-22824", "package": "expat", "installed": "2.2.9-r1", "fixed": "2.2.10-r0", "title": "expat: Expat: Denial of service and memory issues due to integer overflow", "link": "https://avd.aquasec.com/nvd/cve-2022-22824" }, { "id": "CVE-2022-23852", "package": "expat", "installed": "2.2.9-r1", "fixed": "2.2.10-r1", "title": "expat: Integer overflow in function XML_GetBuffer", "link": "https://avd.aquasec.com/nvd/cve-2022-23852" }, { "id": "CVE-2022-25235", "package": "expat", "installed": "2.2.9-r1", "fixed": "2.2.10-r2", "title": "expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution", "link": "https://avd.aquasec.com/nvd/cve-2022-25235" }, { "id": "CVE-2022-25236", "package": "expat", "installed": "2.2.9-r1", "fixed": "2.2.10-r2", "title": "expat: Namespace-separator characters in \"xmlns[:prefix]\" attribute values can lead to arbitrary code execution", "link": "https://avd.aquasec.com/nvd/cve-2022-25236" }, { "id": "CVE-2022-25315", "package": "expat", "installed": "2.2.9-r1", "fixed": "2.2.10-r2", "title": "expat: Integer overflow in storeRawNames()", "link": "https://avd.aquasec.com/nvd/cve-2022-25315" }, { "id": "CVE-2022-37434", "package": "zlib", "installed": "1.2.11-r3", "fixed": "1.2.12-r2", "title": "zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field", "link": "https://avd.aquasec.com/nvd/cve-2022-37434" }, { "id": "GHSA-6q48-6c7w-9gw2", "package": "certifi", "installed": "2026.2.25", "fixed": "2026.10.18", "title": "certifi bundles emSign root CAs with compromised intermediate CA keys", "link": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/sdnc-ansible-server-image:3.2.4" }, { "critical": 71, "high": 385, "fixable_critical": 53, "fixable_high": 365, "cves": [ { "id": "CVE-2016-1000027", "package": "org.springframework:spring-web", "installed": "5.2.12.RELEASE", "fixed": "6.0.0", "title": "spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization", "link": "https://avd.aquasec.com/nvd/cve-2016-1000027" }, { "id": "CVE-2016-1000027", "package": "org.springframework:spring-web", "installed": "5.2.12.RELEASE", "fixed": "6.0.0", "title": "spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization", "link": "https://avd.aquasec.com/nvd/cve-2016-1000027" }, { "id": "CVE-2019-17571", "package": "log4j:log4j", "installed": "1.2.17", "fixed": "", "title": "log4j: deserialization of untrusted data in SocketServer", "link": "https://avd.aquasec.com/nvd/cve-2019-17571" }, { "id": "CVE-2019-17571", "package": "log4j:log4j", "installed": "1.2.17", "fixed": "", "title": "log4j: deserialization of untrusted data in SocketServer", "link": "https://avd.aquasec.com/nvd/cve-2019-17571" }, { "id": "CVE-2019-17571", "package": "log4j:log4j", "installed": "1.2.17", "fixed": "", "title": "log4j: deserialization of untrusted data in SocketServer", "link": "https://avd.aquasec.com/nvd/cve-2019-17571" }, { "id": "CVE-2019-17571", "package": "log4j:log4j", "installed": "1.2.17", "fixed": "", "title": "log4j: deserialization of untrusted data in SocketServer", "link": "https://avd.aquasec.com/nvd/cve-2019-17571" }, { "id": "CVE-2019-17571", "package": "log4j:log4j", "installed": "1.2.17", "fixed": "", "title": "log4j: deserialization of untrusted data in SocketServer", "link": "https://avd.aquasec.com/nvd/cve-2019-17571" }, { "id": "CVE-2019-17571", "package": "log4j:log4j", "installed": "1.2.17", "fixed": "", "title": "log4j: deserialization of untrusted data in SocketServer", "link": "https://avd.aquasec.com/nvd/cve-2019-17571" }, { "id": "CVE-2020-11989", "package": "org.apache.shiro:shiro-core", "installed": "1.3.2", "fixed": "1.5.3", "title": "shiro: spring dynamic controllers, a specially crafted request may cause an authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2020-11989" }, { "id": "CVE-2020-11989", "package": "org.apache.shiro:shiro-core", "installed": "1.3.2", "fixed": "1.5.3", "title": "shiro: spring dynamic controllers, a specially crafted request may cause an authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2020-11989" }, { "id": "CVE-2020-11989", "package": "org.apache.shiro:shiro-core", "installed": "1.3.2", "fixed": "1.5.3", "title": "shiro: spring dynamic controllers, a specially crafted request may cause an authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2020-11989" }, { "id": "CVE-2020-11989", "package": "org.apache.shiro:shiro-core", "installed": "1.3.2", "fixed": "1.5.3", "title": "shiro: spring dynamic controllers, a specially crafted request may cause an authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2020-11989" }, { "id": "CVE-2020-1957", "package": "org.apache.shiro:shiro-core", "installed": "1.3.2", "fixed": "1.5.2", "title": "shiro: Spring dynamic controllers, a specially crafted request may cause an authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2020-1957" }, { "id": "CVE-2020-1957", "package": "org.apache.shiro:shiro-core", "installed": "1.3.2", "fixed": "1.5.2", "title": "shiro: Spring dynamic controllers, a specially crafted request may cause an authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2020-1957" }, { "id": "CVE-2020-1957", "package": "org.apache.shiro:shiro-core", "installed": "1.3.2", "fixed": "1.5.2", "title": "shiro: Spring dynamic controllers, a specially crafted request may cause an authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2020-1957" }, { "id": "CVE-2020-1957", "package": "org.apache.shiro:shiro-core", "installed": "1.3.2", "fixed": "1.5.2", "title": "shiro: Spring dynamic controllers, a specially crafted request may cause an authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2020-1957" }, { "id": "CVE-2021-41303", "package": "org.apache.shiro:shiro-core", "installed": "1.3.2", "fixed": "1.8.0", "title": "shiro: specially crafted HTTP request may cause an authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2021-41303" }, { "id": "CVE-2021-41303", "package": "org.apache.shiro:shiro-core", "installed": "1.3.2", "fixed": "1.8.0", "title": "shiro: specially crafted HTTP request may cause an authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2021-41303" }, { "id": "CVE-2021-41303", "package": "org.apache.shiro:shiro-core", "installed": "1.3.2", "fixed": "1.8.0", "title": "shiro: specially crafted HTTP request may cause an authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2021-41303" }, { "id": "CVE-2021-41303", "package": "org.apache.shiro:shiro-core", "installed": "1.3.2", "fixed": "1.8.0", "title": "shiro: specially crafted HTTP request may cause an authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2021-41303" }, { "id": "CVE-2022-22965", "package": "org.springframework:spring-beans", "installed": "5.2.12.RELEASE", "fixed": "5.2.20.RELEASE, 5.3.18", "title": "spring-framework: RCE via Data Binding on JDK 9+", "link": "https://avd.aquasec.com/nvd/cve-2022-22965" }, { "id": "CVE-2022-22965", "package": "org.springframework:spring-beans", "installed": "5.2.12.RELEASE", "fixed": "5.2.20.RELEASE, 5.3.18", "title": "spring-framework: RCE via Data Binding on JDK 9+", "link": "https://avd.aquasec.com/nvd/cve-2022-22965" }, { "id": "CVE-2022-23305", "package": "log4j:log4j", "installed": "1.2.17", "fixed": "", "title": "log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender", "link": "https://avd.aquasec.com/nvd/cve-2022-23305" }, { "id": "CVE-2022-23305", "package": "log4j:log4j", "installed": "1.2.17", "fixed": "", "title": "log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender", "link": "https://avd.aquasec.com/nvd/cve-2022-23305" }, { "id": "CVE-2022-23305", "package": "log4j:log4j", "installed": "1.2.17", "fixed": "", "title": "log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender", "link": "https://avd.aquasec.com/nvd/cve-2022-23305" }, { "id": "CVE-2022-23305", "package": "log4j:log4j", "installed": "1.2.17", "fixed": "", "title": "log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender", "link": "https://avd.aquasec.com/nvd/cve-2022-23305" }, { "id": "CVE-2022-23305", "package": "log4j:log4j", "installed": "1.2.17", "fixed": "", "title": "log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender", "link": "https://avd.aquasec.com/nvd/cve-2022-23305" }, { "id": "CVE-2022-23305", "package": "log4j:log4j", "installed": "1.2.17", "fixed": "", "title": "log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender", "link": "https://avd.aquasec.com/nvd/cve-2022-23305" }, { "id": "CVE-2022-23307", "package": "log4j:log4j", "installed": "1.2.17", "fixed": "", "title": "log4j: Unsafe deserialization flaw in Chainsaw log viewer", "link": "https://avd.aquasec.com/nvd/cve-2022-23307" }, { "id": "CVE-2022-23307", "package": "log4j:log4j", "installed": "1.2.17", "fixed": "", "title": "log4j: Unsafe deserialization flaw in Chainsaw log viewer", "link": "https://avd.aquasec.com/nvd/cve-2022-23307" }, { "id": "CVE-2022-23307", "package": "log4j:log4j", "installed": "1.2.17", "fixed": "", "title": "log4j: Unsafe deserialization flaw in Chainsaw log viewer", "link": "https://avd.aquasec.com/nvd/cve-2022-23307" }, { "id": "CVE-2022-23307", "package": "log4j:log4j", "installed": "1.2.17", "fixed": "", "title": "log4j: Unsafe deserialization flaw in Chainsaw log viewer", "link": "https://avd.aquasec.com/nvd/cve-2022-23307" }, { "id": "CVE-2022-23307", "package": "log4j:log4j", "installed": "1.2.17", "fixed": "", "title": "log4j: Unsafe deserialization flaw in Chainsaw log viewer", "link": "https://avd.aquasec.com/nvd/cve-2022-23307" }, { "id": "CVE-2022-23307", "package": "log4j:log4j", "installed": "1.2.17", "fixed": "", "title": "log4j: Unsafe deserialization flaw in Chainsaw log viewer", "link": "https://avd.aquasec.com/nvd/cve-2022-23307" }, { "id": "CVE-2022-32532", "package": "org.apache.shiro:shiro-core", "installed": "1.3.2", "fixed": "1.9.1", "title": "shiro: authorization bypass due to possible misconfigured", "link": "https://avd.aquasec.com/nvd/cve-2022-32532" }, { "id": "CVE-2022-32532", "package": "org.apache.shiro:shiro-core", "installed": "1.3.2", "fixed": "1.9.1", "title": "shiro: authorization bypass due to possible misconfigured", "link": "https://avd.aquasec.com/nvd/cve-2022-32532" }, { "id": "CVE-2022-32532", "package": "org.apache.shiro:shiro-core", "installed": "1.3.2", "fixed": "1.9.1", "title": "shiro: authorization bypass due to possible misconfigured", "link": "https://avd.aquasec.com/nvd/cve-2022-32532" }, { "id": "CVE-2022-32532", "package": "org.apache.shiro:shiro-core", "installed": "1.3.2", "fixed": "1.9.1", "title": "shiro: authorization bypass due to possible misconfigured", "link": "https://avd.aquasec.com/nvd/cve-2022-32532" }, { "id": "CVE-2022-40664", "package": "org.apache.shiro:shiro-core", "installed": "1.3.2", "fixed": "1.10.0", "title": "shiro: Authentication Bypass Vulnerability", "link": "https://avd.aquasec.com/nvd/cve-2022-40664" }, { "id": "CVE-2022-40664", "package": "org.apache.shiro:shiro-core", "installed": "1.3.2", "fixed": "1.10.0", "title": "shiro: Authentication Bypass Vulnerability", "link": "https://avd.aquasec.com/nvd/cve-2022-40664" }, { "id": "CVE-2022-40664", "package": "org.apache.shiro:shiro-core", "installed": "1.3.2", "fixed": "1.10.0", "title": "shiro: Authentication Bypass Vulnerability", "link": "https://avd.aquasec.com/nvd/cve-2022-40664" }, { "id": "CVE-2022-40664", "package": "org.apache.shiro:shiro-core", "installed": "1.3.2", "fixed": "1.10.0", "title": "shiro: Authentication Bypass Vulnerability", "link": "https://avd.aquasec.com/nvd/cve-2022-40664" }, { "id": "CVE-2022-42889", "package": "org.apache.commons:commons-text", "installed": "1.9", "fixed": "1.10.0", "title": "apache-commons-text: variable interpolation RCE", "link": "https://avd.aquasec.com/nvd/cve-2022-42889" }, { "id": "CVE-2022-42889", "package": "org.apache.commons:commons-text", "installed": "1.9", "fixed": "1.10.0", "title": "apache-commons-text: variable interpolation RCE", "link": "https://avd.aquasec.com/nvd/cve-2022-42889" }, { "id": "CVE-2022-42889", "package": "org.apache.commons:commons-text", "installed": "1.9", "fixed": "1.10.0", "title": "apache-commons-text: variable interpolation RCE", "link": "https://avd.aquasec.com/nvd/cve-2022-42889" }, { "id": "CVE-2022-42889", "package": "org.apache.commons:commons-text", "installed": "1.9", "fixed": "1.10.0", "title": "apache-commons-text: variable interpolation RCE", "link": "https://avd.aquasec.com/nvd/cve-2022-42889" }, { "id": "CVE-2025-14813", "package": "org.bouncycastle:bcprov-jdk18on", "installed": "1.80", "fixed": "1.80.2, 1.81.1, 1.84", "title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly", "link": "https://avd.aquasec.com/nvd/cve-2025-14813" }, { "id": "CVE-2025-14813", "package": "org.bouncycastle:bcprov-jdk18on", "installed": "1.80", "fixed": "1.80.2, 1.81.1, 1.84", "title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly", "link": "https://avd.aquasec.com/nvd/cve-2025-14813" }, { "id": "CVE-2025-14813", "package": "org.bouncycastle:bcprov-jdk18on", "installed": "1.80", "fixed": "1.80.2, 1.81.1, 1.84", "title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly", "link": "https://avd.aquasec.com/nvd/cve-2025-14813" }, { "id": "CVE-2025-3277", "package": "sqlite-libs", "installed": "3.48.0-r0", "fixed": "3.48.0-r1", "title": "SQLite: integer overflow in SQLite", "link": "https://avd.aquasec.com/nvd/cve-2025-3277" }, { "id": "CVE-2025-55130", "package": "nodejs", "installed": "22.15.1-r0", "fixed": "22.22.2-r0", "title": "nodejs: Nodejs file permissions bypass", "link": "https://avd.aquasec.com/nvd/cve-2025-55130" }, { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.1.0-r2", "fixed": "1.1.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-31789", "package": "libcrypto3", "installed": "3.3.3-r0", "fixed": "3.3.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "libssl3", "installed": "3.3.3-r0", "fixed": "3.3.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "openssl", "installed": "3.3.3-r0", "fixed": "3.3.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-33701", "package": "io.opentelemetry.javaagent:opentelemetry-javaagent", "installed": "2.24.0", "fixed": "2.26.1", "title": "io.opentelemetry.javaagent/opentelemetry-javaagent: OpenTelemetry Java Instrumentation: Remote code execution via deserialization vulnerability in RMI", "link": "https://avd.aquasec.com/nvd/cve-2026-33701" }, { "id": "CVE-2026-33845", "package": "gnutls", "installed": "3.8.8-r0", "fixed": "3.8.13-r0", "title": "gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment", "link": "https://avd.aquasec.com/nvd/cve-2026-33845" }, { "id": "CVE-2026-42010", "package": "gnutls", "installed": "3.8.8-r0", "fixed": "3.8.13-r0", "title": "gnutls: gnutls: Authentication Bypass via NUL Character in Username", "link": "https://avd.aquasec.com/nvd/cve-2026-42010" }, { "id": "CVE-2026-44170", "package": "mariadb-client", "installed": "11.4.8-r0", "fixed": "11.4.11-r0", "title": "mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine", "link": "https://avd.aquasec.com/nvd/cve-2026-44170" }, { "id": "CVE-2026-44170", "package": "mariadb-common", "installed": "11.4.8-r0", "fixed": "11.4.11-r0", "title": "mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine", "link": "https://avd.aquasec.com/nvd/cve-2026-44170" }, { "id": "CVE-2026-44170", "package": "mysql-client", "installed": "11.4.8-r0", "fixed": "11.4.11-r0", "title": "mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine", "link": "https://avd.aquasec.com/nvd/cve-2026-44170" }, { "id": "CVE-2026-44172", "package": "mariadb-client", "installed": "11.4.8-r0", "fixed": "11.4.11-r0", "title": "mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()", "link": "https://avd.aquasec.com/nvd/cve-2026-44172" }, { "id": "CVE-2026-44172", "package": "mariadb-common", "installed": "11.4.8-r0", "fixed": "11.4.11-r0", "title": "mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()", "link": "https://avd.aquasec.com/nvd/cve-2026-44172" }, { "id": "CVE-2026-44172", "package": "mysql-client", "installed": "11.4.8-r0", "fixed": "11.4.11-r0", "title": "mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()", "link": "https://avd.aquasec.com/nvd/cve-2026-44172" }, { "id": "CVE-2026-48930", "package": "nodejs", "installed": "22.15.1-r0", "fixed": "22.23.0-r0", "title": "nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling", "link": "https://avd.aquasec.com/nvd/cve-2026-48930" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.119.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.119.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.68.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "id": "CVE-2026-8763", "package": "org.bouncycastle:bcprov-jdk18on", "installed": "1.80", "fixed": "1.85", "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI", "link": "https://avd.aquasec.com/nvd/cve-2026-8763" }, { "id": "CVE-2026-8763", "package": "org.bouncycastle:bcprov-jdk18on", "installed": "1.80", "fixed": "1.85", "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI", "link": "https://avd.aquasec.com/nvd/cve-2026-8763" }, { "id": "CVE-2026-8763", "package": "org.bouncycastle:bcprov-jdk18on", "installed": "1.80", "fixed": "1.85", "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI", "link": "https://avd.aquasec.com/nvd/cve-2026-8763" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/sdnc-image:3.2.4" }, { "critical": 15, "high": 186, "fixable_critical": 15, "fixable_high": 184, "cves": [ { "id": "CVE-2025-3277", "package": "sqlite-libs", "installed": "3.48.0-r0", "fixed": "3.48.0-r1", "title": "SQLite: integer overflow in SQLite", "link": "https://avd.aquasec.com/nvd/cve-2025-3277" }, { "id": "CVE-2025-55130", "package": "nodejs", "installed": "22.15.1-r0", "fixed": "22.22.2-r0", "title": "nodejs: Nodejs file permissions bypass", "link": "https://avd.aquasec.com/nvd/cve-2025-55130" }, { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.1.0-r2", "fixed": "1.1.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-31789", "package": "libcrypto3", "installed": "3.3.3-r0", "fixed": "3.3.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "libssl3", "installed": "3.3.3-r0", "fixed": "3.3.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "openssl", "installed": "3.3.3-r0", "fixed": "3.3.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-33845", "package": "gnutls", "installed": "3.8.8-r0", "fixed": "3.8.13-r0", "title": "gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment", "link": "https://avd.aquasec.com/nvd/cve-2026-33845" }, { "id": "CVE-2026-42010", "package": "gnutls", "installed": "3.8.8-r0", "fixed": "3.8.13-r0", "title": "gnutls: gnutls: Authentication Bypass via NUL Character in Username", "link": "https://avd.aquasec.com/nvd/cve-2026-42010" }, { "id": "CVE-2026-44170", "package": "mariadb-client", "installed": "11.4.8-r0", "fixed": "11.4.11-r0", "title": "mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine", "link": "https://avd.aquasec.com/nvd/cve-2026-44170" }, { "id": "CVE-2026-44170", "package": "mariadb-common", "installed": "11.4.8-r0", "fixed": "11.4.11-r0", "title": "mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine", "link": "https://avd.aquasec.com/nvd/cve-2026-44170" }, { "id": "CVE-2026-44170", "package": "mysql-client", "installed": "11.4.8-r0", "fixed": "11.4.11-r0", "title": "mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine", "link": "https://avd.aquasec.com/nvd/cve-2026-44170" }, { "id": "CVE-2026-44172", "package": "mariadb-client", "installed": "11.4.8-r0", "fixed": "11.4.11-r0", "title": "mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()", "link": "https://avd.aquasec.com/nvd/cve-2026-44172" }, { "id": "CVE-2026-44172", "package": "mariadb-common", "installed": "11.4.8-r0", "fixed": "11.4.11-r0", "title": "mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()", "link": "https://avd.aquasec.com/nvd/cve-2026-44172" }, { "id": "CVE-2026-44172", "package": "mysql-client", "installed": "11.4.8-r0", "fixed": "11.4.11-r0", "title": "mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()", "link": "https://avd.aquasec.com/nvd/cve-2026-44172" }, { "id": "CVE-2026-48930", "package": "nodejs", "installed": "22.15.1-r0", "fixed": "22.23.0-r0", "title": "nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling", "link": "https://avd.aquasec.com/nvd/cve-2026-48930" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/sdnc-ueb-listener-image:3.2.4" }, { "critical": 21, "high": 202, "fixable_critical": 18, "fixable_high": 145, "cves": [ { "id": "CVE-2023-45853", "package": "zlib1g", "installed": "1:1.2.13.dfsg-1", "fixed": "", "title": "zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6", "link": "https://avd.aquasec.com/nvd/cve-2023-45853" }, { "id": "CVE-2024-56171", "package": "libxml2", "installed": "2.9.14+dfsg-1.3~deb12u1", "fixed": "2.9.14+dfsg-1.3~deb12u2", "title": "libxml2: Use-After-Free in libxml2", "link": "https://avd.aquasec.com/nvd/cve-2024-56171" }, { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.21.11", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2025-7458", "package": "libsqlite3-0", "installed": "3.40.1-2+deb12u2", "fixed": "", "title": "sqlite: SQLite integer overflow", "link": "https://avd.aquasec.com/nvd/cve-2025-7458" }, { "id": "CVE-2026-13221", "package": "libperl5.36", "installed": "5.36.0-7+deb12u1", "fixed": "5.36.0-7+deb12u4", "title": "perl: Perl: Incorrect regular expression processing via large regular expressions", "link": "https://avd.aquasec.com/nvd/cve-2026-13221" }, { "id": "CVE-2026-13221", "package": "perl", "installed": "5.36.0-7+deb12u1", "fixed": "5.36.0-7+deb12u4", "title": "perl: Perl: Incorrect regular expression processing via large regular expressions", "link": "https://avd.aquasec.com/nvd/cve-2026-13221" }, { "id": "CVE-2026-13221", "package": "perl-base", "installed": "5.36.0-7+deb12u1", "fixed": "5.36.0-7+deb12u4", "title": "perl: Perl: Incorrect regular expression processing via large regular expressions", "link": "https://avd.aquasec.com/nvd/cve-2026-13221" }, { "id": "CVE-2026-13221", "package": "perl-modules-5.36", "installed": "5.36.0-7+deb12u1", "fixed": "5.36.0-7+deb12u4", "title": "perl: Perl: Incorrect regular expression processing via large regular expressions", "link": "https://avd.aquasec.com/nvd/cve-2026-13221" }, { "id": "CVE-2026-31789", "package": "libssl3", "installed": "3.0.18-1~deb12u2", "fixed": "3.0.19-1~deb12u2", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "openssl", "installed": "3.0.18-1~deb12u2", "fixed": "3.0.19-1~deb12u2", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-33845", "package": "libgnutls30", "installed": "3.7.9-2+deb12u2", "fixed": "3.7.9-2+deb12u7", "title": "gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment", "link": "https://avd.aquasec.com/nvd/cve-2026-33845" }, { "id": "CVE-2026-42010", "package": "libgnutls30", "installed": "3.7.9-2+deb12u2", "fixed": "3.7.9-2+deb12u7", "title": "gnutls: gnutls: Authentication Bypass via NUL Character in Username", "link": "https://avd.aquasec.com/nvd/cve-2026-42010" }, { "id": "CVE-2026-42496", "package": "libperl5.36", "installed": "5.36.0-7+deb12u1", "fixed": "5.36.0-7+deb12u4", "title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access", "link": "https://avd.aquasec.com/nvd/cve-2026-42496" }, { "id": "CVE-2026-42496", "package": "perl", "installed": "5.36.0-7+deb12u1", "fixed": "5.36.0-7+deb12u4", "title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access", "link": "https://avd.aquasec.com/nvd/cve-2026-42496" }, { "id": "CVE-2026-42496", "package": "perl-base", "installed": "5.36.0-7+deb12u1", "fixed": "5.36.0-7+deb12u4", "title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access", "link": "https://avd.aquasec.com/nvd/cve-2026-42496" }, { "id": "CVE-2026-42496", "package": "perl-modules-5.36", "installed": "5.36.0-7+deb12u1", "fixed": "5.36.0-7+deb12u4", "title": "perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access", "link": "https://avd.aquasec.com/nvd/cve-2026-42496" }, { "id": "CVE-2026-6653", "package": "libxml2", "installed": "2.9.14+dfsg-1.3~deb12u1", "fixed": "", "title": "libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free", "link": "https://avd.aquasec.com/nvd/cve-2026-6653" }, { "id": "CVE-2026-8376", "package": "libperl5.36", "installed": "5.36.0-7+deb12u1", "fixed": "5.36.0-7+deb12u4", "title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds", "link": "https://avd.aquasec.com/nvd/cve-2026-8376" }, { "id": "CVE-2026-8376", "package": "perl", "installed": "5.36.0-7+deb12u1", "fixed": "5.36.0-7+deb12u4", "title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds", "link": "https://avd.aquasec.com/nvd/cve-2026-8376" }, { "id": "CVE-2026-8376", "package": "perl-base", "installed": "5.36.0-7+deb12u1", "fixed": "5.36.0-7+deb12u4", "title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds", "link": "https://avd.aquasec.com/nvd/cve-2026-8376" }, { "id": "CVE-2026-8376", "package": "perl-modules-5.36", "installed": "5.36.0-7+deb12u1", "fixed": "5.36.0-7+deb12u4", "title": "perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds", "link": "https://avd.aquasec.com/nvd/cve-2026-8376" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/sdnc-web-image:3.2.4" } ] }, { "name": "so", "datastore": false, "images": [ { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/hub.docker.com/busybox:1.37.0" }, { "critical": 4, "high": 65, "fixable_critical": 4, "fixable_high": 65, "cves": [ { "id": "CVE-2023-24538", "package": "stdlib", "installed": "v1.18.2", "fixed": "1.19.8, 1.20.3", "title": "golang: html/template: backticks not treated as string delimiters", "link": "https://avd.aquasec.com/nvd/cve-2023-24538" }, { "id": "CVE-2023-24540", "package": "stdlib", "installed": "v1.18.2", "fixed": "1.19.9, 1.20.4", "title": "golang: html/template: improper handling of JavaScript whitespace", "link": "https://avd.aquasec.com/nvd/cve-2023-24540" }, { "id": "CVE-2024-24790", "package": "stdlib", "installed": "v1.18.2", "fixed": "1.21.11, 1.22.4", "title": "golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses", "link": "https://avd.aquasec.com/nvd/cve-2024-24790" }, { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.18.2", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" } ], "ref": "artifactory.devops.telekom.de/hub.docker.com/mariadb:11.7.2" }, { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3" }, { "critical": 10, "high": 18, "fixable_critical": 10, "fixable_high": 18, "cves": [ { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r1", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webflux", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-47892", "package": "org.springframework:spring-webflux", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints", "link": "https://avd.aquasec.com/nvd/cve-2026-47892" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.135.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/so/api-handler-infra:1.22.0" }, { "critical": 10, "high": 23, "fixable_critical": 10, "fixable_high": 23, "cves": [ { "id": "CVE-2018-1000844", "package": "com.squareup.retrofit2:retrofit", "installed": "2.3.0", "fixed": "2.5.0", "title": "retrofit: XML external entity processing vulnerability in JAXB", "link": "https://avd.aquasec.com/nvd/cve-2018-1000844" }, { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r1", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-49875", "package": "org.apache.cxf:cxf-core", "installed": "4.0.5", "fixed": "4.2.2, 4.1.7, 3.6.12", "title": "cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening", "link": "https://avd.aquasec.com/nvd/cve-2026-49875" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.135.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/so/bpmn-infra:1.22.0" }, { "critical": 7, "high": 13, "fixable_critical": 7, "fixable_high": 13, "cves": [ { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r1", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/so/catalog-db-adapter:1.22.0" }, { "critical": 8, "high": 15, "fixable_critical": 8, "fixable_high": 15, "cves": [ { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r1", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-49875", "package": "org.apache.cxf:cxf-core", "installed": "4.0.5", "fixed": "4.2.2, 4.1.7, 3.6.12", "title": "cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening", "link": "https://avd.aquasec.com/nvd/cve-2026-49875" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/so/openstack-adapter:1.22.0" }, { "critical": 8, "high": 17, "fixable_critical": 8, "fixable_high": 17, "cves": [ { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r1", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-49875", "package": "org.apache.cxf:cxf-core", "installed": "4.0.5", "fixed": "4.2.2, 4.1.7, 3.6.12", "title": "cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening", "link": "https://avd.aquasec.com/nvd/cve-2026-49875" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/so/request-db-adapter:1.22.0" }, { "critical": 7, "high": 13, "fixable_critical": 7, "fixable_high": 13, "cves": [ { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r1", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/so/sdc-controller:1.22.0" }, { "critical": 8, "high": 17, "fixable_critical": 8, "fixable_high": 17, "cves": [ { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r1", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-49875", "package": "org.apache.cxf:cxf-core", "installed": "4.0.5", "fixed": "4.2.2, 4.1.7, 3.6.12", "title": "cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening", "link": "https://avd.aquasec.com/nvd/cve-2026-49875" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/so/sdnc-adapter:1.22.0" }, { "critical": 26, "high": 203, "fixable_critical": 26, "fixable_high": 202, "cves": [ { "id": "CVE-2016-1000027", "package": "org.springframework:spring-web", "installed": "5.2.12.RELEASE", "fixed": "6.0.0", "title": "spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization", "link": "https://avd.aquasec.com/nvd/cve-2016-1000027" }, { "id": "CVE-2019-20444", "package": "io.netty:netty-codec-http", "installed": "4.1.42.Final", "fixed": "4.1.44", "title": "netty: HTTP request smuggling", "link": "https://avd.aquasec.com/nvd/cve-2019-20444" }, { "id": "CVE-2022-22965", "package": "org.springframework.boot:spring-boot-starter-web", "installed": "2.3.7.RELEASE", "fixed": "2.5.12, 2.6.6", "title": "spring-framework: RCE via Data Binding on JDK 9+", "link": "https://avd.aquasec.com/nvd/cve-2022-22965" }, { "id": "CVE-2022-22965", "package": "org.springframework:spring-beans", "installed": "5.2.12.RELEASE", "fixed": "5.2.20.RELEASE, 5.3.18", "title": "spring-framework: RCE via Data Binding on JDK 9+", "link": "https://avd.aquasec.com/nvd/cve-2022-22965" }, { "id": "CVE-2022-22965", "package": "org.springframework:spring-webmvc", "installed": "5.2.12.RELEASE", "fixed": "5.2.20.RELEASE, 5.3.18", "title": "spring-framework: RCE via Data Binding on JDK 9+", "link": "https://avd.aquasec.com/nvd/cve-2022-22965" }, { "id": "CVE-2022-22978", "package": "org.springframework.security:spring-security-core", "installed": "5.3.6.RELEASE", "fixed": "5.5.7, 5.6.4, 5.4.11", "title": "springframework: Authorization Bypass in RegexRequestMatcher", "link": "https://avd.aquasec.com/nvd/cve-2022-22978" }, { "id": "CVE-2022-22978", "package": "org.springframework.security:spring-security-web", "installed": "5.3.6.RELEASE", "fixed": "5.5.7, 5.6.4, 5.4.11", "title": "springframework: Authorization Bypass in RegexRequestMatcher", "link": "https://avd.aquasec.com/nvd/cve-2022-22978" }, { "id": "CVE-2023-20873", "package": "org.springframework.boot:spring-boot-actuator-autoconfigure", "installed": "2.3.7.RELEASE", "fixed": "3.0.6, 2.7.11, 2.6.15, 2.5.15", "title": "spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry", "link": "https://avd.aquasec.com/nvd/cve-2023-20873" }, { "id": "CVE-2024-38821", "package": "org.springframework.security:spring-security-web", "installed": "5.3.6.RELEASE", "fixed": "5.7.13, 5.8.15, 6.2.7, 6.0.13, 6.1.11, 6.3.4", "title": "Spring-WebFlux: Authorization Bypass of Static Resources in WebFlux Applications", "link": "https://avd.aquasec.com/nvd/cve-2024-38821" }, { "id": "CVE-2025-24813", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.41", "fixed": "11.0.3, 10.1.35, 9.0.99", "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "link": "https://avd.aquasec.com/nvd/cve-2025-24813" }, { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.1.0-r2", "fixed": "1.1.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-22732", "package": "org.springframework.security:spring-security-web", "installed": "5.3.6.RELEASE", "fixed": "6.5.9, 7.0.4", "title": "Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers", "link": "https://avd.aquasec.com/nvd/cve-2026-22732" }, { "id": "CVE-2026-31789", "package": "libcrypto3", "installed": "3.3.3-r0", "fixed": "3.3.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "libssl3", "installed": "3.3.3-r0", "fixed": "3.3.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "openssl", "installed": "3.3.3-r0", "fixed": "3.3.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-33845", "package": "gnutls", "installed": "3.8.8-r0", "fixed": "3.8.13-r0", "title": "gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment", "link": "https://avd.aquasec.com/nvd/cve-2026-33845" }, { "id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.41", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "link": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "id": "CVE-2026-42010", "package": "gnutls", "installed": "3.8.8-r0", "fixed": "3.8.13-r0", "title": "gnutls: gnutls: Authentication Bypass via NUL Character in Username", "link": "https://avd.aquasec.com/nvd/cve-2026-42010" }, { "id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.41", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "link": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.41", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "5.2.12.RELEASE", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.41", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.41", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "9.0.41", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.42.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.55.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/so/so-admin-cockpit:1.10.0" }, { "critical": 8, "high": 17, "fixable_critical": 8, "fixable_high": 17, "cves": [ { "id": "CVE-2026-33701", "package": "io.opentelemetry.javaagent:opentelemetry-javaagent", "installed": "2.25.0", "fixed": "2.26.1", "title": "io.opentelemetry.javaagent/opentelemetry-javaagent: OpenTelemetry Java Instrumentation: Remote code execution via deserialization vulnerability in RMI", "link": "https://avd.aquasec.com/nvd/cve-2026-33701" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-49875", "package": "org.apache.cxf:cxf-core", "installed": "4.0.5", "fixed": "4.2.2, 4.1.7, 3.6.12", "title": "cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening", "link": "https://avd.aquasec.com/nvd/cve-2026-49875" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/so/so-cnf-adapter:1.17.2" }, { "critical": 22, "high": 204, "fixable_critical": 22, "fixable_high": 202, "cves": [ { "id": "CVE-2022-1996", "package": "github.com/emicklei/go-restful", "installed": "v2.9.5+incompatible", "fixed": "2.16.0", "title": "go-restful: Authorization Bypass Through User-Controlled Key", "link": "https://avd.aquasec.com/nvd/cve-2022-1996" }, { "id": "CVE-2022-21235", "package": "github.com/Masterminds/vcs", "installed": "v1.13.1", "fixed": "1.13.2", "title": "github.com/Masterminds/vcs: Command Injection via argument injection", "link": "https://avd.aquasec.com/nvd/cve-2022-21235" }, { "id": "CVE-2022-23806", "package": "stdlib", "installed": "v1.15.7", "fixed": "1.16.14, 1.17.7", "title": "golang: crypto/elliptic: IsOnCurve returns true for invalid field elements", "link": "https://avd.aquasec.com/nvd/cve-2022-23806" }, { "id": "CVE-2022-23806", "package": "stdlib", "installed": "v1.16.4", "fixed": "1.16.14, 1.17.7", "title": "golang: crypto/elliptic: IsOnCurve returns true for invalid field elements", "link": "https://avd.aquasec.com/nvd/cve-2022-23806" }, { "id": "CVE-2023-24538", "package": "stdlib", "installed": "v1.15.7", "fixed": "1.19.8, 1.20.3", "title": "golang: html/template: backticks not treated as string delimiters", "link": "https://avd.aquasec.com/nvd/cve-2023-24538" }, { "id": "CVE-2023-24538", "package": "stdlib", "installed": "v1.16.4", "fixed": "1.19.8, 1.20.3", "title": "golang: html/template: backticks not treated as string delimiters", "link": "https://avd.aquasec.com/nvd/cve-2023-24538" }, { "id": "CVE-2023-24540", "package": "stdlib", "installed": "v1.15.7", "fixed": "1.19.9, 1.20.4", "title": "golang: html/template: improper handling of JavaScript whitespace", "link": "https://avd.aquasec.com/nvd/cve-2023-24540" }, { "id": "CVE-2023-24540", "package": "stdlib", "installed": "v1.16.4", "fixed": "1.19.9, 1.20.4", "title": "golang: html/template: improper handling of JavaScript whitespace", "link": "https://avd.aquasec.com/nvd/cve-2023-24540" }, { "id": "CVE-2024-24790", "package": "stdlib", "installed": "v1.15.7", "fixed": "1.21.11, 1.22.4", "title": "golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses", "link": "https://avd.aquasec.com/nvd/cve-2024-24790" }, { "id": "CVE-2024-24790", "package": "stdlib", "installed": "v1.16.4", "fixed": "1.21.11, 1.22.4", "title": "golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses", "link": "https://avd.aquasec.com/nvd/cve-2024-24790" }, { "id": "CVE-2025-14813", "package": "org.bouncycastle:bcprov-jdk18on", "installed": "1.76", "fixed": "1.80.2, 1.81.1, 1.84", "title": "bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly", "link": "https://avd.aquasec.com/nvd/cve-2025-14813" }, { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.15.7", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.16.4", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2026-33186", "package": "google.golang.org/grpc", "installed": "v1.27.1", "fixed": "1.79.3", "title": "google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation", "link": "https://avd.aquasec.com/nvd/cve-2026-33186" }, { "id": "CVE-2026-33701", "package": "io.opentelemetry.javaagent:opentelemetry-javaagent", "installed": "2.25.0", "fixed": "2.26.1", "title": "io.opentelemetry.javaagent/opentelemetry-javaagent: OpenTelemetry Java Instrumentation: Remote code execution via deserialization vulnerability in RMI", "link": "https://avd.aquasec.com/nvd/cve-2026-33701" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "id": "CVE-2026-8763", "package": "org.bouncycastle:bcprov-jdk18on", "installed": "1.76", "fixed": "1.85", "title": "org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI", "link": "https://avd.aquasec.com/nvd/cve-2026-8763" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/so/so-cnfm-as-lcm:1.17.2" }, { "critical": 7, "high": 14, "fixable_critical": 7, "fixable_high": 14, "cves": [ { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r1", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/so/so-etsi-nfvo-ns-lcm:1.13.1" }, { "critical": 7, "high": 13, "fixable_critical": 7, "fixable_high": 13, "cves": [ { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r1", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/so/so-etsi-sol003-adapter:1.13.1" }, { "critical": 8, "high": 17, "fixable_critical": 8, "fixable_high": 17, "cves": [ { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r1", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-49875", "package": "org.apache.cxf:cxf-core", "installed": "4.0.5", "fixed": "4.2.2, 4.1.7, 3.6.12", "title": "cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening", "link": "https://avd.aquasec.com/nvd/cve-2026-49875" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/so/so-etsi-sol005-adapter:1.13.1" }, { "critical": 8, "high": 17, "fixable_critical": 8, "fixable_high": 17, "cves": [ { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r1", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-49875", "package": "org.apache.cxf:cxf-core", "installed": "4.0.5", "fixed": "4.2.2, 4.1.7, 3.6.12", "title": "cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening", "link": "https://avd.aquasec.com/nvd/cve-2026-49875" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/so/so-nssmf-adapter:1.15.1" }, { "critical": 11, "high": 20, "fixable_critical": 11, "fixable_high": 20, "cves": [ { "id": "CVE-2026-111497", "package": "brotli-libs", "installed": "1.2.0-r1", "fixed": "1.2.1-r0", "title": "brotli: Out-of-Bounds Write in Google Brotli Decoder", "link": "https://avd.aquasec.com/nvd/cve-2026-111497" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webflux", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-47890", "package": "org.springframework:spring-webmvc", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments", "link": "https://avd.aquasec.com/nvd/cve-2026-47890" }, { "id": "CVE-2026-47892", "package": "org.springframework:spring-webflux", "installed": "6.2.19", "fixed": "7.0.9", "title": "org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints", "link": "https://avd.aquasec.com/nvd/cve-2026-47892" }, { "id": "CVE-2026-49875", "package": "org.apache.cxf:cxf-core", "installed": "4.0.5", "fixed": "4.2.2, 4.1.7, 3.6.12", "title": "cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening", "link": "https://avd.aquasec.com/nvd/cve-2026-49875" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65637", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.59, 9.0.121", "title": "tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation", "link": "https://avd.aquasec.com/nvd/cve-2026-65637" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.55", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.135.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/so/so-oof-adapter:1.14.1" } ] }, { "name": "uui", "datastore": false, "images": [ { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/hub.docker.com/alpine/psql:18.6" }, { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/hub.docker.com/busybox:1.37.0" }, { "critical": 2, "high": 87, "fixable_critical": 1, "fixable_high": 25, "cves": [ { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.24.6", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2026-6653", "package": "libxml2", "installed": "2.12.7+dfsg+really2.9.14-2.1+deb13u3", "fixed": "", "title": "libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free", "link": "https://avd.aquasec.com/nvd/cve-2026-6653" } ], "ref": "artifactory.devops.telekom.de/hub.docker.com/postgres:17.11" }, { "critical": 0, "high": 0, "fixable_critical": 0, "fixable_high": 0, "cves": [], "ref": "artifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3" }, { "critical": 17, "high": 104, "fixable_critical": 17, "fixable_high": 104, "cves": [ { "id": "CVE-2015-7501", "package": "commons-collections:commons-collections", "installed": "3.2.1", "fixed": "3.2.2", "title": "apache-commons-collections: InvokerTransformer code execution during deserialisation", "link": "https://avd.aquasec.com/nvd/cve-2015-7501" }, { "id": "CVE-2017-7657", "package": "org.eclipse.jetty:jetty-server", "installed": "9.3.12.v20160915", "fixed": "9.2.25.v20180606, 9.3.24.v20180605", "title": "jetty: HTTP request smuggling", "link": "https://avd.aquasec.com/nvd/cve-2017-7657" }, { "id": "CVE-2017-7658", "package": "org.eclipse.jetty:jetty-server", "installed": "9.3.12.v20160915", "fixed": "9.2.25.v20180606, 9.3.24.v20180605, 9.4.11.v20180605", "title": "jetty: Incorrect header handling", "link": "https://avd.aquasec.com/nvd/cve-2017-7658" }, { "id": "CVE-2022-36437", "package": "com.hazelcast:hazelcast", "installed": "3.7.2", "fixed": "3.12.13, 4.1.10, 4.2.6, 5.0.4, 5.1.3", "title": "hazelcast: Hazelcast connection caching", "link": "https://avd.aquasec.com/nvd/cve-2022-36437" }, { "id": "CVE-2022-42889", "package": "org.apache.commons:commons-text", "installed": "1.9", "fixed": "1.10.0", "title": "apache-commons-text: variable interpolation RCE", "link": "https://avd.aquasec.com/nvd/cve-2022-42889" }, { "id": "CVE-2024-45491", "package": "libexpat", "installed": "2.5.0-r0", "fixed": "2.6.3-r0", "title": "libexpat: Integer Overflow or Wraparound", "link": "https://avd.aquasec.com/nvd/cve-2024-45491" }, { "id": "CVE-2024-45492", "package": "libexpat", "installed": "2.5.0-r0", "fixed": "2.6.3-r0", "title": "libexpat: integer overflow", "link": "https://avd.aquasec.com/nvd/cve-2024-45492" }, { "id": "CVE-2025-24813", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.13", "fixed": "11.0.3, 10.1.35, 9.0.99", "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "link": "https://avd.aquasec.com/nvd/cve-2025-24813" }, { "id": "CVE-2026-107726", "package": "com.hazelcast:hazelcast", "installed": "3.7.2", "fixed": "5.7.0", "title": "com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client", "link": "https://avd.aquasec.com/nvd/cve-2026-107726" }, { "id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.13", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "link": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.13", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "link": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.13", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.0.12", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.13", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.13", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.13", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.97.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/usecase-ui-intent-analysis:16.0.1" }, { "critical": 4, "high": 62, "fixable_critical": 4, "fixable_high": 62, "cves": [ { "id": "CVE-2024-45491", "package": "libexpat", "installed": "2.5.0-r0", "fixed": "2.6.3-r0", "title": "libexpat: Integer Overflow or Wraparound", "link": "https://avd.aquasec.com/nvd/cve-2024-45491" }, { "id": "CVE-2024-45492", "package": "libexpat", "installed": "2.5.0-r0", "fixed": "2.6.3-r0", "title": "libexpat: integer overflow", "link": "https://avd.aquasec.com/nvd/cve-2024-45492" }, { "id": "CVE-2026-47892", "package": "org.springframework:spring-webflux", "installed": "6.0.12", "fixed": "7.0.9", "title": "org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints", "link": "https://avd.aquasec.com/nvd/cve-2026-47892" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.97.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/usecase-ui-llm-adaptation:16.0.1" }, { "critical": 14, "high": 168, "fixable_critical": 13, "fixable_high": 168, "cves": [ { "id": "CVE-2020-13092", "package": "scikit-learn", "installed": "0.21.2", "fixed": "", "title": "scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute ...", "link": "https://avd.aquasec.com/nvd/cve-2020-13092" }, { "id": "CVE-2021-41208", "package": "tensorflow", "installed": "1.14.0", "fixed": "2.6.1, 2.5.2, 2.4.4", "title": "Incomplete validation in boosted trees code", "link": "https://avd.aquasec.com/nvd/cve-2021-41208" }, { "id": "CVE-2022-21797", "package": "joblib", "installed": "0.13.2", "fixed": "1.2.0", "title": "The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary ...", "link": "https://avd.aquasec.com/nvd/cve-2022-21797" }, { "id": "CVE-2022-22817", "package": "Pillow", "installed": "8.4.0", "fixed": "9.0.1", "title": "python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions", "link": "https://avd.aquasec.com/nvd/cve-2022-22817" }, { "id": "CVE-2022-45907", "package": "torch", "installed": "1.10.1+cpu", "fixed": "1.13.1", "title": "In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line c ...", "link": "https://avd.aquasec.com/nvd/cve-2022-45907" }, { "id": "CVE-2023-25668", "package": "tensorflow", "installed": "1.14.0", "fixed": "2.11.1", "title": "CVE-2023-25668 affecting package tensorflow for versions less than 2.11.1-1", "link": "https://avd.aquasec.com/nvd/cve-2023-25668" }, { "id": "CVE-2023-50447", "package": "Pillow", "installed": "8.4.0", "fixed": "10.2.0", "title": "pillow: Arbitrary Code Execution via the environment parameter", "link": "https://avd.aquasec.com/nvd/cve-2023-50447" }, { "id": "CVE-2025-32434", "package": "torch", "installed": "1.10.1+cpu", "fixed": "2.6.0", "title": "PyTorch is a Python package that provides tensor computation with stro ...", "link": "https://avd.aquasec.com/nvd/cve-2025-32434" }, { "id": "CVE-2026-112393", "package": "Pillow", "installed": "8.4.0", "fixed": "13.0.0", "title": "pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO", "link": "https://avd.aquasec.com/nvd/cve-2026-112393" }, { "id": "CVE-2026-112398", "package": "Pillow", "installed": "8.4.0", "fixed": "13.0.0", "title": "pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution", "link": "https://avd.aquasec.com/nvd/cve-2026-112398" }, { "id": "CVE-2026-112403", "package": "Pillow", "installed": "8.4.0", "fixed": "13.0.0", "title": "pillow: Pillow: Heap buffer overflow in ImagingJpegDecode", "link": "https://avd.aquasec.com/nvd/cve-2026-112403" }, { "id": "CVE-2026-112900", "package": "Pillow", "installed": "8.4.0", "fixed": "13.0.0", "title": "pillow: Pillow: Argument Injection in Ghostscript call, potentially leading into RCE", "link": "https://avd.aquasec.com/nvd/cve-2026-112900" }, { "id": "GHSA-6q48-6c7w-9gw2", "package": "certifi", "installed": "2023.5.7", "fixed": "2026.10.18", "title": "certifi bundles emSign root CAs with compromised intermediate CA keys", "link": "https://github.com/advisories/GHSA-6q48-6c7w-9gw2" }, { "id": "GHSA-h6gw-r52c-724r", "package": "tensorflow", "installed": "1.14.0", "fixed": "2.5.3, 2.6.3, 2.7.1", "title": "NULL Pointer Dereference and Access of Uninitialized Pointer in TensorFlow", "link": "https://github.com/advisories/GHSA-h6gw-r52c-724r" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/usecase-ui-nlp:1.0.5" }, { "critical": 10, "high": 63, "fixable_critical": 10, "fixable_high": 63, "cves": [ { "id": "CVE-2024-45491", "package": "libexpat", "installed": "2.5.0-r0", "fixed": "2.6.3-r0", "title": "libexpat: Integer Overflow or Wraparound", "link": "https://avd.aquasec.com/nvd/cve-2024-45491" }, { "id": "CVE-2024-45492", "package": "libexpat", "installed": "2.5.0-r0", "fixed": "2.6.3-r0", "title": "libexpat: integer overflow", "link": "https://avd.aquasec.com/nvd/cve-2024-45492" }, { "id": "CVE-2025-24813", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.13", "fixed": "11.0.3, 10.1.35, 9.0.99", "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "link": "https://avd.aquasec.com/nvd/cve-2025-24813" }, { "id": "CVE-2026-41293", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.13", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "link": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "id": "CVE-2026-43512", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.13", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "link": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "id": "CVE-2026-43515", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.13", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "id": "CVE-2026-47884", "package": "org.springframework:spring-webmvc", "installed": "6.0.12", "fixed": "7.0.9", "title": "org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView", "link": "https://avd.aquasec.com/nvd/cve-2026-47884" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.13", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.13", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat.embed:tomcat-embed-core", "installed": "10.1.13", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/usecase-ui-server:16.0.1" }, { "critical": 11, "high": 38, "fixable_critical": 11, "fixable_high": 38, "cves": [ { "id": "CVE-2024-45491", "package": "libexpat", "installed": "2.5.0-r0", "fixed": "2.6.3-r0", "title": "libexpat: Integer Overflow or Wraparound", "link": "https://avd.aquasec.com/nvd/cve-2024-45491" }, { "id": "CVE-2024-45492", "package": "libexpat", "installed": "2.5.0-r0", "fixed": "2.6.3-r0", "title": "libexpat: integer overflow", "link": "https://avd.aquasec.com/nvd/cve-2024-45492" }, { "id": "CVE-2024-52316", "package": "org.apache.tomcat:tomcat-catalina", "installed": "10.1.2", "fixed": "9.0.96, 10.1.30, 11.0.1", "title": "tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API", "link": "https://avd.aquasec.com/nvd/cve-2024-52316" }, { "id": "CVE-2025-24813", "package": "org.apache.tomcat:tomcat-catalina", "installed": "10.1.2", "fixed": "11.0.3, 10.1.35, 9.0.99", "title": "tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT", "link": "https://avd.aquasec.com/nvd/cve-2025-24813" }, { "id": "CVE-2026-41293", "package": "org.apache.tomcat:tomcat-coyote", "installed": "10.1.2", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated", "link": "https://avd.aquasec.com/nvd/cve-2026-41293" }, { "id": "CVE-2026-43512", "package": "org.apache.tomcat:tomcat-catalina", "installed": "10.1.2", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication", "link": "https://avd.aquasec.com/nvd/cve-2026-43512" }, { "id": "CVE-2026-43515", "package": "org.apache.tomcat:tomcat-catalina", "installed": "10.1.2", "fixed": "9.0.118, 10.1.55, 11.0.22", "title": "tomcat-coyote: tomcat: Improper Authorization allows security bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-43515" }, { "id": "CVE-2026-53434", "package": "org.apache.tomcat:tomcat-util", "installed": "10.1.2", "fixed": "11.0.23, 10.1.56, 9.0.119", "title": "tomcat: Apache Tomcat: Error condition not handled when configuring CRLs", "link": "https://avd.aquasec.com/nvd/cve-2026-53434" }, { "id": "CVE-2026-65182", "package": "org.apache.tomcat:tomcat-catalina", "installed": "10.1.2", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Security constraint bypass due to improper access control", "link": "https://avd.aquasec.com/nvd/cve-2026-65182" }, { "id": "CVE-2026-65905", "package": "org.apache.tomcat:tomcat-catalina", "installed": "10.1.2", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator", "link": "https://avd.aquasec.com/nvd/cve-2026-65905" }, { "id": "CVE-2026-68525", "package": "org.apache.tomcat:tomcat-catalina", "installed": "10.1.2", "fixed": "11.0.25, 10.1.58, 9.0.121", "title": "tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass", "link": "https://avd.aquasec.com/nvd/cve-2026-68525" } ], "ref": "artifactory.devops.telekom.de/onap-repo/onap/usecase-ui:16.0.1" } ] }, { "name": "k8ssandra", "datastore": true, "images": [ { "critical": 3, "high": 47, "fixable_critical": 3, "fixable_high": 47, "cves": [ { "id": "CVE-2026-31789", "package": "libcrypto3", "installed": "3.3.2-r4", "fixed": "3.3.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "libssl3", "installed": "3.3.2-r4", "fixed": "3.3.7-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.94.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "artifactory.devops.telekom.de/hub.docker.com/thelastpickle/cassandra-reaper:3.8.0" } ] }, { "name": "kafka", "datastore": true, "images": [ { "critical": 2, "high": 139, "fixable_critical": 2, "fixable_high": 123, "cves": [ { "id": "CVE-2026-114406", "package": "ca-certificates", "installed": "2024.2.69_v8.0.303-91.4.el9_4", "fixed": "2026.2.92_v9.0.319-90.3.el9_8", "title": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns", "link": "https://avd.aquasec.com/nvd/cve-2026-114406" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.115.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "quay.io/strimzi/kafka-bridge:0.31.1" }, { "critical": 4, "high": 239, "fixable_critical": 4, "fixable_high": 214, "cves": [ { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.23.0", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" }, { "id": "CVE-2026-114406", "package": "ca-certificates", "installed": "2024.2.69_v8.0.303-91.4.el9_4", "fixed": "2026.2.92_v9.0.319-90.3.el9_8", "title": "ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns", "link": "https://avd.aquasec.com/nvd/cve-2026-114406" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.100.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" }, { "id": "CVE-2026-75595", "package": "io.netty:netty-handler", "installed": "4.1.111.Final", "fixed": "4.2.17.Final, 4.1.137.Final", "title": "io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext", "link": "https://avd.aquasec.com/nvd/cve-2026-75595" } ], "ref": "quay.io/strimzi/kafka:0.45.0-kafka-3.9.0" } ] }, { "name": "mariadb", "datastore": true, "images": [ { "critical": 4, "high": 65, "fixable_critical": 4, "fixable_high": 65, "cves": [ { "id": "CVE-2023-24538", "package": "stdlib", "installed": "v1.18.2", "fixed": "1.19.8, 1.20.3", "title": "golang: html/template: backticks not treated as string delimiters", "link": "https://avd.aquasec.com/nvd/cve-2023-24538" }, { "id": "CVE-2023-24540", "package": "stdlib", "installed": "v1.18.2", "fixed": "1.19.9, 1.20.4", "title": "golang: html/template: improper handling of JavaScript whitespace", "link": "https://avd.aquasec.com/nvd/cve-2023-24540" }, { "id": "CVE-2024-24790", "package": "stdlib", "installed": "v1.18.2", "fixed": "1.21.11, 1.22.4", "title": "golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses", "link": "https://avd.aquasec.com/nvd/cve-2024-24790" }, { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.18.2", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" } ], "ref": "artifactory.devops.telekom.de/hub.docker.com/mariadb:11.7.2" }, { "critical": 1, "high": 47, "fixable_critical": 1, "fixable_high": 47, "cves": [ { "id": "CVE-2025-68121", "package": "stdlib", "installed": "v1.24.2", "fixed": "1.24.13, 1.25.7, 1.26.0-rc.3", "title": "crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption", "link": "https://avd.aquasec.com/nvd/cve-2025-68121" } ], "ref": "docker-registry3.mariadb.com/mariadb-operator/mariadb-operator:0.38.1" } ] }, { "name": "redis", "datastore": true, "images": [ { "critical": 2, "high": 25, "fixable_critical": 2, "fixable_high": 25, "cves": [ { "id": "CVE-2026-31789", "package": "libcrypto3", "installed": "3.5.4-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" }, { "id": "CVE-2026-31789", "package": "libssl3", "installed": "3.5.4-r0", "fixed": "3.5.6-r0", "title": "openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing", "link": "https://avd.aquasec.com/nvd/cve-2026-31789" } ], "ref": "public.ecr.aws/docker/library/redis:8.2.2-alpine" } ] } ], "critical": 878, "high": 7771, "fixable_critical": 841, "fixable_high": 7188 }