Oracle Linux 9 : jackson-core, / jackson-databind, / jackson-jaxrs-providers, / and / jackson-modules-base (ELSA-2026-80504)

The remote Oracle Linux 9 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2026-80504 advisory. jackson-core 2.21.6-1 - Rebase to version 2.21.6 - Resolves: RHEL-259227 jackson-databind 2.21.6-1 - Rebase to version 2.21.6 - Resolves: RHEL-259227...

ai.aarvion:aarvion-sdk-anthropic (>=0.1.0, <=0.2.0), ai.aarvion:aarvion-sdk-apache (>=0.1.0, <=0.2.0) +12598 more potentially affected by CVE-2026-110879 via com.fasterxml.jackson.core:jackson-databind (>=2.22.0, <=2.22.3)

com.fasterxml.jackson.core:jackson-databind MAVEN version =2.22.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.1.0, =0.0.1, =0.0.1, =0.0.1, =0.0.1, =0.9.3, =0.9.4, =0.9.11 and more Source cves: CVE-2026-110879 Source advisory: MEND:CVE-2026-110879...

CVE-2026-111620

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in xprocessplatformassemblesurface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the...

CVE-2026-111620 O2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in xprocessplatformassemblesurface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the...

CVE-2026-111620

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in xprocessplatformassemblesurface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the...

CVE-2026-111620 O2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in xprocessplatformassemblesurface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the...

CVE-2026-111620 O2OA through 10.0.2-ce Cross-Work Attachment Read via Attachment Download Endpoint

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in xprocessplatformassemblesurface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the...

CVE-2026-111620

O2OA versions up to and including 10.0.2-ce are vulnerable to an authorization bypass (CWE-639) in the x_processplatform_assemble_surface component. The vulnerability exists because the ActionDownloadWithWork and ActionDownloadWithWorkStream functions fail to verify if a requested attachment ID b...

EUVD-2026-103042

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in xprocessplatformassemblesurface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the...

CVE-2026-111620: Authorization Bypass Through User-Controlled Key

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in xprocessplatformassemblesurface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to the...

PT-2026-116019

O2OA through 10.0.2-ce contains an authorization bypass vulnerability in x processplatform assemble surface that allows authenticated users to download attachments from other works. ActionDownloadWithWork and ActionDownloadWithWorkStream never verify that the requested attachment id belongs to th...

O2OA Authorization Issue Vulnerability

O2OA 10.0.2-ce and earlier versions have an authorization issue vulnerability. This vulnerability stems from the lack of verification in xprocessplatformassemblesurface for the ActionDownloadWithWork and ActionDownloadWithWorkStream methods to ensure that the requested attachment ID belongs to th...

jackson-core, jackson-databind, jackson-jaxrs-providers, and jackson-modules-base security update

jackson-core 2.21.6-1 - Rebase to version 2.21.6 - Resolves: RHEL-259227 jackson-databind 2.21.6-1 - Rebase to version 2.21.6 - Resolves: RHEL-259227 jackson-jaxrs-providers 2.21.6-1 - Rebase to version 2.21.6 - Resolves: RHEL-259227 jackson-modules-base 2.21.6-1 - Rebase to version 2.21.6 -...

io.github.aafc-bicoe:dina-base-api (>=0.168, <=0.183), net.tirasa.connid.bundles:net.tirasa.connid.bundles.rest (1.1.2) +7 more potentially affected by CVE-2026-86463 via org.apache.cxf:cxf-rt-rs-extension-search (>=4.2.0, <=4.2.3)

org.apache.cxf:cxf-rt-rs-extension-search MAVEN version =4.2.0, =0.168, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =4.2.0, =8.0.0-rc2, =8.1.0-rc2 Source cves: CVE-2026-86463 Source advisory: MEND:CVE-2026-86463...

RHLW-2026-C23E4577FAE1D333 Lightwell Security Advisory: cxf-jaxrs-service 4.2.2.rhlw-00008

Red Hat Lightwell has released org.apache.cxf.archetype:cxf-jaxrs-service 4.2.2.rhlw-00008 with backported fixes for CVE-2026-57817 and CVE-2026-65583. CVE-2026-57817: Apache CXF: The authorization code hash chash is not enforced for the hybrid OIDC flow CVE-2026-65583: Apache CXF: Self-issued ID...

RHLW-2026-689BBA11EAE91BCB Lightwell Security Advisory: cxf-jaxrs-service 3.6.9.rhlw-00004

Red Hat Lightwell has released org.apache.cxf.archetype:cxf-jaxrs-service 3.6.9.rhlw-00004 with backported fixes for CVE-2026-44417, CVE-2026-50632, and CVE-2026-66909. CVE-2026-44417: Apache CXF: Incomplete fix for CVE-2025-48913 Untrusted JMS configuration can lead to RCE CVE-2026-50632: Apache...

Security Bulletin: Vulnerabilities reported in cxf-rt-frontend-jaxrs-4.2.2.jar are addressed in APIM 11.1

Summary Vulnerabilities reported in cxf-rt-frontend-jaxrs-4.2.2.jar are addressed in APIM 11.1 Vulnerability Details CVEID:CVE-2026-57819 DESCRIPTION: Apache CXF allows to set a limit on the number of form parameters in a JAX-RS message via the "maxFormParameterCount" configuration option. Howeve...

Security Bulletin: IBM Engineering Lifecycle Management products using IBM WebSphere Application Server Liberty is affected by an improper restriction of XML External Entity Reference vulnerability due to Apache CXF (CVE-2026-49875)

Summary There is a vulnerability in the Apache CXF library that affects IBM WebSphere Application Server Liberty with the jaxrs-2.0, jaxrs-2.1, jaxws-2.2, xmlWS-3.0, xmlWS-4.0 or wsAtomicTransaction-1.2 enabled. Vulnerability Details Refer to the security bulletins listed in the Remediation/Fixes...

io.zipkin.dependencies:zipkin-dependencies (1.11.3), io.zipkin.dependencies:zipkin-dependencies-mysql (1.11.3) +6 more potentially affected by CVE-2026-61700 via org.mariadb.jdbc:mariadb-java-client (1.7.2)

org.mariadb.jdbc:mariadb-java-client MAVEN version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.mariadb.jdbc:mariadb-java-client and may be impacted: - io.zipkin.dependencies:zipkin-dependencies 1.11.3 -...

io.zipkin.dependencies:zipkin-dependencies (1.11.3), io.zipkin.dependencies:zipkin-dependencies-mysql (1.11.3) +6 more potentially affected by CVE-2026-55856 via org.mariadb.jdbc:mariadb-java-client (1.7.2)

org.mariadb.jdbc:mariadb-java-client MAVEN version 1.7.2 is affected by a known vulnerability. The following packages have a transitive dependency on org.mariadb.jdbc:mariadb-java-client and may be impacted: - io.zipkin.dependencies:zipkin-dependencies 1.11.3 -...