Threat database

OpenRemote core versions before 1.31.0 have an authorization bypass vulnerability where inbound edge gateway events do not undergo proper realm or gateway-descendant authorization. This allows an attacker controlling a registered gateway to manipulate event asset IDs to overwrite or delete assets across different realms, breaking tenant isolation.

OpenRemote core versions before 1.31.0 have an authorization bypass vulnerability that allows authenticated users to access gateway tunnel information from other realms. This can expose internal target hosts, ports, and routing data by exploiting the getGatewayActiveTunnelInfos endpoint with manipulated parameters.

OpenRemote core versions before 1.31.0 have an authorization bypass vulnerability that allows realm administrators to impersonate gateways in other realms. This occurs because the GatewayService only verifies the gateway ID without validating the associated realm. Attackers with WRITE:ADMIN privileges in one realm can create a service user named after another realm's gateway ID, enabling them to overwrite assets and establish SSH tunnels into the target realm's local network. The vulnerability has a low CVSS 4.0 base score of 2.1 and does not have known exploits in the wild.

CVE-2026-101386 is a vulnerability in Oracle REST Data Services Core component affecting versions 24.2.0 through 26.1.0. It allows a low privileged attacker with network access via HTTP to perform unauthorized read, update, insert, or delete operations on some accessible data. The vulnerability is rated medium severity with a CVSS 3.1 base score of 4.2, indicating limited confidentiality and integrity impact. The vulnerability is difficult to exploit due to the required conditions. Oracle has released patches addressing this and many other vulnerabilities in their October 2026 Critical Patch Update.

CVE-2026-101384 is a vulnerability in Oracle REST Data Services Core component affecting versions 24.2.0 through 26.1.0. It allows a low privileged attacker with network access via HTTP to gain unauthorized read access to some data accessible through Oracle REST Data Services. The vulnerability has a CVSS 3.1 base score of 5.0, indicating a medium severity with confidentiality impact only. The vulnerability may also impact additional Oracle products due to scope change. Oracle has published a Critical Patch Update advisory that includes security patches addressing this and other vulnerabilities.

CVE-2026-101383 is a vulnerability in Oracle REST Data Services Core component affecting versions 24.2.0 through 26.1.0. It allows an unauthenticated attacker with network access via HTTP to compromise the service. Successful exploitation requires human interaction from a person other than the attacker. The vulnerability can lead to unauthorized update, insert, or delete operations on some accessible data, as well as unauthorized read access to a subset of data. The CVSS 3.1 base score is 5.4, indicating a medium severity level.

Server-Side Request Forgery / Local File Inclusion in Apache MyFace Core. Older unsupported versions may also be affected.  Users are recommended to upgrade to versions 2.3.12, 2.3-next-M9, 3.0.4, 4.0.4, or 4.1.4, which fix this issue.

CVE-2026-76646 is a high-severity vulnerability in Apache MyFaces that allows a remote attacker to cause uncontrolled resource consumption by sending specially crafted request parameters. This can lead to a denial of service (DoS) condition. The issue affects multiple versions of Apache MyFaces, and fixed versions have been released. Users are advised to upgrade to the specified fixed versions to mitigate the risk.

In Siglet current and past versions the refresh token handler do not enforce proof of possession of the issuer DID.

Silverpeas Core versions up to and including 6.4.6 contain a Cross Site Scripting (XSS) vulnerability in the Multimedia library application introduction component. This vulnerability allows an attacker to inject malicious scripts that could be executed in the context of a user's browser session. The vulnerability has a medium severity rating with a CVSS score of 6.1. No official patch or remediation information is provided in the available data.

Silverpeas Core versions up to and including 6.4.6 contain a Cross Site Scripting (XSS) vulnerability in the wysiwyg-CKEditor image upload feature. This vulnerability allows an attacker to inject malicious scripts that can be executed in the context of the affected application. The vulnerability has a CVSS score of 6.1, indicating a medium severity level.

Silverpeas Core version 6.4.6 contains a Cross Site Scripting (XSS) vulnerability in its Document management file upload feature. This vulnerability allows an attacker to execute malicious scripts in the context of a user's browser session. The vulnerability has a medium severity rating with a CVSS score of 6.1.

HAPI FHIR is a complete implementation of the HL7 FHIR standard for healthcare interoperability in Java. Prior to 6.9.11, XhtmlParser.java imposes no maximum element nesting depth, so a deeply nested text.div narrative triggers unbounded recursion between parseElementInner() and parseElement(), raising a StackOverflowError. An attacker who can submit FHIR resources containing such narratives can thus crash a parsing or validation worker thread, affecting validator services and any application that parses attacker-supplied FHIR JSON or XML. This issue is fixed in version 6.9.11.

Improper Restriction of XML External Entity Reference vulnerability in Apache SIS. It is possible to write XML files in such a way that, when parsed by Apache SIS, an XML file reveals to the attacker the content of a local file on the server running Apache SIS. This vulnerability impacts the following SIS services: * Reading of GeoTIFF files having the GEO_METADATA tag defined by the Defense Geospatial Information Working Group (DGIWG). * Parsing of ISO 19115 metadata in XML format. * Parsing of Coordinate Reference Systems defined in the GML format. * Parsing of files in GPS Exchange Format (GPX). This issue affects Apache SIS from versions 0.4 through 1.5 inclusive. Users are recommended to upgrade to version 1.6, which will fix the issue. In the meantime, the security vulnerability can be avoided by launching Java with the javax.xml.accessExternalDTD system property sets to a comma-separated list of authorized protocols. For example: java -Djavax.xml.accessExternalDTD="" ...