Trivy CVE scan (HIGH, CRITICAL)

109/109 images scanned. CRITICAL 779 (fixable 745), HIGH 7653 (fixable 6658).

Excluded from scanning (1)

By component

ComponentImagesCRITICALHIGHFixable
sdnc714912191190
so18124672793
dcae111011054890
policy189411811028
uui961590529
cps542394429
sdc1139423406
multicloud834214244
network231192222
cds825678329
robot114188200
aai1013182195
ncmp2136374
a1policymanagement1127789
portal697685
kafka (datastore)26405344
mariadb (datastore)25115120
nengdb246872
oauth2245760
cassandra3311584
k8ssandra (datastore)135053
nginx131720
entity12153126
postgres2214728
redis (datastore)122830
onap102929

By image

ComponentImageCRITICALHIGHFixableCRITICAL CVEs (installed → fixed)
a1policymanagementartifactory.devops.telekom.de/onap-repo/onap/ccsdk-oran-a1policymanagementservice:2.2.0127789CVE-2026-31789 libcrypto3 3.5.4-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 libssl3 3.5.4-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 10.1.46 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated
CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 10.1.46 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication
CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 10.1.46 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass
CVE-2026-47890 org.springframework:spring-webflux 6.2.11 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-47892 org.springframework:spring-webflux 6.2.11 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints
CVE-2026-55276 org.apache.tomcat.embed:tomcat-embed-core 10.1.46 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.46 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.46 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.46 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
CVE-2026-75595 io.netty:netty-handler 4.1.127.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
aaiartifactory.devops.telekom.de/hub.docker.com/curlimages/curl:8.23.003232
aaiartifactory.devops.telekom.de/onap-repo/onap/aai-graphadmin:1.19.002323
aaiartifactory.devops.telekom.de/onap-repo/onap/aai-haproxy:1.15.233033CVE-2026-31789 libcrypto3 3.3.2-r1 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 libssl3 3.3.2-r1 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 openssl 3.3.2-r1 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
aaiartifactory.devops.telekom.de/onap-repo/onap/aai-resources:1.19.011718CVE-2026-33701 io.opentelemetry.javaagent:opentelemetry-javaagent 2.24.0 → 2.26.1 io.opentelemetry.javaagent/opentelemetry-javaagent: OpenTelemetry Java Instrumentation: Remote code execution via deserialization vulnerability in RMI
aaiartifactory.devops.telekom.de/onap-repo/onap/aai-schema-service:1.15.042226CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.56 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.56 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.56 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.56 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
aaiartifactory.devops.telekom.de/onap-repo/onap/aai-traversal:1.19.001818
aaiartifactory.devops.telekom.de/onap-repo/onap/babel:1.15.012021CVE-2026-47884 org.springframework:spring-webmvc 6.0.21 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
aaiartifactory.devops.telekom.de/onap-repo/onap/model-loader:1.15.121113CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
aaiartifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3011
aaiartifactory.devops.telekom.de/onap-repo/onap/sparky-be:3.1.02810CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
cassandratrusted.artifactory.devops.telekom.de/hub.docker.com/k8ssandra/cass-management-api:4.1.8-ubi39362CVE-2024-53990 org.asynchttpclient:async-http-client 2.12.1 → 2.12.4, 3.0.1 async-http-client: AsyncHttpClient (AHC) library's `CookieStore` replaces explicitly defined `Cookie`s
CVE-2026-107282 org.asynchttpclient:async-http-client 2.12.1 → 3.0.13, 2.16.1 org.asynchttpclient/async-http-client: AsyncHttpClient: Replay to a different host sends the original host request and credentials to the new host
CVE-2026-75595 io.netty:netty-handler 4.1.89.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
cassandratrusted.artifactory.devops.telekom.de/hub.docker.com/k8ssandra/k8ssandra-client:v0.9.201414
cassandratrusted.artifactory.devops.telekom.de/hub.docker.com/k8ssandra/system-logger:v1.28.1088
cdsartifactory.devops.telekom.de/hub.docker.com/busybox:1.37.0000
cdsartifactory.devops.telekom.de/hub.docker.com/postgres:17.11214728CVE-2025-68121 stdlib v1.24.6 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
CVE-2026-6653 libxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3 → no fix libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free
cdsartifactory.devops.telekom.de/onap-repo/onap/ccsdk-blueprintsprocessor:1.11.044951CVE-2026-107726 com.hazelcast:hazelcast 5.4.0 → 5.7.0 com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client
CVE-2026-111497 brotli-libs 1.2.0-r1 → 1.2.1-r0 brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-47890 org.springframework:spring-webflux 6.2.11 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-47892 org.springframework:spring-webflux 6.2.11 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints
cdsartifactory.devops.telekom.de/onap-repo/onap/ccsdk-cds-ui-server:1.11.010162139CVE-2019-10744 lodash 3.10.1 → 4.17.12 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties
CVE-2019-8457 libdb5.3 5.3.28+dfsg1-0.5 → no fix sqlite: heap out-of-bound read in function rtreenode()
CVE-2021-44906 minimist 0.0.10 → 1.2.6, 0.2.4 minimist: prototype pollution
CVE-2022-29078 ejs 2.7.4 → 3.1.7 ejs: server-side template injection in outputFunctionName
CVE-2023-45853 zlib1g 1:1.2.11.dfsg-1+deb10u2 → no fix zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6
CVE-2024-21534 jsonpath-plus 1.1.0 → 10.2.0 jsonpath-plus: Remote Code Execution in jsonpath-plus via Improper Input Sanitization
CVE-2024-57077 utils-extend 1.0.8 → no fix utils-extend Prototype Pollution
CVE-2025-7783 form-data 2.3.3 → 2.5.4, 3.0.4, 4.0.4 form-data: Unsafe random function in form-data
CVE-2026-59873 tar 6.1.11 → 7.5.19 tar: node-tar: Denial of Service via crafted gzip bomb
CVE-2026-59873 tar 6.1.11 → 7.5.19 tar: node-tar: Denial of Service via crafted gzip bomb
cdsartifactory.devops.telekom.de/onap-repo/onap/ccsdk-commandexecutor:1.11.0314231CVE-2023-45853 zlib1g 1:1.2.13.dfsg-1 → no fix zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6
CVE-2025-7458 libsqlite3-0 3.40.1-2+deb12u2 → no fix sqlite: SQLite integer overflow
CVE-2026-111497 libbrotli1 1.0.9-2+b6 → 1.0.9-2+deb12u1 brotli: Out-of-Bounds Write in Google Brotli Decoder
cdsartifactory.devops.telekom.de/onap-repo/onap/ccsdk-py-executor:1.11.0213636CVE-2023-45853 zlib1g 1:1.2.13.dfsg-1 → no fix zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6
CVE-2025-7458 libsqlite3-0 3.40.1-2+deb12u2 → no fix sqlite: SQLite integer overflow
cdsartifactory.devops.telekom.de/onap-repo/onap/ccsdk-sdclistener:1.11.044143CVE-2026-107726 com.hazelcast:hazelcast 5.5.0 → 5.7.0 com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client
CVE-2026-111497 brotli-libs 1.2.0-r1 → 1.2.1-r0 brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-47890 org.springframework:spring-webflux 6.2.11 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-47892 org.springframework:spring-webflux 6.2.11 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints
cdsartifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3011
cpsartifactory.devops.telekom.de/hub.docker.com/alpine/psql:18.6000
cpsartifactory.devops.telekom.de/hub.docker.com/timescale/timescaledb:2.16.1-pg1411212222CVE-2023-24538 stdlib v1.18.2 → 1.19.8, 1.20.3 golang: html/template: backticks not treated as string delimiters
CVE-2023-24540 stdlib v1.18.2 → 1.19.9, 1.20.4 golang: html/template: improper handling of JavaScript whitespace
CVE-2024-24790 stdlib v1.18.2 → 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
CVE-2024-45491 libexpat 2.6.2-r0 → 2.6.3-r0 libexpat: Integer Overflow or Wraparound
CVE-2024-45492 libexpat 2.6.2-r0 → 2.6.3-r0 libexpat: integer overflow
CVE-2024-56171 libxml2 2.12.7-r0 → 2.12.7-r1 libxml2: Use-After-Free in libxml2
CVE-2025-68121 stdlib v1.18.2 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
CVE-2025-68121 stdlib v1.22.4 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
CVE-2025-68121 stdlib v1.22.4 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
CVE-2026-31789 libcrypto3 3.3.1-r3 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 libssl3 3.3.1-r3 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
cpsartifactory.devops.telekom.de/onap-repo/onap/cps-and-ncmp:3.7.087682CVE-2024-45491 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: Integer Overflow or Wraparound
CVE-2024-45492 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: integer overflow
CVE-2026-107726 com.hazelcast:hazelcast 5.5.0 → 5.7.0 com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client
CVE-2026-47884 org.springframework:spring-webmvc 6.2.9 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webflux 6.2.9 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-47890 org.springframework:spring-webmvc 6.2.9 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-47892 org.springframework:spring-webflux 6.2.9 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints
CVE-2026-75595 io.netty:netty-handler 4.1.123.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
cpsartifactory.devops.telekom.de/onap-repo/onap/cps-temporal:1.2.123105124CVE-2016-1000027 org.springframework:spring-web 5.3.21 → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization
CVE-2021-36159 apk-tools 2.10.5-r1 → 2.10.7-r0 libfetch: an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes leads to information leak or crash
CVE-2021-3711 libcrypto1.1 1.1.1g-r0 → 1.1.1l-r0 openssl: SM2 Decryption Buffer Overflow
CVE-2021-3711 libssl1.1 1.1.1g-r0 → 1.1.1l-r0 openssl: SM2 Decryption Buffer Overflow
CVE-2021-3711 openssl 1.1.1i-r0 → 1.1.1l-r0 openssl: SM2 Decryption Buffer Overflow
CVE-2022-31692 org.springframework.security:spring-security-core 5.6.6 → 5.7.5, 5.6.9 spring-security: Authorization rules can be bypassed via forward or include dispatcher types in Spring Security
CVE-2022-37434 zlib 1.2.11-r3 → 1.2.12-r2 zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field
CVE-2022-42889 org.apache.commons:commons-text 1.9 → 1.10.0 apache-commons-text: variable interpolation RCE
CVE-2023-20860 org.springframework:spring-webmvc 5.3.21 → 6.0.7, 5.3.26 springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern
CVE-2023-20873 org.springframework.boot:spring-boot-actuator-autoconfigure 2.6.9 → 3.0.6, 2.7.11, 2.6.15, 2.5.15 spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry
CVE-2023-34034 org.springframework.security:spring-security-config 5.6.6 → 5.6.12, 5.7.10, 5.8.5, 6.0.5, 6.1.2 spring-security-webflux: path wildcard leads to security bypass
CVE-2024-1597 org.postgresql:postgresql 42.3.6 → 42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2 pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE
CVE-2024-38821 org.springframework.security:spring-security-web 5.6.6 → 5.7.13, 5.8.15, 6.2.7, 6.0.13, 6.1.11, 6.3.4 Spring-WebFlux: Authorization Bypass of Static Resources in WebFlux Applications
CVE-2025-24813 org.apache.tomcat.embed:tomcat-embed-core 9.0.64 → 11.0.3, 10.1.35, 9.0.99 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
CVE-2026-22732 org.springframework.security:spring-security-web 5.6.6 → 6.5.9, 7.0.4 Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers
CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 9.0.64 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated
CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 9.0.64 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication
CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 9.0.64 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass
CVE-2026-47884 org.springframework:spring-webmvc 5.3.21 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-55276 org.apache.tomcat.embed:tomcat-embed-core 9.0.64 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 9.0.64 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 9.0.64 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 9.0.64 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
cpsartifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3011
dcaeartifactory.devops.telekom.de/hub.docker.com/busybox:1.37.0000
dcaeartifactory.devops.telekom.de/hub.docker.com/postgres:17.11214728CVE-2025-68121 stdlib v1.24.6 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
CVE-2026-6653 libxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3 → no fix libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free
dcaeartifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3011
dcaeartifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.collectors.hv-ves.hv-collector-main:1.11.17102107CVE-2026-111497 brotli-libs 1.2.0-r0 → 1.2.1-r0 brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-31789 libcrypto3 3.5.5-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 libssl3 3.5.5-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 openssl 3.5.5-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-33845 gnutls 3.8.11-r0 → 3.8.13-r0 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment
CVE-2026-42010 gnutls 3.8.11-r0 → 3.8.13-r0 gnutls: gnutls: Authentication Bypass via NUL Character in Username
CVE-2026-75595 io.netty:netty-handler 4.1.79.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
dcaeartifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.collectors.ves.vescollector:1.12.619151167CVE-2016-1000027 org.springframework:spring-web 5.3.22 → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization
CVE-2022-42889 org.apache.commons:commons-text 1.9 → 1.10.0 apache-commons-text: variable interpolation RCE
CVE-2023-20860 org.springframework:spring-webmvc 5.3.22 → 6.0.7, 5.3.26 springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern
CVE-2025-24813 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 11.0.3, 10.1.35, 9.0.99 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
CVE-2026-111497 brotli-libs 1.2.0-r0 → 1.2.1-r0 brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-31789 libcrypto3 3.5.5-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 libssl3 3.5.5-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 openssl 3.5.5-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-33845 gnutls 3.8.11-r0 → 3.8.13-r0 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment
CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated
CVE-2026-42010 gnutls 3.8.11-r0 → 3.8.13-r0 gnutls: gnutls: Authentication Bypass via NUL Character in Username
CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication
CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass
CVE-2026-47884 org.springframework:spring-webmvc 5.3.22 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-55276 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
CVE-2026-75595 io.netty:netty-handler 4.1.73.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
dcaeartifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.deployments.healthcheck-container:2.4.114343CVE-2026-59873 tar 6.1.15 → 7.5.19 tar: node-tar: Denial of Service via crafted gzip bomb
dcaeartifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.platform.ves-openapi-manager:1.3.11695108CVE-2016-1000027 org.springframework:spring-web 5.3.22 → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization
CVE-2021-36159 apk-tools 2.10.5-r1 → 2.10.7-r0 libfetch: an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes leads to information leak or crash
CVE-2021-3711 libcrypto1.1 1.1.1g-r0 → 1.1.1l-r0 openssl: SM2 Decryption Buffer Overflow
CVE-2021-3711 libssl1.1 1.1.1g-r0 → 1.1.1l-r0 openssl: SM2 Decryption Buffer Overflow
CVE-2021-3711 openssl 1.1.1i-r0 → 1.1.1l-r0 openssl: SM2 Decryption Buffer Overflow
CVE-2022-37434 zlib 1.2.11-r3 → 1.2.12-r2 zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field
CVE-2023-20860 org.springframework:spring-webmvc 5.3.22 → 6.0.7, 5.3.26 springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern
CVE-2025-24813 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 11.0.3, 10.1.35, 9.0.99 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated
CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication
CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass
CVE-2026-47884 org.springframework:spring-webmvc 5.3.22 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-55276 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 9.0.65 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
dcaeartifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.services.datalake.exposure.service:1.2.0125160CVE-2016-1000027 org.springframework:spring-web 5.3.31 → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization
CVE-2024-1597 org.postgresql:postgresql 42.2.18 → 42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2 pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE
CVE-2025-24813 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 11.0.3, 10.1.35, 9.0.99 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
CVE-2026-111497 brotli-libs 1.2.0-r1 → 1.2.1-r0 brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated
CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication
CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass
CVE-2026-47884 org.springframework:spring-webmvc 5.3.31 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-55276 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
dcaeartifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.services.datalakeadminui:1.2.021255CVE-2026-111497 libbrotli1 1.1.0-2+b7 → 1.1.0-2+deb13u1 brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-6653 libxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3 → no fix libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free
dcaeartifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.services.datalakefeeder:1.2.028247267CVE-2014-125087 com.jamesmurty.utils:java-xmlbuilder 1.1 → 1.2 java-xmlbuilder: XMLBuilder2 is vulnerable to XML External Entity (XXE) injection
CVE-2015-1832 org.apache.derby:derby 10.11.1.1 → 10.12.1.1 Derby: XXE attack possible by using XmlVTI and the XML datatype
CVE-2016-1000027 org.springframework:spring-web 5.3.31 → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization
CVE-2017-1000487 org.codehaus.plexus:plexus-utils 3.0.15 → 3.0.16 plexus-utils: Mishandled strings in Commandline class allow for command injection
CVE-2019-10202 org.codehaus.jackson:jackson-mapper-asl 1.9.13 → no fix codehaus: incomplete fix for unsafe deserialization in jackson-databind vulnerabilities
CVE-2019-20444 io.netty:netty 3.10.5.Final → 4.0.0 netty: HTTP request smuggling
CVE-2019-20444 io.netty:netty-codec-http 4.1.8.Final → 4.1.44 netty: HTTP request smuggling
CVE-2022-46337 org.apache.derby:derby 10.11.1.1 → 10.14.2.1, 10.16.1.2, 10.15.2.1 A cleverly devised username might bypass LDAP authentication checks. I ...
CVE-2023-44981 org.apache.zookeeper:zookeeper 3.4.10 → 3.7.2, 3.8.3, 3.9.1 zookeeper: Authorization Bypass in Apache ZooKeeper
CVE-2024-1597 org.postgresql:postgresql 42.6.0 → 42.2.28, 42.3.9, 42.4.4, 42.5.5, 42.6.1, 42.7.2 pgjdbc: PostgreSQL JDBC Driver allows attacker to inject SQL if using PreferQueryMode=SIMPLE
CVE-2024-47561 org.apache.avro:avro 1.7.7 → 1.11.4 apache-avro: Schema parsing may trigger Remote Code Execution (RCE)
CVE-2025-24813 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 11.0.3, 10.1.35, 9.0.99 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
CVE-2026-111497 brotli-libs 1.2.0-r0 → 1.2.1-r0 brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-31789 libcrypto3 3.5.5-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 libssl3 3.5.5-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 openssl 3.5.5-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-33845 gnutls 3.8.11-r0 → 3.8.13-r0 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment
CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated
CVE-2026-42010 gnutls 3.8.11-r0 → 3.8.13-r0 gnutls: gnutls: Authentication Bypass via NUL Character in Username
CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication
CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass
CVE-2026-47884 org.springframework:spring-webmvc 5.3.31 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-55276 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 9.0.83 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
CVE-2026-75595 io.netty:netty-handler 4.1.8.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
CVE-2026-75595 io.netty:netty-handler 4.1.80.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
dcaeartifactory.devops.telekom.de/onap-repo/onap/org.onap.dcaegen2.services.prh.prh-app-server:1.13.01492104CVE-2026-111497 brotli-libs 1.2.0-r0 → 1.2.1-r0 brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-33701 io.opentelemetry.javaagent:opentelemetry-javaagent 2.25.0 → 2.26.1 io.opentelemetry.javaagent/opentelemetry-javaagent: OpenTelemetry Java Instrumentation: Remote code execution via deserialization vulnerability in RMI
CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 10.1.49 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated
CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 10.1.49 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication
CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 10.1.49 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass
CVE-2026-47884 org.springframework:spring-webmvc 6.2.14 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webflux 6.2.14 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-47890 org.springframework:spring-webmvc 6.2.14 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-47892 org.springframework:spring-webflux 6.2.14 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints
CVE-2026-55276 org.apache.tomcat.embed:tomcat-embed-core 10.1.49 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.49 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.49 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.49 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
CVE-2026-75595 io.netty:netty-handler 4.1.128.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
entityquay.io/strimzi/operator:0.45.02153126CVE-2026-114406 ca-certificates 2024.2.69_v8.0.303-91.4.el9_4 → 2026.2.92_v9.0.319-90.3.el9_8 ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns
CVE-2026-75595 io.netty:netty-handler 4.1.115.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
multicloudartifactory.devops.telekom.de/hub.docker.com/mongo:8.0.3413839CVE-2025-68121 stdlib v1.24.6 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
multicloudartifactory.devops.telekom.de/onap-repo/memcached:alpine3.15189CVE-2022-37434 zlib 1.2.12-r0 → 1.2.12-r2 zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field
multicloudartifactory.devops.telekom.de/onap-repo/onap/multicloud/framework-artifactbroker:1.10.011211CVE-2026-111497 brotli-libs 1.2.0-r1 → 1.2.1-r0 brotli: Out-of-Bounds Write in Google Brotli Decoder
multicloudartifactory.devops.telekom.de/onap-repo/onap/multicloud/framework:1.10.0156378CVE-2020-14343 PyYAML 5.3.1 → 5.4 PyYAML: incomplete fix for CVE-2020-1747
CVE-2021-36159 apk-tools 2.12.5-r0 → 2.12.6-r0 libfetch: an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes leads to information leak or crash
CVE-2022-22822 expat 2.2.10-r1 → 2.2.10-r2 expat: Integer overflow in addBinding in xmlparse.c
CVE-2022-22823 expat 2.2.10-r1 → 2.2.10-r2 expat: Expat: Denial of Service vulnerability in XML parsing
CVE-2022-22824 expat 2.2.10-r1 → 2.2.10-r2 expat: Expat: Denial of service and memory issues due to integer overflow
CVE-2022-23852 expat 2.2.10-r1 → 2.2.10-r3 expat: Integer overflow in function XML_GetBuffer
CVE-2022-25235 expat 2.2.10-r1 → 2.2.10-r4 expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
CVE-2022-25236 expat 2.2.10-r1 → 2.2.10-r4 expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
CVE-2022-25315 expat 2.2.10-r1 → 2.2.10-r4 expat: Integer overflow in storeRawNames()
CVE-2022-28346 Django 3.2.7 → 2.2.28, 3.2.13, 4.0.4 Django: SQL injection in QuerySet.annotate(),aggregate() and extra()
CVE-2022-28347 Django 3.2.7 → 2.2.28, 3.2.13, 4.0.4 Django: SQL injection via QuerySet.explain(options) on PostgreSQL
CVE-2022-34265 Django 3.2.7 → 3.2.14, 4.0.6 python-django: Potential SQL injection via Trunc(kind) and Extract(lookup_name) arguments
CVE-2022-37434 zlib 1.2.11-r3 → 1.2.12-r2 zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field
CVE-2023-31047 Django 3.2.7 → 3.2.19, 4.1.9, 4.2.1 python-django: Potential bypass of validation when uploading multiple files using one form field
CVE-2025-64459 Django 3.2.7 → 5.2.8, 5.1.14, 4.2.26 django: Django SQL injection
multicloudartifactory.devops.telekom.de/onap-repo/onap/multicloud/k8s:0.14.0086
multicloudartifactory.devops.telekom.de/onap-repo/onap/multicloud/openstack-fcaps:1.5.7157691CVE-2021-36159 apk-tools 2.12.5-r0 → 2.12.6-r0 libfetch: an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes leads to information leak or crash
CVE-2022-22822 expat 2.2.10-r1 → 2.2.10-r2 expat: Integer overflow in addBinding in xmlparse.c
CVE-2022-22823 expat 2.2.10-r1 → 2.2.10-r2 expat: Expat: Denial of Service vulnerability in XML parsing
CVE-2022-22824 expat 2.2.10-r1 → 2.2.10-r2 expat: Expat: Denial of service and memory issues due to integer overflow
CVE-2022-23852 expat 2.2.10-r1 → 2.2.10-r3 expat: Integer overflow in function XML_GetBuffer
CVE-2022-25235 expat 2.2.10-r1 → 2.2.10-r4 expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
CVE-2022-25236 expat 2.2.10-r1 → 2.2.10-r4 expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
CVE-2022-25315 expat 2.2.10-r1 → 2.2.10-r4 expat: Integer overflow in storeRawNames()
CVE-2022-28346 Django 3.2.7 → 2.2.28, 3.2.13, 4.0.4 Django: SQL injection in QuerySet.annotate(),aggregate() and extra()
CVE-2022-28347 Django 3.2.7 → 2.2.28, 3.2.13, 4.0.4 Django: SQL injection via QuerySet.explain(options) on PostgreSQL
CVE-2022-34265 Django 3.2.7 → 3.2.14, 4.0.6 python-django: Potential SQL injection via Trunc(kind) and Extract(lookup_name) arguments
CVE-2022-37434 zlib 1.2.11-r3 → 1.2.12-r2 zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field
CVE-2023-31047 Django 3.2.7 → 3.2.19, 4.1.9, 4.2.1 python-django: Potential bypass of validation when uploading multiple files using one form field
CVE-2025-64459 Django 3.2.7 → 5.2.8, 5.1.14, 4.2.26 django: Django SQL injection
GHSA-6q48-6c7w-9gw2 certifi 2021.10.8 → 2026.10.18 certifi bundles emSign root CAs with compromised intermediate CA keys
multicloudartifactory.devops.telekom.de/onap-repo/rabbitmq:alpine000
multicloudquay.io/coreos/etcd:v3.2.321910CVE-2021-36159 apk-tools 2.10.4-r2 → 2.10.7-r0 libfetch: an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes leads to information leak or crash
ncmpartifactory.devops.telekom.de/onap-repo/onap/ncmp-dmi-plugin:1.7.0136273CVE-2024-45491 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: Integer Overflow or Wraparound
CVE-2024-45492 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: integer overflow
CVE-2025-41232 org.springframework.security:spring-security-core 6.4.4 → 6.4.6 Spring-Security: Spring Security authorization bypass for method security annotations on private methods
CVE-2026-22732 org.springframework.security:spring-security-web 6.4.4 → 6.5.9, 7.0.4 Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers
CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 10.1.39 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated
CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 10.1.39 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication
CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 10.1.39 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass
CVE-2026-47884 org.springframework:spring-webmvc 6.2.5 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webmvc 6.2.5 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-55276 org.apache.tomcat.embed:tomcat-embed-core 10.1.39 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.39 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.39 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.39 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
ncmpartifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3011
nengdbartifactory.devops.telekom.de/hub.docker.com/mariadb:11.7.246771CVE-2023-24538 stdlib v1.18.2 → 1.19.8, 1.20.3 golang: html/template: backticks not treated as string delimiters
CVE-2023-24540 stdlib v1.18.2 → 1.19.9, 1.20.4 golang: html/template: improper handling of JavaScript whitespace
CVE-2024-24790 stdlib v1.18.2 → 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
CVE-2025-68121 stdlib v1.18.2 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
nengdbartifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3011
networkartifactory.devops.telekom.de/onap-repo/onap/ccsdk-apps-ms-neng:1.4.031191221CVE-2016-1000027 org.springframework:spring-web 5.3.16 → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization
CVE-2021-36159 apk-tools 2.10.5-r1 → 2.10.7-r0 libfetch: an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes leads to information leak or crash
CVE-2021-3711 libcrypto1.1 1.1.1g-r0 → 1.1.1l-r0 openssl: SM2 Decryption Buffer Overflow
CVE-2021-3711 libssl1.1 1.1.1g-r0 → 1.1.1l-r0 openssl: SM2 Decryption Buffer Overflow
CVE-2021-3711 openssl 1.1.1i-r0 → 1.1.1l-r0 openssl: SM2 Decryption Buffer Overflow
CVE-2021-42392 com.h2database:h2 1.4.200 → 2.0.206 h2: Remote Code Execution in Console
CVE-2021-43527 nss 3.60-r1 → 3.60-r2 nss: Memory corruption in decodeECorDsaSignature with DSA signatures (and RSA-PSS)
CVE-2022-0839 org.liquibase:liquibase-core 4.4.2.nordix → 4.8.0 liquibase: Improper Restriction of XML External Entity
CVE-2022-22822 expat 2.2.9-r1 → 2.2.10-r0 expat: Integer overflow in addBinding in xmlparse.c
CVE-2022-22823 expat 2.2.9-r1 → 2.2.10-r0 expat: Expat: Denial of Service vulnerability in XML parsing
CVE-2022-22824 expat 2.2.9-r1 → 2.2.10-r0 expat: Expat: Denial of service and memory issues due to integer overflow
CVE-2022-22965 org.springframework:spring-beans 5.3.16 → 5.2.20.RELEASE, 5.3.18 spring-framework: RCE via Data Binding on JDK 9+
CVE-2022-22965 org.springframework:spring-webmvc 5.3.16 → 5.2.20.RELEASE, 5.3.18 spring-framework: RCE via Data Binding on JDK 9+
CVE-2022-23221 com.h2database:h2 1.4.200 → 2.1.210 h2: Loading of custom classes from remote servers through JNDI
CVE-2022-23852 expat 2.2.9-r1 → 2.2.10-r1 expat: Integer overflow in function XML_GetBuffer
CVE-2022-25235 expat 2.2.9-r1 → 2.2.10-r2 expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
CVE-2022-25236 expat 2.2.9-r1 → 2.2.10-r2 expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
CVE-2022-25315 expat 2.2.9-r1 → 2.2.10-r2 expat: Integer overflow in storeRawNames()
CVE-2022-27404 freetype 2.10.4-r0 → 2.10.4-r1 FreeType: Buffer overflow in sfnt_init_face
CVE-2022-37434 zlib 1.2.11-r3 → 1.2.12-r2 zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field
CVE-2023-20860 org.springframework:spring-webmvc 5.3.16 → 6.0.7, 5.3.26 springframework: Security Bypass With Un-Prefixed Double Wildcard Pattern
CVE-2023-20873 org.springframework.boot:spring-boot-actuator-autoconfigure 2.5.10 → 3.0.6, 2.7.11, 2.6.15, 2.5.15 spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry
CVE-2025-24813 org.apache.tomcat.embed:tomcat-embed-core 9.0.58 → 11.0.3, 10.1.35, 9.0.99 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 9.0.58 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated
CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 9.0.58 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication
CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 9.0.58 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass
CVE-2026-47884 org.springframework:spring-webmvc 5.3.16 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-55276 org.apache.tomcat.embed:tomcat-embed-core 9.0.58 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 9.0.58 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 9.0.58 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 9.0.58 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
networkartifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3011
nginxdocker.io/bitnami/nginx:latest31720CVE-2026-15176 nginx 1.31.6-1 → 1.30.6, 1.31.7 nginx: nginx: heap-based buffer overflow in ngx_http_core_module via alias with rewrite referencing $request_filename
CVE-2026-93479 nginx 1.31.6-1 → 1.30.6, 1.31.7 nginx: NGINX map directive and regex matching vulnerability
CVE-2026-97205 nginx 1.31.6-1 → 1.30.6, 1.31.7 nginx: NGINX ngx_http_core_module vulnerability
oauth2docker.io/library/alpine:latest033
oauth2quay.io/oauth2-proxy/oauth2-proxy:v7.13.045457CVE-2025-68121 stdlib v1.25.4 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
CVE-2026-33186 google.golang.org/grpc v1.73.0 → 1.79.3 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
CVE-2026-34457 github.com/oauth2-proxy/oauth2-proxy/v7 v7.13.0 → 7.15.2 OAuth2 Proxy's Health Check User-Agent Matching Bypasses Authentication in auth_request Mode
CVE-2026-40575 github.com/oauth2-proxy/oauth2-proxy/v7 v7.13.0 → 7.15.2 oauth2-proxy: github.com/oauth2-proxy/oauth2-proxy: OAuth2 Proxy: Authentication bypass due to spoofed X-Forwarded-Uri header
onapartifactory.devops.telekom.de/hub.docker.com/adorsys/keycloak-config-cli:6.2.1-26.0.502929
policyartifactory.devops.telekom.de/hub.docker.com/busybox:1.37.0000
policyartifactory.devops.telekom.de/hub.docker.com/postgres:17.11214728CVE-2025-68121 stdlib v1.24.6 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
CVE-2026-6653 libxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3 → no fix libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free
policyartifactory.devops.telekom.de/onap-repo/library/postgres:17.11214728CVE-2025-68121 stdlib v1.24.6 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
CVE-2026-6653 libxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3 → no fix libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free
policyartifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3011
policyartifactory.devops.telekom.de/onap-repo/onap/policy-apex-pdp:5.0.135255CVE-2026-107726 com.hazelcast:hazelcast 5.5.0 → 5.7.0 com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client
CVE-2026-75595 io.netty:netty-handler 4.2.15.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
CVE-2026-8763 org.bouncycastle:bc-fips 2.1.2 → 1.0.2.7, 2.0.2, 2.1.3 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI
policyartifactory.devops.telekom.de/onap-repo/onap/policy-api:5.0.1104151CVE-2026-47884 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-47890 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-47892 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints
CVE-2026-55276 org.apache.tomcat.embed:tomcat-embed-core 11.0.22 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 11.0.22 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 11.0.22 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 11.0.22 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 11.0.22 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
CVE-2026-75595 io.netty:netty-handler 4.2.15.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
policyartifactory.devops.telekom.de/onap-repo/onap/policy-clamp-ac-a1pms-ppnt:9.1.094150CVE-2026-47884 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-47890 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-47892 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
CVE-2026-75595 io.netty:netty-handler 4.2.15.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
policyartifactory.devops.telekom.de/onap-repo/onap/policy-clamp-ac-http-ppnt:9.1.094150CVE-2026-47884 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-47890 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-47892 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
CVE-2026-75595 io.netty:netty-handler 4.2.15.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
policyartifactory.devops.telekom.de/onap-repo/onap/policy-clamp-ac-k8s-ppnt:9.1.019229246CVE-2022-1996 github.com/emicklei/go-restful v2.9.5+incompatible → 2.16.0 go-restful: Authorization Bypass Through User-Controlled Key
CVE-2022-21235 github.com/Masterminds/vcs v1.13.1 → 1.13.2 github.com/Masterminds/vcs: Command Injection via argument injection
CVE-2022-23806 stdlib v1.15.7 → 1.16.14, 1.17.7 golang: crypto/elliptic: IsOnCurve returns true for invalid field elements
CVE-2022-23806 stdlib v1.16.4 → 1.16.14, 1.17.7 golang: crypto/elliptic: IsOnCurve returns true for invalid field elements
CVE-2023-24538 stdlib v1.15.7 → 1.19.8, 1.20.3 golang: html/template: backticks not treated as string delimiters
CVE-2023-24538 stdlib v1.16.4 → 1.19.8, 1.20.3 golang: html/template: backticks not treated as string delimiters
CVE-2023-24540 stdlib v1.15.7 → 1.19.9, 1.20.4 golang: html/template: improper handling of JavaScript whitespace
CVE-2023-24540 stdlib v1.16.4 → 1.19.9, 1.20.4 golang: html/template: improper handling of JavaScript whitespace
CVE-2024-24790 stdlib v1.15.7 → 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
CVE-2024-24790 stdlib v1.16.4 → 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
CVE-2025-68121 stdlib v1.15.7 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
CVE-2025-68121 stdlib v1.16.4 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
CVE-2026-33186 google.golang.org/grpc v1.27.1 → 1.79.3 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
CVE-2026-47884 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
policyartifactory.devops.telekom.de/onap-repo/onap/policy-clamp-ac-kserve-ppnt:9.1.083745CVE-2025-14813 org.bouncycastle:bcprov-jdk18on 1.83 → 1.80.2, 1.81.1, 1.84 bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly
CVE-2026-47884 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
CVE-2026-8763 org.bouncycastle:bcprov-jdk18on 1.83 → 1.85 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI
policyartifactory.devops.telekom.de/onap-repo/onap/policy-clamp-ac-pf-ppnt:9.1.094150CVE-2026-47884 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-47890 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-47892 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
CVE-2026-75595 io.netty:netty-handler 4.2.15.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
policyartifactory.devops.telekom.de/onap-repo/onap/policy-clamp-runtime-acm:9.1.063642CVE-2026-47884 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 11.0.24 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
policyartifactory.devops.telekom.de/onap-repo/onap/policy-db-migrator:5.0.105959
policyartifactory.devops.telekom.de/onap-repo/onap/policy-distribution:5.1.003131
policyartifactory.devops.telekom.de/onap-repo/onap/policy-opa-pdp:2.1.04105109CVE-2025-68121 stdlib v1.23.1 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
CVE-2025-68121 stdlib v1.23.12 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
CVE-2026-33186 google.golang.org/grpc v1.67.0 → 1.79.3 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
CVE-2026-33186 google.golang.org/grpc v1.70.0 → 1.79.3 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
policyartifactory.devops.telekom.de/onap-repo/onap/policy-pap:5.0.173845CVE-2026-47884 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webmvc 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-55276 org.apache.tomcat.embed:tomcat-embed-core 11.0.22 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 11.0.22 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 11.0.22 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 11.0.22 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 11.0.22 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
policyartifactory.devops.telekom.de/onap-repo/onap/policy-pdpd-cl:4.0.16102105CVE-2020-10683 dom4j:dom4j 1.1 → no fix dom4j: XML External Entity vulnerability in default SAX parser
CVE-2021-26291 org.apache.maven:maven-core 3.1.1 → 3.8.1 maven: Block repositories using http by default
CVE-2026-75595 io.netty:netty-handler 4.2.15.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
CVE-2026-75595 io.netty:netty-handler 4.2.15.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
CVE-2026-8763 org.bouncycastle:bc-fips 2.1.2 → 1.0.2.7, 2.0.2, 2.1.3 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI
CVE-2026-8763 org.bouncycastle:bc-fips 2.1.2 → 1.0.2.7, 2.0.2, 2.1.3 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI
policyartifactory.devops.telekom.de/onap-repo/onap/policy-xacml-pdp:5.0.103333
portalartifactory.devops.telekom.de/hub.docker.com/alpine/psql:18.6000
portalartifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3011
portalartifactory.devops.telekom.de/onap-repo/onap/portal-ng/bff:0.5.1-20260925T075611920CVE-2026-111497 brotli-libs 1.2.0-r1 → 1.2.1-r0 brotli: Out-of-Bounds Write in Google Brotli Decoder
portalartifactory.devops.telekom.de/onap-repo/onap/portal-ng/history:0.4.0-20260925T080242630CVE-2026-111497 brotli-libs 1.2.0-r1 → 1.2.1-r0 brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-47890 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-47892 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints
CVE-2026-75595 io.netty:netty-handler 4.2.15.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
portalartifactory.devops.telekom.de/onap-repo/onap/portal-ng/preferences:0.4.0-20260925T075742630CVE-2026-111497 brotli-libs 1.2.0-r1 → 1.2.1-r0 brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-47890 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-47892 org.springframework:spring-webflux 7.0.8 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints
CVE-2026-75595 io.netty:netty-handler 4.2.15.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
portalartifactory.devops.telekom.de/onap-repo/onap/portal-ng/ui:0.2.0-20260923T0059044
postgresartifactory.devops.telekom.de/hub.docker.com/busybox:1.37.0000
postgresartifactory.devops.telekom.de/hub.docker.com/postgres:17.11214728CVE-2025-68121 stdlib v1.24.6 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
CVE-2026-6653 libxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3 → no fix libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free
robotartifactory.devops.telekom.de/onap-repo/onap/testsuite:1.14.114188200CVE-2022-23806 stdlib v1.17.5 → 1.16.14, 1.17.7 golang: crypto/elliptic: IsOnCurve returns true for invalid field elements
CVE-2023-24538 stdlib v1.17.5 → 1.19.8, 1.20.3 golang: html/template: backticks not treated as string delimiters
CVE-2023-24538 stdlib v1.17.11 → 1.19.8, 1.20.3 golang: html/template: backticks not treated as string delimiters
CVE-2023-24540 stdlib v1.17.5 → 1.19.9, 1.20.4 golang: html/template: improper handling of JavaScript whitespace
CVE-2023-24540 stdlib v1.17.11 → 1.19.9, 1.20.4 golang: html/template: improper handling of JavaScript whitespace
CVE-2024-24790 stdlib v1.17.5 → 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
CVE-2024-24790 stdlib v1.17.11 → 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
CVE-2024-41110 github.com/docker/docker v20.10.12+incompatible → 23.0.15, 26.1.5, 27.1.1, 25.0.6 moby: Authz zero length regression
CVE-2024-49768 waitress 3.0.0 → 3.0.1 waitress: python-waitress: request processing race condition in HTTP pipelining with invalid first request
CVE-2025-58367 deepdiff 8.4.2 → 8.6.1 DeepDiff is a project focused on Deep Difference and search of any Pyt ...
CVE-2025-68121 stdlib v1.17.5 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
CVE-2025-68121 stdlib v1.17.11 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
CVE-2026-33186 google.golang.org/grpc v1.43.0 → 1.79.3 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
GHSA-6q48-6c7w-9gw2 certifi 2025.4.26 → 2026.10.18 certifi bundles emSign root CAs with compromised intermediate CA keys
sdcartifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3011
sdcartifactory.devops.telekom.de/onap-repo/onap/sdc-backend-all-plugins:1.19.0107279CVE-2015-7501 commons-collections:commons-collections 3.2.1 → 3.2.2 apache-commons-collections: InvokerTransformer code execution during deserialisation
CVE-2016-1000027 org.springframework:spring-web 5.3.39 → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization
CVE-2017-7657 org.eclipse.jetty:jetty-server 9.3.12.v20160915 → 9.2.25.v20180606, 9.3.24.v20180605 jetty: HTTP request smuggling
CVE-2017-7658 org.eclipse.jetty:jetty-server 9.3.12.v20160915 → 9.2.25.v20180606, 9.3.24.v20180605, 9.4.11.v20180605 jetty: Incorrect header handling
CVE-2022-36437 com.hazelcast:hazelcast 3.7.2 → 3.12.13, 4.1.10, 4.2.6, 5.0.4, 5.1.3 hazelcast: Hazelcast connection caching
CVE-2026-107726 com.hazelcast:hazelcast 3.7.2 → 5.7.0 com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client
CVE-2026-111497 brotli-libs 1.2.0-r1 → 1.2.1-r0 brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-47884 org.springframework:spring-webmvc 5.3.39 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-49875 org.apache.cxf:cxf-core 3.6.3 → 4.2.2, 4.1.7, 3.6.12 cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening
CVE-2026-75595 io.netty:netty-handler 4.1.92.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
sdcartifactory.devops.telekom.de/onap-repo/onap/sdc-backend-init:1.19.001818
sdcartifactory.devops.telekom.de/onap-repo/onap/sdc-cassandra-init:1.19.064349CVE-2017-7657 org.eclipse.jetty:jetty-server 9.3.12.v20160915 → 9.2.25.v20180606, 9.3.24.v20180605 jetty: HTTP request smuggling
CVE-2017-7658 org.eclipse.jetty:jetty-server 9.3.12.v20160915 → 9.2.25.v20180606, 9.3.24.v20180605, 9.4.11.v20180605 jetty: Incorrect header handling
CVE-2022-36437 com.hazelcast:hazelcast 3.7.2 → 3.12.13, 4.1.10, 4.2.6, 5.0.4, 5.1.3 hazelcast: Hazelcast connection caching
CVE-2026-107726 com.hazelcast:hazelcast 3.7.2 → 5.7.0 com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client
CVE-2026-49875 org.apache.cxf:cxf-core 3.6.3 → 4.2.2, 4.1.7, 3.6.12 cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening
CVE-2026-75595 io.netty:netty-handler 4.1.92.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
sdcartifactory.devops.telekom.de/onap-repo/onap/sdc-frontend:1.19.0088
sdcartifactory.devops.telekom.de/onap-repo/onap/sdc-helm-validator:1.3.594350CVE-2016-1000027 org.springframework:spring-web 5.3.31 → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization
CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 9.0.99 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated
CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 9.0.99 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication
CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 9.0.99 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass
CVE-2026-47884 org.springframework:spring-webmvc 5.3.31 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-55276 org.apache.tomcat.embed:tomcat-embed-core 9.0.99 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 9.0.99 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 9.0.99 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 9.0.99 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
sdcartifactory.devops.telekom.de/onap-repo/onap/sdc-onboard-backend:1.19.053337CVE-2016-1000027 org.springframework:spring-web 5.3.39 → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization
CVE-2026-47884 org.springframework:spring-webmvc 5.3.39 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-49875 org.apache.cxf:cxf-core 3.6.3 → 4.2.2, 4.1.7, 3.6.12 cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening
CVE-2026-75595 io.netty:netty-handler 4.1.92.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
CVE-2026-84939 org.freemarker:freemarker 2.3.30 → 2.3.35 org.apache.freemarker/freemarker: Apache FreeMarker: Path traversal via malformed locale identifier
sdcartifactory.devops.telekom.de/onap-repo/onap/sdc-onboard-cassandra-init:1.19.00556
sdcartifactory.devops.telekom.de/onap-repo/onap/sdc-workflow-backend:1.15.044447CVE-2016-1000027 org.springframework:spring-web 5.3.31 → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization
CVE-2026-111497 brotli-libs 1.2.0-r1 → 1.2.1-r0 brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-47884 org.springframework:spring-webmvc 5.3.31 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-75595 io.netty:netty-handler 4.1.101.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
sdcartifactory.devops.telekom.de/onap-repo/onap/sdc-workflow-frontend:1.15.058590CVE-2026-31789 libcrypto3 3.5.1-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 libssl3 3.5.1-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 openssl 3.5.1-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-33845 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment
CVE-2026-42010 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: gnutls: Authentication Bypass via NUL Character in Username
sdcartifactory.devops.telekom.de/onap-repo/onap/sdc-workflow-init:1.15.002121
sdncartifactory.devops.telekom.de/hub.docker.com/busybox:1.37.0000
sdncartifactory.devops.telekom.de/onap-repo/onap/ccsdk-dgbuilder-image:2.2.032293323CVE-2017-16042 growl 1.8.1 → 1.10.0 nodejs-growl: Does not properly sanitize input before passing it to exec
CVE-2019-10744 lodash 0.9.2 → 4.17.12 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties
CVE-2019-10744 lodash 0.9.2 → 4.17.12 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties
CVE-2019-10744 lodash 1.3.1 → 4.17.12 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties
CVE-2019-10744 lodash 2.4.2 → 4.17.12 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties
CVE-2019-10744 lodash 2.4.2 → 4.17.12 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties
CVE-2019-10744 lodash 2.4.2 → 4.17.12 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties
CVE-2019-10744 lodash 2.4.2 → 4.17.12 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties
CVE-2019-10744 lodash 3.7.0 → 4.17.12 nodejs-lodash: prototype pollution in defaultsDeep function leading to modifying properties
CVE-2019-5413 morgan 1.3.2 → 1.9.1 nodejs-morgan: Unescaped input in compile() function
CVE-2020-28282 getobject 0.1.0 → 1.0.0 nodejs-getobject: Prototype pollution could result in DoS and RCE
CVE-2020-7769 nodemailer 1.3.0 → 6.4.16 This affects the package nodemailer before 6.4.16. Use of crafted reci ...
CVE-2021-23358 underscore 1.6.0 → 1.12.1 nodejs-underscore: Arbitrary code execution via the template function
CVE-2021-23358 underscore 1.7.0 → 1.12.1 nodejs-underscore: Arbitrary code execution via the template function
CVE-2021-44906 minimist 0.0.8 → 1.2.6, 0.2.4 minimist: prototype pollution
CVE-2022-42889 org.apache.commons:commons-text 1.9 → 1.10.0 apache-commons-text: variable interpolation RCE
CVE-2025-55130 nodejs 22.15.1-r0 → 22.22.2-r0 nodejs: Nodejs file permissions bypass
CVE-2025-7783 form-data 0.1.2 → 2.5.4, 3.0.4, 4.0.4 form-data: Unsafe random function in form-data
CVE-2025-7783 form-data 0.1.4 → 2.5.4, 3.0.4, 4.0.4 form-data: Unsafe random function in form-data
CVE-2026-111497 brotli-libs 1.1.0-r2 → 1.1.1-r0 brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-31789 libcrypto3 3.3.5-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 libssl3 3.3.5-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 openssl 3.3.5-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-33845 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment
CVE-2026-42010 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: gnutls: Authentication Bypass via NUL Character in Username
CVE-2026-44170 mariadb-client 11.4.8-r0 → 11.4.11-r0 mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine
CVE-2026-44170 mariadb-common 11.4.8-r0 → 11.4.11-r0 mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine
CVE-2026-44170 mysql-client 11.4.8-r0 → 11.4.11-r0 mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine
CVE-2026-44172 mariadb-client 11.4.8-r0 → 11.4.11-r0 mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()
CVE-2026-44172 mariadb-common 11.4.8-r0 → 11.4.11-r0 mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()
CVE-2026-44172 mysql-client 11.4.8-r0 → 11.4.11-r0 mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()
CVE-2026-48930 nodejs 22.15.1-r0 → 22.23.0-r0 nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling
sdncartifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3011
sdncartifactory.devops.telekom.de/onap-repo/onap/sdnc-ansible-server-image:3.2.4105969CVE-2021-36159 apk-tools 2.10.5-r1 → 2.10.7-r0 libfetch: an out of boundary read while libfetch uses strtol to parse the relevant numbers into address bytes leads to information leak or crash
CVE-2022-22822 expat 2.2.9-r1 → 2.2.10-r0 expat: Integer overflow in addBinding in xmlparse.c
CVE-2022-22823 expat 2.2.9-r1 → 2.2.10-r0 expat: Expat: Denial of Service vulnerability in XML parsing
CVE-2022-22824 expat 2.2.9-r1 → 2.2.10-r0 expat: Expat: Denial of service and memory issues due to integer overflow
CVE-2022-23852 expat 2.2.9-r1 → 2.2.10-r1 expat: Integer overflow in function XML_GetBuffer
CVE-2022-25235 expat 2.2.9-r1 → 2.2.10-r2 expat: Malformed 2- and 3-byte UTF-8 sequences can lead to arbitrary code execution
CVE-2022-25236 expat 2.2.9-r1 → 2.2.10-r2 expat: Namespace-separator characters in "xmlns[:prefix]" attribute values can lead to arbitrary code execution
CVE-2022-25315 expat 2.2.9-r1 → 2.2.10-r2 expat: Integer overflow in storeRawNames()
CVE-2022-37434 zlib 1.2.11-r3 → 1.2.12-r2 zlib: heap-based buffer over-read and overflow in inflate() in inflate.c via a large gzip header extra field
GHSA-6q48-6c7w-9gw2 certifi 2026.2.25 → 2026.10.18 certifi bundles emSign root CAs with compromised intermediate CA keys
sdncartifactory.devops.telekom.de/onap-repo/onap/sdnc-image:3.2.471394427CVE-2016-1000027 org.springframework:spring-web 5.2.12.RELEASE → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization
CVE-2016-1000027 org.springframework:spring-web 5.2.12.RELEASE → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization
CVE-2019-17571 log4j:log4j 1.2.17 → no fix log4j: deserialization of untrusted data in SocketServer
CVE-2019-17571 log4j:log4j 1.2.17 → no fix log4j: deserialization of untrusted data in SocketServer
CVE-2019-17571 log4j:log4j 1.2.17 → no fix log4j: deserialization of untrusted data in SocketServer
CVE-2019-17571 log4j:log4j 1.2.17 → no fix log4j: deserialization of untrusted data in SocketServer
CVE-2019-17571 log4j:log4j 1.2.17 → no fix log4j: deserialization of untrusted data in SocketServer
CVE-2019-17571 log4j:log4j 1.2.17 → no fix log4j: deserialization of untrusted data in SocketServer
CVE-2020-11989 org.apache.shiro:shiro-core 1.3.2 → 1.5.3 shiro: spring dynamic controllers, a specially crafted request may cause an authentication bypass
CVE-2020-11989 org.apache.shiro:shiro-core 1.3.2 → 1.5.3 shiro: spring dynamic controllers, a specially crafted request may cause an authentication bypass
CVE-2020-11989 org.apache.shiro:shiro-core 1.3.2 → 1.5.3 shiro: spring dynamic controllers, a specially crafted request may cause an authentication bypass
CVE-2020-11989 org.apache.shiro:shiro-core 1.3.2 → 1.5.3 shiro: spring dynamic controllers, a specially crafted request may cause an authentication bypass
CVE-2020-1957 org.apache.shiro:shiro-core 1.3.2 → 1.5.2 shiro: Spring dynamic controllers, a specially crafted request may cause an authentication bypass
CVE-2020-1957 org.apache.shiro:shiro-core 1.3.2 → 1.5.2 shiro: Spring dynamic controllers, a specially crafted request may cause an authentication bypass
CVE-2020-1957 org.apache.shiro:shiro-core 1.3.2 → 1.5.2 shiro: Spring dynamic controllers, a specially crafted request may cause an authentication bypass
CVE-2020-1957 org.apache.shiro:shiro-core 1.3.2 → 1.5.2 shiro: Spring dynamic controllers, a specially crafted request may cause an authentication bypass
CVE-2021-41303 org.apache.shiro:shiro-core 1.3.2 → 1.8.0 shiro: specially crafted HTTP request may cause an authentication bypass
CVE-2021-41303 org.apache.shiro:shiro-core 1.3.2 → 1.8.0 shiro: specially crafted HTTP request may cause an authentication bypass
CVE-2021-41303 org.apache.shiro:shiro-core 1.3.2 → 1.8.0 shiro: specially crafted HTTP request may cause an authentication bypass
CVE-2021-41303 org.apache.shiro:shiro-core 1.3.2 → 1.8.0 shiro: specially crafted HTTP request may cause an authentication bypass
CVE-2022-22965 org.springframework:spring-beans 5.2.12.RELEASE → 5.2.20.RELEASE, 5.3.18 spring-framework: RCE via Data Binding on JDK 9+
CVE-2022-22965 org.springframework:spring-beans 5.2.12.RELEASE → 5.2.20.RELEASE, 5.3.18 spring-framework: RCE via Data Binding on JDK 9+
CVE-2022-23305 log4j:log4j 1.2.17 → no fix log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender
CVE-2022-23305 log4j:log4j 1.2.17 → no fix log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender
CVE-2022-23305 log4j:log4j 1.2.17 → no fix log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender
CVE-2022-23305 log4j:log4j 1.2.17 → no fix log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender
CVE-2022-23305 log4j:log4j 1.2.17 → no fix log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender
CVE-2022-23305 log4j:log4j 1.2.17 → no fix log4j: SQL injection in Log4j 1.x when application is configured to use JDBCAppender
CVE-2022-23307 log4j:log4j 1.2.17 → no fix log4j: Unsafe deserialization flaw in Chainsaw log viewer
CVE-2022-23307 log4j:log4j 1.2.17 → no fix log4j: Unsafe deserialization flaw in Chainsaw log viewer
CVE-2022-23307 log4j:log4j 1.2.17 → no fix log4j: Unsafe deserialization flaw in Chainsaw log viewer
CVE-2022-23307 log4j:log4j 1.2.17 → no fix log4j: Unsafe deserialization flaw in Chainsaw log viewer
CVE-2022-23307 log4j:log4j 1.2.17 → no fix log4j: Unsafe deserialization flaw in Chainsaw log viewer
CVE-2022-23307 log4j:log4j 1.2.17 → no fix log4j: Unsafe deserialization flaw in Chainsaw log viewer
CVE-2022-32532 org.apache.shiro:shiro-core 1.3.2 → 1.9.1 shiro: authorization bypass due to possible misconfigured
CVE-2022-32532 org.apache.shiro:shiro-core 1.3.2 → 1.9.1 shiro: authorization bypass due to possible misconfigured
CVE-2022-32532 org.apache.shiro:shiro-core 1.3.2 → 1.9.1 shiro: authorization bypass due to possible misconfigured
CVE-2022-32532 org.apache.shiro:shiro-core 1.3.2 → 1.9.1 shiro: authorization bypass due to possible misconfigured
CVE-2022-40664 org.apache.shiro:shiro-core 1.3.2 → 1.10.0 shiro: Authentication Bypass Vulnerability
CVE-2022-40664 org.apache.shiro:shiro-core 1.3.2 → 1.10.0 shiro: Authentication Bypass Vulnerability
CVE-2022-40664 org.apache.shiro:shiro-core 1.3.2 → 1.10.0 shiro: Authentication Bypass Vulnerability
CVE-2022-40664 org.apache.shiro:shiro-core 1.3.2 → 1.10.0 shiro: Authentication Bypass Vulnerability
CVE-2022-42889 org.apache.commons:commons-text 1.9 → 1.10.0 apache-commons-text: variable interpolation RCE
CVE-2022-42889 org.apache.commons:commons-text 1.9 → 1.10.0 apache-commons-text: variable interpolation RCE
CVE-2022-42889 org.apache.commons:commons-text 1.9 → 1.10.0 apache-commons-text: variable interpolation RCE
CVE-2022-42889 org.apache.commons:commons-text 1.9 → 1.10.0 apache-commons-text: variable interpolation RCE
CVE-2025-14813 org.bouncycastle:bcprov-jdk18on 1.80 → 1.80.2, 1.81.1, 1.84 bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly
CVE-2025-14813 org.bouncycastle:bcprov-jdk18on 1.80 → 1.80.2, 1.81.1, 1.84 bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly
CVE-2025-14813 org.bouncycastle:bcprov-jdk18on 1.80 → 1.80.2, 1.81.1, 1.84 bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly
CVE-2025-3277 sqlite-libs 3.48.0-r0 → 3.48.0-r1 SQLite: integer overflow in SQLite
CVE-2025-55130 nodejs 22.15.1-r0 → 22.22.2-r0 nodejs: Nodejs file permissions bypass
CVE-2026-111497 brotli-libs 1.1.0-r2 → 1.1.1-r0 brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-31789 libcrypto3 3.3.3-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 libssl3 3.3.3-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 openssl 3.3.3-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-33701 io.opentelemetry.javaagent:opentelemetry-javaagent 2.24.0 → 2.26.1 io.opentelemetry.javaagent/opentelemetry-javaagent: OpenTelemetry Java Instrumentation: Remote code execution via deserialization vulnerability in RMI
CVE-2026-33845 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment
CVE-2026-42010 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: gnutls: Authentication Bypass via NUL Character in Username
CVE-2026-44170 mariadb-client 11.4.8-r0 → 11.4.11-r0 mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine
CVE-2026-44170 mariadb-common 11.4.8-r0 → 11.4.11-r0 mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine
CVE-2026-44170 mysql-client 11.4.8-r0 → 11.4.11-r0 mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine
CVE-2026-44172 mariadb-client 11.4.8-r0 → 11.4.11-r0 mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()
CVE-2026-44172 mariadb-common 11.4.8-r0 → 11.4.11-r0 mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()
CVE-2026-44172 mysql-client 11.4.8-r0 → 11.4.11-r0 mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()
CVE-2026-48930 nodejs 22.15.1-r0 → 22.23.0-r0 nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling
CVE-2026-75595 io.netty:netty-handler 4.1.119.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
CVE-2026-75595 io.netty:netty-handler 4.1.119.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
CVE-2026-75595 io.netty:netty-handler 4.1.68.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
CVE-2026-8763 org.bouncycastle:bcprov-jdk18on 1.80 → 1.85 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI
CVE-2026-8763 org.bouncycastle:bcprov-jdk18on 1.80 → 1.85 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI
CVE-2026-8763 org.bouncycastle:bcprov-jdk18on 1.80 → 1.85 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI
sdncartifactory.devops.telekom.de/onap-repo/onap/sdnc-ueb-listener-image:3.2.415192205CVE-2025-3277 sqlite-libs 3.48.0-r0 → 3.48.0-r1 SQLite: integer overflow in SQLite
CVE-2025-55130 nodejs 22.15.1-r0 → 22.22.2-r0 nodejs: Nodejs file permissions bypass
CVE-2026-111497 brotli-libs 1.1.0-r2 → 1.1.1-r0 brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-31789 libcrypto3 3.3.3-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 libssl3 3.3.3-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 openssl 3.3.3-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-33845 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment
CVE-2026-42010 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: gnutls: Authentication Bypass via NUL Character in Username
CVE-2026-44170 mariadb-client 11.4.8-r0 → 11.4.11-r0 mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine
CVE-2026-44170 mariadb-common 11.4.8-r0 → 11.4.11-r0 mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine
CVE-2026-44170 mysql-client 11.4.8-r0 → 11.4.11-r0 mariadb: Arbitrary shell command execution via improper sanitization in CONNECT engine
CVE-2026-44172 mariadb-client 11.4.8-r0 → 11.4.11-r0 mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()
CVE-2026-44172 mariadb-common 11.4.8-r0 → 11.4.11-r0 mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()
CVE-2026-44172 mysql-client 11.4.8-r0 → 11.4.11-r0 mariadb: MariaDB server: SQL injection vulnerability via improper handling of big5 character set with mysql_real_escape_string()
CVE-2026-48930 nodejs 22.15.1-r0 → 22.23.0-r0 nodejs: Node.js: Silent authority rebinding due to embedded-nul hostnames in TLS handling
sdncartifactory.devops.telekom.de/onap-repo/onap/sdnc-web-image:3.2.421280165CVE-2023-45853 zlib1g 1:1.2.13.dfsg-1 → no fix zlib: integer overflow and resultant heap-based buffer overflow in zipOpenNewFileInZip4_6
CVE-2024-56171 libxml2 2.9.14+dfsg-1.3~deb12u1 → 2.9.14+dfsg-1.3~deb12u2 libxml2: Use-After-Free in libxml2
CVE-2025-68121 stdlib v1.21.11 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
CVE-2025-7458 libsqlite3-0 3.40.1-2+deb12u2 → no fix sqlite: SQLite integer overflow
CVE-2026-13221 libperl5.36 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl: Perl: Incorrect regular expression processing via large regular expressions
CVE-2026-13221 perl 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl: Perl: Incorrect regular expression processing via large regular expressions
CVE-2026-13221 perl-base 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl: Perl: Incorrect regular expression processing via large regular expressions
CVE-2026-13221 perl-modules-5.36 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl: Perl: Incorrect regular expression processing via large regular expressions
CVE-2026-31789 libssl3 3.0.18-1~deb12u2 → 3.0.19-1~deb12u2 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 openssl 3.0.18-1~deb12u2 → 3.0.19-1~deb12u2 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-33845 libgnutls30 3.7.9-2+deb12u2 → 3.7.9-2+deb12u7 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment
CVE-2026-42010 libgnutls30 3.7.9-2+deb12u2 → 3.7.9-2+deb12u7 gnutls: gnutls: Authentication Bypass via NUL Character in Username
CVE-2026-42496 libperl5.36 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access
CVE-2026-42496 perl 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access
CVE-2026-42496 perl-base 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access
CVE-2026-42496 perl-modules-5.36 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl-archive-tar: perl-archive-tar: Path traversal via crafted symlinks allows arbitrary file access
CVE-2026-6653 libxml2 2.9.14+dfsg-1.3~deb12u1 → no fix libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free
CVE-2026-8376 libperl5.36 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds
CVE-2026-8376 perl 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds
CVE-2026-8376 perl-base 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds
CVE-2026-8376 perl-modules-5.36 5.36.0-7+deb12u1 → 5.36.0-7+deb12u4 perl: Perl: Heap buffer overflow when compiling regular expressions on 32-bit builds
soartifactory.devops.telekom.de/hub.docker.com/busybox:1.37.0000
soartifactory.devops.telekom.de/hub.docker.com/mariadb:11.7.246771CVE-2023-24538 stdlib v1.18.2 → 1.19.8, 1.20.3 golang: html/template: backticks not treated as string delimiters
CVE-2023-24540 stdlib v1.18.2 → 1.19.9, 1.20.4 golang: html/template: improper handling of JavaScript whitespace
CVE-2024-24790 stdlib v1.18.2 → 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
CVE-2025-68121 stdlib v1.18.2 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
soartifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3011
soartifactory.devops.telekom.de/onap-repo/onap/so/api-handler-infra:1.23.0-20261110T18122810CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
soartifactory.devops.telekom.de/onap-repo/onap/so/bpmn-infra:1.23.0-20261110T181231821CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-75595 io.netty:netty-handler 4.1.135.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
soartifactory.devops.telekom.de/onap-repo/onap/so/catalog-db-adapter:1.23.0-20261110T18122810CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
soartifactory.devops.telekom.de/onap-repo/onap/so/openstack-adapter:1.23.0-20261110T18122810CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
soartifactory.devops.telekom.de/onap-repo/onap/so/request-db-adapter:1.23.0-20261110T18122810CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
soartifactory.devops.telekom.de/onap-repo/onap/so/sdc-controller:1.23.0-20261110T181221113CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
soartifactory.devops.telekom.de/onap-repo/onap/so/sdnc-adapter:1.23.0-20261110T18122810CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
soartifactory.devops.telekom.de/onap-repo/onap/so/so-admin-cockpit:1.10.027210236CVE-2016-1000027 org.springframework:spring-web 5.2.12.RELEASE → 6.0.0 spring: HttpInvokerServiceExporter readRemoteInvocation method untrusted java deserialization
CVE-2019-20444 io.netty:netty-codec-http 4.1.42.Final → 4.1.44 netty: HTTP request smuggling
CVE-2022-22965 org.springframework.boot:spring-boot-starter-web 2.3.7.RELEASE → 2.5.12, 2.6.6 spring-framework: RCE via Data Binding on JDK 9+
CVE-2022-22965 org.springframework:spring-beans 5.2.12.RELEASE → 5.2.20.RELEASE, 5.3.18 spring-framework: RCE via Data Binding on JDK 9+
CVE-2022-22965 org.springframework:spring-webmvc 5.2.12.RELEASE → 5.2.20.RELEASE, 5.3.18 spring-framework: RCE via Data Binding on JDK 9+
CVE-2022-22978 org.springframework.security:spring-security-core 5.3.6.RELEASE → 5.5.7, 5.6.4, 5.4.11 springframework: Authorization Bypass in RegexRequestMatcher
CVE-2022-22978 org.springframework.security:spring-security-web 5.3.6.RELEASE → 5.5.7, 5.6.4, 5.4.11 springframework: Authorization Bypass in RegexRequestMatcher
CVE-2023-20873 org.springframework.boot:spring-boot-actuator-autoconfigure 2.3.7.RELEASE → 3.0.6, 2.7.11, 2.6.15, 2.5.15 spring-boot: Security Bypass With Wildcard Pattern Matching on Cloud Foundry
CVE-2024-38821 org.springframework.security:spring-security-web 5.3.6.RELEASE → 5.7.13, 5.8.15, 6.2.7, 6.0.13, 6.1.11, 6.3.4 Spring-WebFlux: Authorization Bypass of Static Resources in WebFlux Applications
CVE-2025-24813 org.apache.tomcat.embed:tomcat-embed-core 9.0.41 → 11.0.3, 10.1.35, 9.0.99 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
CVE-2026-111497 brotli-libs 1.1.0-r2 → 1.1.1-r0 brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-22732 org.springframework.security:spring-security-web 5.3.6.RELEASE → 6.5.9, 7.0.4 Spring Security: Spring Security: Security policy bypass and information disclosure due to unwritten HTTP headers
CVE-2026-31789 libcrypto3 3.3.3-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 libssl3 3.3.3-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 openssl 3.3.3-r0 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-33845 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: GnuTLS: Denial of Service via DTLS zero-length fragment
CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 9.0.41 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated
CVE-2026-42010 gnutls 3.8.8-r0 → 3.8.13-r0 gnutls: gnutls: Authentication Bypass via NUL Character in Username
CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 9.0.41 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication
CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 9.0.41 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass
CVE-2026-47884 org.springframework:spring-webmvc 5.2.12.RELEASE → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-55276 org.apache.tomcat.embed:tomcat-embed-core 9.0.41 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 9.0.41 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 9.0.41 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 9.0.41 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
CVE-2026-75595 io.netty:netty-handler 4.1.42.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
CVE-2026-75595 io.netty:netty-handler 4.1.55.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
soartifactory.devops.telekom.de/onap-repo/onap/so/so-cnf-adapter:1.17.292029CVE-2026-33701 io.opentelemetry.javaagent:opentelemetry-javaagent 2.25.0 → 2.26.1 io.opentelemetry.javaagent/opentelemetry-javaagent: OpenTelemetry Java Instrumentation: Remote code execution via deserialization vulnerability in RMI
CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-49875 org.apache.cxf:cxf-core 4.0.5 → 4.2.2, 4.1.7, 3.6.12 cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening
CVE-2026-55276 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
soartifactory.devops.telekom.de/onap-repo/onap/so/so-cnfm-as-lcm:1.17.223209230CVE-2022-1996 github.com/emicklei/go-restful v2.9.5+incompatible → 2.16.0 go-restful: Authorization Bypass Through User-Controlled Key
CVE-2022-21235 github.com/Masterminds/vcs v1.13.1 → 1.13.2 github.com/Masterminds/vcs: Command Injection via argument injection
CVE-2022-23806 stdlib v1.15.7 → 1.16.14, 1.17.7 golang: crypto/elliptic: IsOnCurve returns true for invalid field elements
CVE-2022-23806 stdlib v1.16.4 → 1.16.14, 1.17.7 golang: crypto/elliptic: IsOnCurve returns true for invalid field elements
CVE-2023-24538 stdlib v1.15.7 → 1.19.8, 1.20.3 golang: html/template: backticks not treated as string delimiters
CVE-2023-24538 stdlib v1.16.4 → 1.19.8, 1.20.3 golang: html/template: backticks not treated as string delimiters
CVE-2023-24540 stdlib v1.15.7 → 1.19.9, 1.20.4 golang: html/template: improper handling of JavaScript whitespace
CVE-2023-24540 stdlib v1.16.4 → 1.19.9, 1.20.4 golang: html/template: improper handling of JavaScript whitespace
CVE-2024-24790 stdlib v1.15.7 → 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
CVE-2024-24790 stdlib v1.16.4 → 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
CVE-2025-14813 org.bouncycastle:bcprov-jdk18on 1.76 → 1.80.2, 1.81.1, 1.84 bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly
CVE-2025-68121 stdlib v1.15.7 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
CVE-2025-68121 stdlib v1.16.4 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
CVE-2026-33186 google.golang.org/grpc v1.27.1 → 1.79.3 google.golang.org/grpc/grpc-go: google.golang.org/grpc/authz: gRPC-Go: Authorization bypass due to improper HTTP/2 path validation
CVE-2026-33701 io.opentelemetry.javaagent:opentelemetry-javaagent 2.25.0 → 2.26.1 io.opentelemetry.javaagent/opentelemetry-javaagent: OpenTelemetry Java Instrumentation: Remote code execution via deserialization vulnerability in RMI
CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-55276 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
CVE-2026-8763 org.bouncycastle:bcprov-jdk18on 1.76 → 1.85 org.bouncycastle/bcprov-jdk15on: org.bouncycastle/bcpkix-jdk15on: Bouncy Castle for Java: Name Constraints bypass via trailing dot in rfc822Name and URI
soartifactory.devops.telekom.de/onap-repo/onap/so/so-etsi-nfvo-ns-lcm:1.13.181725CVE-2026-111497 brotli-libs 1.2.0-r1 → 1.2.1-r0 brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-55276 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
soartifactory.devops.telekom.de/onap-repo/onap/so/so-etsi-sol003-adapter:1.13.181624CVE-2026-111497 brotli-libs 1.2.0-r1 → 1.2.1-r0 brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-55276 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
soartifactory.devops.telekom.de/onap-repo/onap/so/so-etsi-sol005-adapter:1.13.192029CVE-2026-111497 brotli-libs 1.2.0-r1 → 1.2.1-r0 brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-49875 org.apache.cxf:cxf-core 4.0.5 → 4.2.2, 4.1.7, 3.6.12 cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening
CVE-2026-55276 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
soartifactory.devops.telekom.de/onap-repo/onap/so/so-nssmf-adapter:1.15.192029CVE-2026-111497 brotli-libs 1.2.0-r1 → 1.2.1-r0 brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-49875 org.apache.cxf:cxf-core 4.0.5 → 4.2.2, 4.1.7, 3.6.12 cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening
CVE-2026-55276 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
soartifactory.devops.telekom.de/onap-repo/onap/so/so-oof-adapter:1.14.1122335CVE-2026-111497 brotli-libs 1.2.0-r1 → 1.2.1-r0 brotli: Out-of-Bounds Write in Google Brotli Decoder
CVE-2026-47884 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-47890 org.springframework:spring-webflux 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-47890 org.springframework:spring-webmvc 6.2.19 → 7.0.9 org.springframework/spring-webmvc: org.springframework/spring-webflux: Spring Framework: Stream corruption in Server-Sent Events (SSE) with view fragments
CVE-2026-47892 org.springframework:spring-webflux 6.2.19 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints
CVE-2026-49875 org.apache.cxf:cxf-core 4.0.5 → 4.2.2, 4.1.7, 3.6.12 cxf: org.apache.cxf/cxf-core: Apache CXF: Information disclosure via out-of-band external entity resolution due to missing JAXP hardening
CVE-2026-55276 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65637 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.59, 9.0.121 tomcat: Apache Tomcat: Improper Input Validation allows HTTP/2 no-authority bypass of strict SNI validation
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.55 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
CVE-2026-75595 io.netty:netty-handler 4.1.135.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
uuiartifactory.devops.telekom.de/hub.docker.com/alpine/psql:18.6000
uuiartifactory.devops.telekom.de/hub.docker.com/busybox:1.37.0000
uuiartifactory.devops.telekom.de/hub.docker.com/postgres:17.11214728CVE-2025-68121 stdlib v1.24.6 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
CVE-2026-6653 libxml2 2.12.7+dfsg+really2.9.14-2.1+deb13u3 → no fix libxml2: mingw-libxml2: libxml2: Denial of Service via crafted XML input due to use-after-free
uuiartifactory.devops.telekom.de/onap-repo/onap/oom/readiness:7.0.3011
uuiartifactory.devops.telekom.de/onap-repo/onap/usecase-ui-intent-analysis:16.0.118106124CVE-2015-7501 commons-collections:commons-collections 3.2.1 → 3.2.2 apache-commons-collections: InvokerTransformer code execution during deserialisation
CVE-2017-7657 org.eclipse.jetty:jetty-server 9.3.12.v20160915 → 9.2.25.v20180606, 9.3.24.v20180605 jetty: HTTP request smuggling
CVE-2017-7658 org.eclipse.jetty:jetty-server 9.3.12.v20160915 → 9.2.25.v20180606, 9.3.24.v20180605, 9.4.11.v20180605 jetty: Incorrect header handling
CVE-2022-36437 com.hazelcast:hazelcast 3.7.2 → 3.12.13, 4.1.10, 4.2.6, 5.0.4, 5.1.3 hazelcast: Hazelcast connection caching
CVE-2022-42889 org.apache.commons:commons-text 1.9 → 1.10.0 apache-commons-text: variable interpolation RCE
CVE-2024-45491 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: Integer Overflow or Wraparound
CVE-2024-45492 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: integer overflow
CVE-2025-24813 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 11.0.3, 10.1.35, 9.0.99 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
CVE-2026-107726 com.hazelcast:hazelcast 3.7.2 → 5.7.0 com.hazelcast/hazelcast: Hazelcast: Arbitrary member memory access by low-privileged client
CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated
CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication
CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass
CVE-2026-47884 org.springframework:spring-webmvc 6.0.12 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-55276 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
CVE-2026-75595 io.netty:netty-handler 4.1.97.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
uuiartifactory.devops.telekom.de/onap-repo/onap/usecase-ui-llm-adaptation:16.0.146266CVE-2024-45491 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: Integer Overflow or Wraparound
CVE-2024-45492 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: integer overflow
CVE-2026-47892 org.springframework:spring-webflux 6.0.12 → 7.0.9 org.springframework/spring-webflux: Spring Framework: Header Predicate Bypass in WebFlux Functional Endpoints
CVE-2026-75595 io.netty:netty-handler 4.1.97.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
uuiartifactory.devops.telekom.de/onap-repo/onap/usecase-ui-nlp:1.0.514169182CVE-2020-13092 scikit-learn 0.21.2 → no fix scikit-learn (aka sklearn) through 0.23.0 can unserialize and execute ...
CVE-2021-41208 tensorflow 1.14.0 → 2.6.1, 2.5.2, 2.4.4 Incomplete validation in boosted trees code
CVE-2022-21797 joblib 0.13.2 → 1.2.0 The package joblib from 0 and before 1.2.0 are vulnerable to Arbitrary ...
CVE-2022-22817 Pillow 8.4.0 → 9.0.1 python-pillow: PIL.ImageMath.eval allows evaluation of arbitrary expressions
CVE-2022-45907 torch 1.10.1+cpu → 1.13.1 In PyTorch before trunk/89695, torch.jit.annotations.parse_type_line c ...
CVE-2023-25668 tensorflow 1.14.0 → 2.11.1 CVE-2023-25668 affecting package tensorflow for versions less than 2.11.1-1
CVE-2023-50447 Pillow 8.4.0 → 10.2.0 pillow: Arbitrary Code Execution via the environment parameter
CVE-2025-32434 torch 1.10.1+cpu → 2.6.0 PyTorch is a Python package that provides tensor computation with stro ...
CVE-2026-112393 Pillow 8.4.0 → 13.0.0 pillow: Pillow: Heap buffer overflow in _tiffWriteProc when saving TIFF to BytesIO
CVE-2026-112398 Pillow 8.4.0 → 13.0.0 pillow: Pillow: Heap buffer overflow in FlashPix (FPX) JPEG decoding leads to code execution
CVE-2026-112403 Pillow 8.4.0 → 13.0.0 pillow: Pillow: Heap buffer overflow in ImagingJpegDecode
CVE-2026-112900 Pillow 8.4.0 → 13.0.0 pillow: Pillow: Argument Injection in Ghostscript call, potentially leading into RCE
GHSA-6q48-6c7w-9gw2 certifi 2023.5.7 → 2026.10.18 certifi bundles emSign root CAs with compromised intermediate CA keys
GHSA-h6gw-r52c-724r tensorflow 1.14.0 → 2.5.3, 2.6.3, 2.7.1 NULL Pointer Dereference and Access of Uninitialized Pointer in TensorFlow
uuiartifactory.devops.telekom.de/onap-repo/onap/usecase-ui-server:16.0.1116576CVE-2024-45491 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: Integer Overflow or Wraparound
CVE-2024-45492 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: integer overflow
CVE-2025-24813 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 11.0.3, 10.1.35, 9.0.99 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
CVE-2026-41293 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated
CVE-2026-43512 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication
CVE-2026-43515 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass
CVE-2026-47884 org.springframework:spring-webmvc 6.0.12 → 7.0.9 org.springframework/spring-webmvc: Spring Framework: Remote Code Execution via improper path limitation in XsltView
CVE-2026-55276 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65905 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat.embed:tomcat-embed-core 10.1.13 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
uuiartifactory.devops.telekom.de/onap-repo/onap/usecase-ui:16.0.1124052CVE-2024-45491 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: Integer Overflow or Wraparound
CVE-2024-45492 libexpat 2.5.0-r0 → 2.6.3-r0 libexpat: integer overflow
CVE-2024-52316 org.apache.tomcat:tomcat-catalina 10.1.2 → 9.0.96, 10.1.30, 11.0.1 tomcat: Apache Tomcat: Authentication bypass when using Jakarta Authentication API
CVE-2025-24813 org.apache.tomcat:tomcat-catalina 10.1.2 → 11.0.3, 10.1.35, 9.0.99 tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
CVE-2026-41293 org.apache.tomcat:tomcat-coyote 10.1.2 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: HTTP/2 request headers not validated
CVE-2026-43512 org.apache.tomcat:tomcat-catalina 10.1.2 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: Apache Tomcat: Authentication bypass via digest authentication
CVE-2026-43515 org.apache.tomcat:tomcat-catalina 10.1.2 → 9.0.118, 10.1.55, 11.0.22 tomcat-coyote: tomcat: Improper Authorization allows security bypass
CVE-2026-53434 org.apache.tomcat:tomcat-util 10.1.2 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Error condition not handled when configuring CRLs
CVE-2026-55276 org.apache.tomcat:tomcat-util-scan 10.1.2 → 11.0.23, 10.1.56, 9.0.119 tomcat: Apache Tomcat: Misleading security logs due to incorrect control flow
CVE-2026-65182 org.apache.tomcat:tomcat-catalina 10.1.2 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Security constraint bypass due to improper access control
CVE-2026-65905 org.apache.tomcat:tomcat-catalina 10.1.2 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Authentication bypass via limited replay attack in DIGEST authenticator
CVE-2026-68525 org.apache.tomcat:tomcat-catalina 10.1.2 → 11.0.25, 10.1.58, 9.0.121 tomcat: Apache Tomcat: Unauthorized resource access via FORM authentication bypass
k8ssandra (datastore)artifactory.devops.telekom.de/hub.docker.com/thelastpickle/cassandra-reaper:3.8.035053CVE-2026-31789 libcrypto3 3.3.2-r4 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 libssl3 3.3.2-r4 → 3.3.7-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-75595 io.netty:netty-handler 4.1.94.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
kafka (datastore)quay.io/strimzi/kafka-bridge:0.31.12152125CVE-2026-114406 ca-certificates 2024.2.69_v8.0.303-91.4.el9_4 → 2026.2.92_v9.0.319-90.3.el9_8 ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns
CVE-2026-75595 io.netty:netty-handler 4.1.115.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
kafka (datastore)quay.io/strimzi/kafka:0.45.0-kafka-3.9.04253219CVE-2025-68121 stdlib v1.23.0 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
CVE-2026-114406 ca-certificates 2024.2.69_v8.0.303-91.4.el9_4 → 2026.2.92_v9.0.319-90.3.el9_8 ca-certificates: Distrust eMudhra intermediate CA certificates due to security concerns
CVE-2026-75595 io.netty:netty-handler 4.1.100.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
CVE-2026-75595 io.netty:netty-handler 4.1.111.Final → 4.2.17.Final, 4.1.137.Final io.netty/netty-handler: Netty: SNI Routing Bypass via Fragmented TLS ClientHello Causing Fallback to Default SslContext
mariadb (datastore)artifactory.devops.telekom.de/hub.docker.com/mariadb:11.7.246771CVE-2023-24538 stdlib v1.18.2 → 1.19.8, 1.20.3 golang: html/template: backticks not treated as string delimiters
CVE-2023-24540 stdlib v1.18.2 → 1.19.9, 1.20.4 golang: html/template: improper handling of JavaScript whitespace
CVE-2024-24790 stdlib v1.18.2 → 1.21.11, 1.22.4 golang: net/netip: Unexpected behavior from Is methods for IPv4-mapped IPv6 addresses
CVE-2025-68121 stdlib v1.18.2 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
mariadb (datastore)docker-registry3.mariadb.com/mariadb-operator/mariadb-operator:0.38.114849CVE-2025-68121 stdlib v1.24.2 → 1.24.13, 1.25.7, 1.26.0-rc.3 crypto/tls: crypto/tls: Incorrect certificate validation during TLS session resumption
redis (datastore)public.ecr.aws/docker/library/redis:8.2.2-alpine22830CVE-2026-31789 libcrypto3 3.5.4-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing
CVE-2026-31789 libssl3 3.5.4-r0 → 3.5.6-r0 openssl: OpenSSL: Heap buffer overflow on 32-bit systems from large X.509 certificate processing