Monthly
SAP NetWeaver AS Java's Adobe Document Services (ADS) component ships outdated open-source cryptographic and data transfer libraries that carry known, unpatched-within-the-product vulnerabilities classified under CWE-1395. Low-privileged authenticated attackers with network access can exploit these library weaknesses to achieve limited impact across confidentiality, integrity, and availability of the affected ADS component. No public exploit code or active exploitation has been identified; this is a supply-chain dependency risk with a CVSS 6.3 Medium score and no indication of weaponization at time of analysis.
We need to produce a JSON with the specified fields. Let's analyze the input data carefully. CVE ID: CVE-2026-58586 Description: Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this. CVSS Score: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CWE: CWE-1395 (Dependency on Vulnerable Third-Party Component) Additional intelligence: EPSS Score: 0.17% (percentile 7%) -> low probability of exploitation. Tags: Information Disclosure, Image CPE: cpe:2.3:a:zapad:image::webp:*:*:*:*:*:*:*:* (up to 0.2) Reported by: CPANSec References: advisory to CVE-2023-4863, oss-security list, etc. No KEV mention, so not actively exploited. No POC mentioned explicitly, but since CVE-2023-4863 is an old libwebp heap buffer overflow, POCs likely exist. However, the input doesn't confirm POC availability directly for this bundled case. I'll assume POC exists for the underlying libwebp vulnerability, but for this specific CVE, public exploit may not be explicitly stated. Use careful phrasing: "publicly available exploit code exists" if we infer from the known exploit for CVE-2023-4863? The instruction: "Use POC=YES but no KEV" if POC exists. But POC isn't mentioned. However, CVE-2023-4863 is widely known, had POCs, so it's reasonable to say that exploit code exists for the underlying libwebp vulnerability, and thus for this bundled case. The description says "bundled copy of libwebp 0.3.0 has multiple known vulnerabilities, including CVE-2023-4863." That is a specific vulnerability (heap buffer overflow in WebP) with known exploits. So it's safe to say publicly available exploit code exists.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker over HTTP, targeting the Centralized Thirdparty Jars component. Oracle rates the flaw 8.8 and describes it as 'easily exploitable,' with successful attacks yielding complete takeover (high confidentiality, integrity, and availability impact). No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV.
Arbitrary code execution in Adobe Dreamweaver Desktop 21.7 and earlier stems from a vulnerable third-party component bundled with the application, allowing an attacker to run code in the context of the user who opens a malicious file. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the changed-scope CVSS of 8.6 reflects the potential for the embedded component flaw to break out of Dreamweaver's security boundary.
HCL iReflection Third party vulnerable and outdated components issue was detected in the web application. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. No vendor patch available.
Remote code execution in Pentaho Data Integration & Analytics affects all versions through vulnerable H2 database JDBC driver. Authenticated data source administrators can execute arbitrary external scripts during database connection creation, achieving complete system compromise with potential container escape (CVSS scope changed). EPSS data not provided; no CISA KEV listing identified at time of analysis. Vendor advisory indicates patches available in versions 10.2.0.7 and 11.0.0.0.
Denial-of-service in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote unauthenticated attacker crash the application by exercising a bundled vulnerable third-party component, taking the storefront offline. The flaw carries CVSS 7.5 with an availability-only impact and no confidentiality or integrity effect; there is no public exploit identified at time of analysis, and EPSS is low at 0.07%. It was reported by Adobe and addressed in security bulletin APSB26-49.
Remote denial-of-service in Adobe Commerce, exploitable without authentication, stems from a dependency on a vulnerable third-party component (CWE-1395) that can be triggered to crash the application. Affected releases span a wide version range including 2.4.9-beta1 through 2.4.4-p17 and earlier. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.07% places this in the 22nd percentile - reflecting limited observed exploitation interest despite the attack being automatable per the SSVC framework.
Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
HCL DFXAnalytics contains unpatched third-party libraries with known vulnerabilities that could allow remote attackers with high effort to gain limited unauthorized access. The application fails to update or isolate vulnerable dependencies, potentially enabling exploitation of publicly disclosed security flaws in embedded components to bypass authentication or extract sensitive information.
SAP NetWeaver AS Java's Adobe Document Services (ADS) component ships outdated open-source cryptographic and data transfer libraries that carry known, unpatched-within-the-product vulnerabilities classified under CWE-1395. Low-privileged authenticated attackers with network access can exploit these library weaknesses to achieve limited impact across confidentiality, integrity, and availability of the affected ADS component. No public exploit code or active exploitation has been identified; this is a supply-chain dependency risk with a CVSS 6.3 Medium score and no indication of weaponization at time of analysis.
We need to produce a JSON with the specified fields. Let's analyze the input data carefully. CVE ID: CVE-2026-58586 Description: Image::WebP versions through 0.2 for Perl bundle a vulnerable version of libwebp. Image::WebP does not link to the system libwebp. Instead, it uses a bundled copy of libwebp 0.3.0 (released 2013-03-20). That version has multiple known vulnerabilities, including CVE-2023-4863. Any caller that decodes an untrusted WebP image reaches the bundled decoder. Because the library is compiled into the module, upgrading the system libwebp does not remediate this. CVSS Score: 9.8 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) CWE: CWE-1395 (Dependency on Vulnerable Third-Party Component) Additional intelligence: EPSS Score: 0.17% (percentile 7%) -> low probability of exploitation. Tags: Information Disclosure, Image CPE: cpe:2.3:a:zapad:image::webp:*:*:*:*:*:*:*:* (up to 0.2) Reported by: CPANSec References: advisory to CVE-2023-4863, oss-security list, etc. No KEV mention, so not actively exploited. No POC mentioned explicitly, but since CVE-2023-4863 is an old libwebp heap buffer overflow, POCs likely exist. However, the input doesn't confirm POC availability directly for this bundled case. I'll assume POC exists for the underlying libwebp vulnerability, but for this specific CVE, public exploit may not be explicitly stated. Use careful phrasing: "publicly available exploit code exists" if we infer from the known exploit for CVE-2023-4863? The instruction: "Use POC=YES but no KEV" if POC exists. But POC isn't mentioned. However, CVE-2023-4863 is widely known, had POCs, so it's reasonable to say that exploit code exists for the underlying libwebp vulnerability, and thus for this bundled case. The description says "bundled copy of libwebp 0.3.0 has multiple known vulnerabilities, including CVE-2023-4863." That is a specific vulnerability (heap buffer overflow in WebP) with known exploits. So it's safe to say publicly available exploit code exists.
Full compromise of Oracle Platform Security for Java (OPSS) in Oracle Fusion Middleware 12.2.1.4.0 and 14.1.2.0.0 is possible by a low-privileged attacker over HTTP, targeting the Centralized Thirdparty Jars component. Oracle rates the flaw 8.8 and describes it as 'easily exploitable,' with successful attacks yielding complete takeover (high confidentiality, integrity, and availability impact). No public exploit is identified at time of analysis and the CVE is not listed in CISA KEV.
Arbitrary code execution in Adobe Dreamweaver Desktop 21.7 and earlier stems from a vulnerable third-party component bundled with the application, allowing an attacker to run code in the context of the user who opens a malicious file. No public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the changed-scope CVSS of 8.6 reflects the potential for the embedded component flaw to break out of Dreamweaver's security boundary.
HCL iReflection Third party vulnerable and outdated components issue was detected in the web application. Rated low severity (CVSS 3.1), this vulnerability is remotely exploitable. No vendor patch available.
Remote code execution in Pentaho Data Integration & Analytics affects all versions through vulnerable H2 database JDBC driver. Authenticated data source administrators can execute arbitrary external scripts during database connection creation, achieving complete system compromise with potential container escape (CVSS scope changed). EPSS data not provided; no CISA KEV listing identified at time of analysis. Vendor advisory indicates patches available in versions 10.2.0.7 and 11.0.0.0.
Denial-of-service in Adobe Commerce (Magento) versions 2.4.9-beta1, 2.4.8-p4, 2.4.7-p9, 2.4.6-p14, 2.4.5-p16, 2.4.4-p17 and earlier lets a remote unauthenticated attacker crash the application by exercising a bundled vulnerable third-party component, taking the storefront offline. The flaw carries CVSS 7.5 with an availability-only impact and no confidentiality or integrity effect; there is no public exploit identified at time of analysis, and EPSS is low at 0.07%. It was reported by Adobe and addressed in security bulletin APSB26-49.
Remote denial-of-service in Adobe Commerce, exploitable without authentication, stems from a dependency on a vulnerable third-party component (CWE-1395) that can be triggered to crash the application. Affected releases span a wide version range including 2.4.9-beta1 through 2.4.4-p17 and earlier. No public exploit or CISA KEV listing exists at time of analysis, and the EPSS score of 0.07% places this in the 22nd percentile - reflecting limited observed exploitation interest despite the attack being automatable per the SSVC framework.
Alien::FreeImage versions through 1.001 for Perl contains several vulnerable libraries. Rated high severity (CVSS 7.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.
HCL DFXAnalytics contains unpatched third-party libraries with known vulnerabilities that could allow remote attackers with high effort to gain limited unauthorized access. The application fails to update or isolate vulnerable dependencies, potentially enabling exploitation of publicly disclosed security flaws in embedded components to bypass authentication or extract sensitive information.