6
CVEs
1
Critical
5
High
0
KEV
0
PoC
0
Unpatched C/H
100.0%
Patch Rate
0.7%
Avg EPSS
Severity Breakdown
CRITICAL
1
HIGH
5
MEDIUM
0
LOW
0
Monthly CVE Trend
Affected Products (30)
Jackson Databind
55
Debian Linux
39
Communications Evolved Communications Application Server
25
Communications Instant Messaging Server
23
Banking Platform
22
Retail Xstore Point Of Service
21
Agile Plm
21
Jd Edwards Enterpriseone Orchestrator
20
Steelstore Cloud Integrated Storage
20
Jd Edwards Enterpriseone Tools
20
Communications Diameter Signaling Router
19
Communications Calendar Server
19
Communications Contacts Server
18
Weblogic Server
18
Retail Merchandising System
18
Primavera Unifier
17
Communications Session Report Manager
17
Communications Element Manager
17
Global Lifecycle Management Opatch
17
Active Iq Unified Manager
16
Autovue For Agile Product Lifecycle Management
16
Communications Session Route Manager
16
Communications Network Charging And Control
15
Retail Sales Audit
14
Banking Digital Experience
13
Enterprise Manager Base Platform
12
Oncommand Workflow Automation
11
Java
11
Financial Services Analytical Applications Infrastructure
11
Service Level Manager
11
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-110879 | Class-name polymorphic deserialization in jackson-databind is insufficiently validated: the outer class in a type ID is checked, but classes named inside generic arguments (and array element types) are accepted even when they would be rejected as direct type IDs, letting an attacker instantiate arbitrary classes. Affected are com.fasterxml.jackson.core:jackson-databind 2.10.0 through 2.18.11, 2.19.0 through 2.21.7 and 2.22.0 through 2.22.3, plus tools.jackson.core:jackson-databind 3.0.0 through 3.1.7 and 3.2.0 through 3.2.3; releases before 2.10.0 are unaffected because PolymorphicTypeValidator did not yet exist, and the earlier CVE-2026-54512 fixes (2.18.8, 2.21.4, 3.1.4) do not remediate this bypass. The default-validator case needs no application-authored validator at all, and the advisory's PoC demonstrates that with Spring on the classpath and attacker-controlled XML, FileSystemXmlApplicationContext is reached through map-key discovery and ProcessBuilder.start() executes arbitrary commands under the application account; the issue carries a public reproducer and warrants the act_now priority label, although exploitation remains gated on the specific polymorphism configuration, available classpath gadgets and a reachable deserialization entry point. | CRITICAL | 9.8 | 1.2% | 50 |
|
| CVE-2026-68498 | Heap exhaustion denial of service in FasterXML jackson-core 2.16.0 and later allows an unauthenticated remote attacker to force allocation of roughly 100 MB or more per oversized JSON property name whenever untrusted JSON is parsed from a character-based source (String, Reader, or char[]), which is the normal path for a request body already read into a String. Because the maxNameLength bound (default 50,000 characters, ~100 KB) is only validated after the entire name has been buffered, the much larger maxStringLength bound (default 100,000,000 characters, roughly 200 MB with segment bookkeeping overhead) governs first, and repeating this across concurrent requests can exhaust the heap and crash the process. The impact is availability-only (CVSS 3.1 7.5, AV:N/AC:L/PR:N/UI:N/C:N/I:N/A:H); no public exploit code or confirmed active exploitation was identified at time of analysis, and a vendor patch is available. | HIGH | 7.5 | 0.9% | 38 |
|
| CVE-2026-68495 | Memory-exhaustion denial of service in the FasterXML jackson-dataformats-binary CBOR parser allows an unauthenticated remote attacker to force unbounded heap allocation by submitting a CBOR document containing a single property name of arbitrary length; the parser buffers the entire name in memory before returning it because maxNameLength is never validated for this binary format. The defect affects jackson-dataformats-binary running against jackson-core 2.16.0 or later (releases before 2.16.0 never contained the constraint that is left unenforced), and is reachable under default configuration because StreamReadConstraints.maxDocumentLength is disabled by default, leaving no built-in bound on the name. Per the assessed vector (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, 7.5) there is no confidentiality or integrity impact, and the practical damage ceiling is set by the attacker's upload capacity versus the victim's available heap; no public exploit code was identified at time of analysis, and exploitation requires only that attacker-controlled bytes actually reach CBORFactory or an ObjectMapper configured with the CBOR module. | HIGH | 7.5 | 0.7% | 38 |
|
| CVE-2026-68496 | Memory-exhaustion denial of service in FasterXML jackson-dataformats-binary affects the Smile binary parser on 2.16.0-and-later releases, where SmileParser buffers an entire JSON object property name in memory through an unconstrained _growArrayTo() call inside _handleLongFieldName() and never calls StreamReadConstraints.validateNameLength(), so the configured maxNameLength is silently ignored for this format. Any remote, unauthenticated attacker whose bytes reach SmileFactory parsing - directly or through an ObjectMapper configured with the Smile module - can embed a single unbounded property name and force heap exhaustion, because maxDocumentLength is also disabled by default (CVSS 3.1: 7.5, AV:N/AC:L/PR:N/UI:N, availability-only impact), leaving upload capacity and available heap as the only practical limits. No public exploit identified at time of analysis, and applications that parse only standard JSON are unaffected since jackson-core's JSON parsers enforce maxNameLength incrementally during name decoding. | HIGH | 7.5 | 0.7% | 38 |
|
| CVE-2026-110747 | Denial of service in jackson-dataformat-protobuf (2.21.6-2.21.7, 2.22.0-2.22.3, 3.1.6-3.1.7 and 3.2.2-3.2.3) lets an 8-byte malformed protobuf message force an oversized buffer allocation that ends in OutOfMemoryError, so any application that streaming-parses untrusted protobuf against a schema containing a string-keyed map (map<string, V>) is exposed. The overflow occurs in ProtobufParser._readStringKey(), where a declared key length of 0x7FFFFFFF wraps the signed bounds check and reaches TextBuffer.expandCurrentSegment(); StreamReadConstraints (maxStringLength, maxNameLength, maxDocumentLength, maxNestingDepth) do not block it, and JVMs started with -XX:+ExitOnOutOfMemoryError terminate outright (observed exit code 3). The CVSS 3.1 vector is AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H (7.5), consistent with pure availability impact and no demonstrated confidentiality or integrity effect; a working proof-of-concept payload is documented in the vendor advisory, but there is no CISA KEV listing and no confirmed active exploitation, and the vuln.today decision label places remediation in this week's queue. | HIGH | 7.5 | 0.4% | 38 |
|
| CVE-2026-104895 | Eager, unbounded memory allocation in the asynchronous Smile parser (NonBlockingByteArrayParser) lets a Smile feed of roughly ten bytes force a byte[] allocation of approximately 2 GB before any body bytes are consumed, producing an OutOfMemoryError that crashes the request or processing thread on reactive/async Smile endpoints; a VInt crafted to overflow int instead yields a negative length and a NegativeArraySizeException that is not a JacksonException and so escapes the parser contract. Only applications that construct the non-blocking parser via SmileFactory.createNonBlockingByteArrayParser and feed it attacker-supplied Smile bytes are exposed - the blocking SmileParser already contains the (value >>> 25) overflow guard - and no authentication, privileges or user interaction are required beyond the ability to submit data for parsing (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, CWE-789). No public exploit code has been identified at time of analysis, although the upstream advisory includes a code-verified reproduction recipe, and fixes are published across all supported branches. | HIGH | 7.5 | 0.4% | 38 |
|