Product by IBM
Operational Decision Manager
62 known vulnerabilities in Operational Decision Manager (IBM), 1 of them actively exploited (CISA KEV).
Key figures
62
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
17
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2023-44487 | HTTP/2 Rapid Reset Attack Vulnerability In CISA KEValso in 158 other products | 7.5 | |
| Critical | CVE-2024-52046 | Apache MINA: MINA applications using unbounded deserialization may allow RCE | 9.8 | |
| Critical | CVE-2024-22320 | IBM Operational Decision Manager code execution | 9.8 | |
| Critical | CVE-2024-22319 | IBM Operational Decision Manager JDNI injection | 8.1 | |
| Critical | CVE-2026-4800 | lodash vulnerable to Code Injection via `_.template` imports key names | 8.1 | |
| High | CVE-2025-13465 | Prototype Pollution Vulnerability in Lodash _.unset and _.omit functions | 5.3 | |
| Critical | CVE-2026-2332 | HTTP Request Smuggling via Chunked Extension Quoted-String Parsing | 9.1 | |
| High | CVE-2021-23337 | Command Injection | 7.2 | |
| Critical | CVE-2018-1821 | IBM Operational Decision Management: XML External Entity (XXE) | 7.1 | |
| Critical | CVE-2026-42779 | Apache MINA: Deserialization of Untrusted Data | 9.8 | |
| Critical | CVE-2026-18658 | IBM Operational Decision Manager for Aug 2026 - Multiple CVEs addressed | 9.8 | |
| High | CVE-2026-33871 | Netty HTTP/2 CONTINUATION Frame Flood DoS via Zero-Byte Frame Bypass | 7.5 | |
| High | CVE-2026-34480 | Apache Log4j Core: Silent log event loss in XmlLayout due to unescaped XML 1.0 forbidden characters | 7.5 | |
| Critical | CVE-2026-42778 | Apache MINA: CWE-502 Deserialization of Untrusted Data (take 2) | 9.8 | |
| Medium | CVE-2023-20863 | Spring Framework: Uncontrolled Resource Consumption | 6.5 | |
| Critical | CVE-2026-41635 | Apache MINA: Deserialization of Untrusted Data | 9.8 | |
| Critical | CVE-2026-22732 | Under Some Conditions Spring Security HTTP Headers Are not Written | 9.1 | |
| High | CVE-2026-34478 | Apache Log4j Core: Log injection in Rfc5424Layout due to silent configuration incompatibility | 7.5 | |
| High | CVE-2026-34481 | Apache Log4j JSON Template Layout: Improper Encoding or Escaping of Output | 7.5 | |
| Critical | CVE-2026-47065 | Apache MINA: Critical Deserialization Allow-list Bypass via resolveProxyClass - ZDRES-232 | 9.8 | |
| Medium | CVE-2025-68161 | Apache Log4j Core: Missing TLS hostname verification in Socket appender | 4.8 | |
| High | CVE-2026-5795 | Eclipse Jetty: Sensitive Information in Resource Not Removed Before Reuse | 7.4 | |
| High | CVE-2026-35554 | Apache Kafka Clients: Use After Free | 8.7 | |
| Medium | CVE-2026-45292 | opentelemetry-java: Unbounded Memory Allocation in W3C Baggage Propagation | 5.3 | |
| Critical | CVE-2026-40976 | Spring Boot: Missing Authorization | 9.1 |
News
- NCSC-2026-0377 [1.00] [M/H] Kwetsbaarheden verholpen in Oracle Enterprise Managerncsc-nl,
- Oracle’s July update fixes ten 10.0 vulnerabilities in Fusion Middlewarecsoonline,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 23sans-atrisk-mail,
- June Patch Tuesday marks a ‘new normal’ with over 200 CVEs, 32 rated ‘critical’csoonline,
- Oracle’s first monthly patch release fixes 35 flaws, including 11 rated ‘critical’csoonline,
- Fwd: @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 20sans-atrisk,