Product by Oracle

    Construction And Engineering

    19 known vulnerabilities in Construction And Engineering (Oracle), 0 of them actively exploited (CISA KEV).

    Key figures

    19

    Vulnerabilities

    0

    Actively exploited (KEV)

    0

    Used by ransomware

    3

    Critical

    Vulnerabilities

    Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.

    Vulnerabilities in Construction And Engineering (Oracle)
    CriticalCVE-2026-4800

    lodash vulnerable to Code Injection via `_.template` imports key names

    also in 11 other products

    		8.1
    CriticalCVE-2026-33557

    Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication

    also in 6 other products

    		9.1
    HighCVE-2026-24308

    Apache ZooKeeper: Sensitive information disclosure in client configuration handling

    also in 7 other products

    		7.5
    HighCVE-2026-68497

    jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS

    also in 6 other products

    		7.5
    HighCVE-2026-34481

    Apache Log4j JSON Template Layout: Improper Encoding or Escaping of Output

    also in 12 other products

    		7.5
    HighCVE-2026-75140

    jsoup Uncontrolled Resource Consumption in XmlTreeBuilder

    also in 1 other product

    		7.5
    HighCVE-2026-66144

    Apache Neethi: Remote PolicyReference fetch lacks resource bounds

    also in 4 other products

    		7.5
    HighCVE-2026-78254

    Apache Ant: Path traversal in ftp and scp tasks allows arbitrary file write

    also in 2 other products

    		7.4
    MediumCVE-2026-84501

    Apache ZooKeeper: Operational log forgery via newline injection in EnsembleAuthenticationProvider

    also in 3 other products

    		5.3
    HighCVE-2026-42402

    Apache Neethi: Policy Normalization Unbounded Resource Allocation DoS

    also in 3 other products

    		7.5
    HighCVE-2026-101736

    Oracle Primavera Unifier: security vulnerability

    also in 1 other product

    		7.4
    MediumCVE-2026-49844

    Apache Log4j API: Improper serialization of non-finite floating-point values in MapMessage.asJson()

    also in 8 other products

    		5.9
    MediumCVE-2026-101475

    Oracle Primavera Unifier: security vulnerability

    also in 1 other product

    		6.5
    HighCVE-2026-101735

    Oracle Primavera Unifier: Improper Access Control

    also in 1 other product

    		7.1
    CriticalCVE-2026-41855

    Spring Framework Unsafe Deserialization via Jackson JMS Converters

    also in 7 other products

    		8.1
    MediumCVE-2026-91376

    Oracle Primavera P6 Enterprise Project Portfolio Management: Improper Access Control

    also in 1 other product

    		6.5
    MediumCVE-2026-41240

    Cure53 DOMPurify: Cross-site Scripting

    also in 3 other products

    		6.1
    MediumCVE-2026-54515

    jackson-databind: Case-insensitive deserialization bypasses per-property @JsonIgnoreProperties

    also in 8 other products

    		5.3
    MediumCVE-2026-91399

    Oracle Primavera P6 Enterprise Project Portfolio Management: security vulnerability

    also in 1 other product

    		4.3

    All products by Oracle