Vendor
Realobjects
44 known vulnerabilities in products by Realobjects, 1 of them actively exploited (CISA KEV).
Key figures
44
Vulnerabilities
1
Actively exploited (KEV)
0
Used by ransomware
4
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2023-44487 | HTTP/2 Rapid Reset Attack Vulnerability In CISA KEValso in 158 other products | 7.5 | |
| Medium | CVE-2025-48924 | Apache Commons Lang: Uncontrolled Recursion | 5.3 | |
| High | CVE-2025-23184 | Apache CXF: Denial of Service vulnerability with temporary files | 5.9 | |
| High | CVE-2026-54513 | FasterXML Jackson-databind: Incomplete List of Disallowed Inputs | 8.1 | |
| Critical | CVE-2019-12154 | RealObjects PDFreactor: XML External Entity (XXE) | 9.1 | |
| Critical | CVE-2019-12153 | RealObjects PDFreactor: Server-Side Request Forgery (SSRF) | 10.0 | |
| High | CVE-2026-54512 | FasterXML Jackson-databind: Incomplete List of Disallowed Inputs | 8.1 | |
| Critical | CVE-2026-10050 | Digest authentication lossy encoding | 9.1 | |
| Medium | CVE-2023-20863 | Spring Framework: Uncontrolled Resource Consumption | 6.5 | |
| High | CVE-2026-68497 | jackson-databind: Duration XMLGregorianCalendar Unbounded Number Parse DoS | 7.5 | |
| High | CVE-2026-57819 | Apache CXF: No default restriction on the amount of form parameters per message | 7.5 | |
| High | CVE-2026-54225 | Apache CXF: Denial of Service attack via large attachments | 7.5 | |
| High | CVE-2026-54079 | veraPDF Validation XXE via XFA | — | |
| High | CVE-2026-54078 | veraPDF Validation XXE via Rich Text | — | |
| High | CVE-2026-64958 | Apache CXF: Denial of service via message header attachments | 7.5 | |
| High | CVE-2026-65432 | Apache CXF: XXE via WSDL/XSD import parsing | 7.5 | |
| Medium | CVE-2026-19032 | jackson-databind resolves attacker-controlled URI schemes when deserializing java.nio.file.Path | 5.3 | |
| Medium | CVE-2026-54081 | veraPDF Parser DoS via PostScript Type 1 Font Programs | — | |
| Medium | CVE-2026-54080 | veraPDF Parser DoS via PostScript CMap Streams | — | |
| High | CVE-2025-1948 | Eclipse Jetty HTTP clients can increase memory allocation | 7.5 | |
| Medium | CVE-2026-64607 | Apache HttpComponents Client: Missing Release of Resource after Effective Lifetime | 5.3 | |
| High | CVE-2026-10051 | Eclipse Jetty: Exposure of Sensitive Information to an Unauthorized Actor | 7.5 | |
| Medium | CVE-2026-59888 | jackson-databind: @JsonIgnore on a Record property is bypassed with a PropertyNamingStrategy | 6.5 | |
| Medium | CVE-2026-54082 | veraPDF-validation: Improper Restriction of XML External Entity Reference | 6.5 | |
| High | CVE-2024-13009 | Eclipse Jetty GZIP buffer release | 7.2 |
News
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 31sans-atrisk-mail,
Products
| RealObjects PDFreactor | 44 | 1 |