Decision Manager
38 CVEs tracked. 2 of them are in CISA KEV.
This hub aggregates every CVE we track for Decision Manager, a product in the operating systems space. Use it to gauge the current risk picture and drill into individual advisories.
Decision Manager CVEs per month
| Month | CVEs |
|---|---|
| 2024-10 | 0 |
| 2024-11 | 0 |
| 2024-12 | 0 |
| 2025-01 | 0 |
| 2025-02 | 0 |
| 2025-03 | 0 |
| 2025-04 | 0 |
| 2025-05 | 0 |
| 2025-06 | 0 |
| 2025-07 | 0 |
| 2025-08 | 0 |
| 2025-09 | 0 |
| 2025-10 | 0 |
| 2025-11 | 0 |
| 2025-12 | 0 |
| 2026-01 | 0 |
| 2026-02 | 0 |
| 2026-03 | 0 |
| 2026-04 | 0 |
| 2026-05 | 0 |
| 2026-06 | 0 |
| 2026-07 | 0 |
| 2026-08 | 0 |
| 2026-09 | 0 |
Severity
How the 38 CVEs score on CVSS. Severity is not exploitation: KEV is counted above.
- Critical4
- High19
- Medium14
- Low1
Latest CVEs
The 15 most recently published vulnerabilities affecting Decision Manager.
- CVE-2023-6717Keycloak: xss via assertion consumer service url in saml post-binding flow6.0
- CVE-2023-26159Versions of the package follow-redirects before 1.15.4 are vulnerable to Improper Input Validation due to the improper handling of URLs by the url.parse() function. When new URL() throws an error, ...7.3
- CVE-2023-45648Apache Tomcat: Trailer header parsing too lenient5.3
- CVE-2023-44487The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.7.5
- CVE-2022-4245Codehaus-plexus: xml external entity (xxe) injection4.3
- CVE-2022-4244Codehaus-plexus: directory traversal7.5
- CVE-2023-4853Quarkus: http security policy bypass8.1
- CVE-2023-1108Undertow: infinite loop in sslconduit during close7.5
- CVE-2022-1415Drools: unsafe data deserialization in streamutils8.1
- CVE-2023-35116jackson-databind through 2.15.2 allows attackers to cause a denial of service or other unspecified impact via a crafted object that uses cyclic dependencies. NOTE: the vendor's perspective is that ...4.7
- CVE-2021-46877jackson-databind 2.10.x through 2.12.x before 2.12.6 and 2.13.x before 2.13.1 allows attackers to cause a denial of service (2 GB transient heap usage per read) in uncommon situations involving Jso...7.5
- CVE-2022-41966XStream Denial of Service via stack overflow 8.2
- CVE-2019-14841A flaw was found in the RHDM, where an authenticated attacker can change their assigned role in the response header. This flaw allows an attacker to gain admin privileges in the Business Central Co...8.8
- CVE-2019-14840A flaw was found in the RHDM, where sensitive HTML form fields like Password has auto-complete enabled which may lead to leak of credentials.7.5
- CVE-2022-40152Stack Buffer Overflow in Woodstox6.5
Product grouping is registry-driven, with AI assist and human review. How it works