CVEs published August 18, 2026

Sandbox escape in the Remote Settings Client component.

A vulnerability was detected in TRENDnet TEW-WLC100 1v2.07b01.

Unauthenticated Remote Code Execution (RCE) in WP Compress < 7.20.01 versions.

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server).

A flaw has been found in TRENDnet TV-IP751WIC 11.03.03.

ArcadeDB server (com.arcadedb:arcadedb-server) in versions 26.7.3 and earlier fails to propagate the authenticated principal to asynchronous command worker threads.

ArcadeDB before 26.8.1 fails to bind the authenticated principal on the gRPC transaction executor thread in beginTransaction, allowing authenticated readers to execute JavaScript commands without scripting…

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Unrestricted Upload of File with Dangerous Type vulnerability in EDGE22 Studios Ltd.

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).

Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server).

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).

Vulnerability in the Oracle Managed File Transfer product of Oracle Fusion Middleware (component: MFT Runtime Server).

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer).

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

Lemur manages TLS certificate creation.

Contributor Arbitrary File Upload in Templatiq <= 0.2.5 versions.

Contributor Arbitrary File Upload in Sync Post With Other Site <= 1.9.3 versions.

Contributor Remote Code Execution (RCE) in Cwicly <= 1.4.4 versions.

ArcadeDB versions before 26.8.1 contain a missing authentication vulnerability in the Redis wire-protocol plugin that allows unauthenticated attackers to read, write, and delete data.

ArcadeDB versions before 26.8.1 fail to enforce SASL authentication on data commands in the MongoDB wire-protocol plugin.

Bastillion fails to properly validate request URI paths in its controller dispatcher, allowing unauthenticated attackers to bypass authentication filters by prefixing requests with arbitrary path segments.

Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153.

Internally found bugs present in Thunderbird 153.

Internally found bugs present in Thunderbird ESR 153.0 and Thunderbird 153.

Internally found bugs present in Thunderbird ESR 140.13, Thunderbird ESR 153.0 and Thunderbird 153.

Privilege escalation in the Enterprise Policies component.

Mitigation bypass in the Add-ons Manager component.

Integer overflow in the Graphics component.

Use-after-free in the DOM: Core & HTML component.

Use-after-free in the Graphics: ImageLib component.

Use-after-free in the Graphics: Text component.

Use-after-free in the JavaScript: WebAssembly component.

Unauthenticated Arbitrary File Upload in Masteriyo - LMS <= 2.3.2 versions.

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Unauthenticated Deserialization of untrusted data in Youzify <= 1.3.7 versions.

Unauthenticated PHP Object Injection in Popup by Supsystic <= 1.13.0 versions.

Unauthenticated PHP Object Injection in Ultimate Maps by Supsystic < 1.5.0 versions.

Joomla!

Unauthenticated PHP Object Injection in Easy Google Maps <= 1.13.0 versions.

Unauthenticated PHP Object Injection in RegistrationMagic <= 6.0.9.7 versions.

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller).

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework).

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework).

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Agent infrastructure).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server).

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server).

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server).

Vulnerability in Oracle Essbase (component: Infrastructure).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Dell PowerStore SDNAS, contains an Out-of-bounds Write vulnerability in SMB/CIFS.

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).

Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component: Data Archival).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Events).

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Web Runtime SEC).

Vulnerability in the Oracle Internet Directory product of Oracle Fusion Middleware (component: OID LDAP Server).

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: WLS Core Components).

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).

Vulnerability in the Oracle WebCenter Enterprise Capture product of Oracle Fusion Middleware (component: Client Bundle).

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Business Interlink).

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

Seroval facilitates JS value stringification, including complex structures beyond JSON.stringify capabilities.

An incorrect access control vulnerability in reportico-web <= 8.1.0 allows an unauthenticated attacker to inject arbitrary php code into the PreExecuteCode attribute of any report regardless of the…

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause path traversal.

MyBB is free and open source forum software.

SSRF via set_skywalking_url Tool and GraphQL expression injection vulnerability in Apache SkyWalking MCP.

Unauthenticated PHP Object Injection in FundEngine <= 1.7.9 versions.

The Forminator Forms plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.56.1 via the handle_file_upload function.

Buffer overflow in Dawn in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity:…

Inappropriate implementation in Media in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security…

A security vulnerability has been detected in TRENDnet TEW-WLC100P 12.07b01.

Vulnerability in the Portable Clusterware component of Oracle Database Server.

Vulnerability in the Portable Clusterware component of Oracle Database Server.

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Lifecycle Management).

Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security).

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler).

Unauthenticated Arbitrary File Upload in Piotnet Addons For Elementor Pro <= 7.1.67 versions.

A flaw was found in the AAP Controller's HashiCorp Vault credential plugin.

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

An inbound SAML Source configured with the non-default USERNAME_LINK or EMAIL_LINK user-matching mode interprets an XML comment in a NameID differently from the identity provider's signed assertion.

CodeWhale (codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain an argument injection vulnerability in the git_show tool.

SpiderFoot fails to HTML-escape correlation titles built from external scan data sources including server banners and metadata.

Unauthenticated SQL Injection in Readabler < 2.0.18 versions.

Unauthenticated SQL Injection in JetAppointment <= 2.5.2 versions.

Unauthenticated SQL Injection in Affiliates Manager <= 2.9.53 versions.

Unauthenticated SQL Injection in Modern Events Calendar < 7.35.0 versions.

Unauthenticated SQL Injection in Sticky Chat Widget <= 1.4.2 versions.

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller).

Vulnerability in the Siebel Apps - Self Service product of Oracle Siebel CRM (component: Helpdesk/Training).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Cross-Site Request Forgery (CSRF) vulnerability exists in Halo CMS versions up to 2.25.4 via the CorsConfigurer.java and the CsrfConfigurer.java components.

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Zebra can accept a block that zcashd rejects because the P2SH signature-operation counter undercounts redeem scripts containing a disabled opcode followed by signature opcodes.

The websock_decode() function in src/websock/websock.c contains an integer overflow when validating a masked WebSocket frame that uses the 64-bit extended length encoding.

MyBB is free and open source forum software.

This Critical severity Stored XSS, PrivEsc (Privilege Escalation), and Security Misconfiguration vulnerability was introduced in versions 7.1.1, 7.4.0, 7.13.0, 7.17.0, 7.19.0, 8.0.0, 8.5.0, 8.9.0, 9.0.1,…

Missing authentication in initial setup functionality left exposed after initial setup is completed in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain…

The allowDashboard authorization gate in server/integrations/node-red/index.js calls authJwt.verify for /nodered without inspecting the decoded identity.

Grav before 2.0.14 fails to guard the access field in the core group blueprint with the required security@: admin.super restriction.

A flaw has been found in COMFAST CF-N1-S 2.6.0.1.

Site isolation issue in the CSS Parsing and Computation component.

Side-channel in the Web Audio component.

Mitigation bypass in the Storage: Cache API component.

Same-origin policy bypass in the DOM: Service Workers component.

Mitigation bypass in the JavaScript: GC component.

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Unauthenticated Broken Authentication in Popup by Supsystic <= 1.13.0 versions.

Missing authentication in initial setup functionality left exposed until first reboot in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to gain administrative…

Vulnerability in the Portable Clusterware component of Oracle Database Server.

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in Oracle Application Testing Suite.

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server).

Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Deployment).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).

Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security).

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Portlet Services).

Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS).

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record.

An arbitrary file write/directory traversal vulnerability in reportico-web <= 8.1.0 allows remote attackers to create or overwrite files anywhere on the filesystem subject to the permissions of the web user…

In Zabbix 7.4 the cryptographic key used for signing Frontend sessions has been erroneously written to the database seed.

The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link.

Kraken agents fail to verify peer-to-peer downloaded blobs against their requested SHA-256 digest before committing to the content-addressable cache, relying only on CRC32 checksums for piece validation.

Context7 through 2.1.2 contains a prompt injection vulnerability that allows attackers to execute malicious instructions in connected AI coding agents by injecting unsanitized content through the Custom AI…

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System).

Froxlor is open source server administration software.

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).

2.29.8, and 2.30.1, the Git node clone operation allows an authenticated workflow user to swap a validated directory for a symlink before cloning, planting a crafted repository in the community node…

Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Incorrect calculation in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Use after free in Browser in Google Chrome on on Mac prior to 151.0.7922.169 allowed a remote attacker leveraging social engineering to execute arbitrary code outside the sandbox via a crafted HTML page.…

Type confusion in V8 in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code inside the sandbox via a crafted HTML page. (Chromium security severity: High)

Buffer overflow in WebGL in Google Chrome prior to 151.0.7922.169 allowed a remote attacker to execute arbitrary code outside the sandbox via a crafted HTML page. (Chromium security severity: Critical)

ArcadeDB's Gremlin wire-protocol plugin (com.arcadedb:arcadedb-gremlin) in versions <= 26.7.3 enforces authentication (SASL PLAIN) but performs no authorization: it never checks database access permissions…

The Grav API plugin (getgrav/grav-plugin-api, bundled with Grav's admin-next/API stack) before 1.0.14 fails to enforce the authorize requirement in MenubarController::executeAction().

Grav before 2.0.15 contains an arbitrary file write vulnerability in the Blueprint dynamic-data bare-function validation that uses an incomplete denylist instead of a positive allowlist.

Use-after-free in the Layout: Text and Fonts component.

Privilege escalation in the Shell Integration component.

Privilege escalation in the Request Handling component.

Privilege escalation in the Networking: Cookies component.

Privilege escalation in the Application Update component.

Privilege escalation in the Downloads API component.

Privilege escalation due to use-after-free in the Graphics: Canvas2D component.

Privilege escalation due to invalid pointer in the Graphics component.

Privilege escalation due to incorrect boundary conditions in the Graphics: CanvasWebGL component.

Privilege escalation in the Remote Settings Client component.

Privilege escalation in the Graphics: CanvasWebGL component.

Privilege escalation in the DOM: Navigation component.

Use-after-free in the JavaScript: GC component.

Privilege escalation in the DOM: Networking component.

Deserialization of Untrusted Data vulnerability in TaxoPress allows Object Injection.

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Hospitality OPERA 5 Property Services product of Oracle Hospitality Applications (component: Opera Servlet).

Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client).

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: Web Service API).

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security).

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Web Services Security).

Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues).

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security).

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security).

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Export).

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Application Server).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Document Management).

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Financial Services Enterprise Case Management product of Oracle Financial Services Applications (component: Web UI).

Vulnerability in the Oracle Product Hub product of Oracle E-Business Suite (component: Outbound Data).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in Oracle Application Testing Suite.

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Yard Management product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server).

Vulnerability in the Oracle Risk Management product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Customers Online product of Oracle E-Business Suite (component: Customer Tab).

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server).

Vulnerability in the Oracle Enterprise Manager for Systems Infrastructure product of Oracle Enterprise Manager (component: Storage Server Management).

Vulnerability in the Oracle Teleservice product of Oracle E-Business Suite (component: Service Request Form).

Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).

Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite (component: Security API).

Vulnerability in the Oracle Sales for Handhelds product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in Oracle Essbase (component: Calculator).

Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

An issue in Halo 2.25.4 allows a remote attacker to execute arbitrary code via the run.halo.app.migration.impl.MigrationServiceImpl.restoreWorkdir(), and…

A flaw was found in the governance-policy-addon-controller component of Red Hat Advanced Cluster Management for Kubernetes.

Cross-Site Request Forgery (CSRF) vulnerability in DevItems HashBar – WordPress Notification Bar allows Cross Site Request Forgery.

8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's RESTORE command accepts a malformed RDB stream payload that assigns one Pending Entry List NACK to multiple consumers during stream consumer-group deserialization,…

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Events).

Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations).

CMS.INITBYDIM and CMS.INITBYPROB accept dimensions whose width times depth times sizeof(int64_t) overflows in src/core/cms.cc, allocating an undersized counter buffer while CMS.INCRBY and CMS.QUERY use the…

The Remote Access Control endpoint list returns every configured endpoint to any authenticated user regardless of which applications the user may access, and the response includes connection settings that…

Dell Watchdog Timer Driver versions prior to 2.0.0.1 contain an Exposed IOCTL with Insufficient Access Control vulnerability.

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).

Vulnerability in the Oracle U.S.

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Application Config Console).

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Installation Security).

Vulnerability in the Oracle Virtual Directory product of Oracle Fusion Middleware (component: Virtual Directory Server).

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).

Vulnerability in the Oracle SOA Suite product of Oracle Fusion Middleware (component: B2B Engine).

Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: nVision).

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Configuration Manager).

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer).

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer).

Vulnerability in the Oracle Access Manager product of Oracle Fusion Middleware (component: Authentication Engine).

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: OIM Legacy UI).

The open-path-at-time IPC handler in src/ipc/player.js accepts a renderer-controlled filePath without validating its type or location.

The downloadSubtitleFile utility in src/ipc/downloads.js, reached through the run-download IPC channel, accepts a renderer-supplied subtitle url using the file: URI scheme and passes its decoded pathname to…

4gaBoards is vulnerable to pre-account takeover when registrationEnabled, localRegistrationEnabled, and ssoRegistrationEnabled are enabled and Google, GitHub, Microsoft, or OIDC SSO is configured.

The dotenv plugin in plugins/dotenv/dotenv.plugin.zsh passes ZSH_DOTENV_FILE to source after a directory change into a folder containing a .env file, allowing syntactically valid shell commands in the file…

4gaBoards allows an authenticated project manager to supply traversal sequences in the filename parameter of GET /exports/:id/:filename.

Vvveb backend product operations allow a low-privileged Vendor to access products owned by another Vendor.

Vvveb backend digital asset operations allow a low-privileged Vendor to access digital assets linked to another Vendor's products.

Lemur manages TLS certificate creation.

Customer PHP Object Injection in Essential Real Estate <= 5.3.3 versions.

Incorrect Privilege Assignment vulnerability in ThemeOne The Grid allows Privilege Escalation.

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.

This High severity BASM (Broken Authentication & Session Management) vulnerability known as CVE-2026-21582 was introduced in version 7.2.1 of Crowd Data Center.

CSV export functionality in Brainstorm Force SureForms version, <= 2.12.1, fails to neutralize spreadsheet formula characters in user-controlled form field names before generating CSV exports, which allows…

Tapo C120 v1 and C200 v5 contain an improper authentication vulnerability within the login authentication verification module.

A flaw was found in managed-serviceaccount.

ArcadeDB versions before 26.8.1 fail to sanitize database names in the POST /api/v1/server endpoint's create database and drop database commands, allowing authenticated root users to write and delete…

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the detectXss() function where unpaired quotes in unquoted attribute values bypass event-handler detection.

Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component: Internal Operations).

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes.

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes.

Vulnerability in the Oracle Customer Care product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).

A crafted uncompressed HEIF image using generic zlib unci full-item compression can crash an application that decodes an advertised tile with heif_image_handle_decode_image_tile().

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Connectors and Connector Server).

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).

Vulnerability in the Service Delivery Platform product of Oracle Fusion Middleware (component: Messaging Enabler).

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Security).

Kestra's custom Markdown parser in ui/src/utils/markdown_plugins/link.ts allows a user with permission to create or update a Flow description to inject JavaScript event-handler attributes through the custom…

Froxlor is open source server administration software.

Blueprint Studio exposed administrator-intended backend API actions to any authenticated Home Assistant user because the backend did not consistently enforce the panel's admin-only authorization boundary.

A remote unauthenticated P2P peer can stall a Zebra node by racing an invalid block body against the valid canonical body for the same block header hash.

Versions prior to 2.10.23 have a path traversal vulnerability.

MyBB is free and open source forum software.

MyBB is free and open source forum software.

Hugo 0.161.0 placed the Node asset pipelines behind the Node.js permission model so that code running through PostCSS, Babel, or TailwindCSS could not reach the file system outside the project directory.

CodeWhale before 0.8.64 contains a server-side request forgery bypass vulnerability in DNS pinning logic that fails to prevent time-of-check-time-of-use attacks.

SiYuan before v3.7.4 contains a cross-site scripting vulnerability in the file upload validation flow that fails to escape filenames before inserting them into HTML via insertAdjacentHTML.

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller).

Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Deployment).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Trading Community product of Oracle E-Business Suite (component: Third Party Data Integration).

Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component: Data Archival).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Event Management).

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

The enterprise Google Chrome device-trust stages advance the flow without confirming that the out-of-band device attestation actually ran.

Blueprint Studio generated a shell-based Git credential helper in custom_components/blueprint_studio/backend/git_manager.py by interpolating the configured Git username and token directly into executable…

The display_map parser function in the Leaflet service accepts attacker-controlled HTML in the overlays parameter, and resources/leaflet/jquery.leaflet.js uses the overlay name as a Leaflet layer-control…

RAGFlow before 0.26.3 contains a server-side request forgery vulnerability in the agent workflow "Invoke" component (agent/component/invoke.py).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the RDBMS component of Oracle Database Server.

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security).

Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST).

Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).

Vulnerability in the Oracle Bills of Material product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Migration).

Vulnerability in the Siebel Artificial Intelligence product of Oracle Siebel CRM (component: AI).

Subscriber SQL Injection in Gravity Forms Bookings premium <= 2.1 versions.

Link following in CredentialProvider in Google Chrome on on Windows prior to 151.0.7922.169 allowed a local attacker to potentially execute arbitrary code outside the sandbox via a local program. (Chromium…

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).

The perform-scheduled-backup IPC handler in src/ipc/storage.js takes settings.path from a renderer-supplied object and uses the resulting directory for fs.mkdirSync, fs.writeFileSync, fs.readdirSync, and…

Buffer overflow in ANGLE in Google Chrome on on Android prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to execute arbitrary code outside the sandbox via a crafted…

Race condition in USB in Google Chrome prior to 151.0.7922.169 allowed a remote attacker who had compromised the renderer process to potentially execute arbitrary code outside the sandbox via a crafted HTML…

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Joomla!

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security).

Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).

Vulnerability in the Oracle BI Publisher product of Oracle Analytics (component: BI Platform Security).

The open-external IPC handler in src/ipc/downloads.js passes a renderer-supplied url directly to Electron's shell.openExternal without validating its protocol.

Vvveb backend post operations allow a low-privileged Author to access posts owned by another Author.

Vvveb backend product revision operations allow a low-privileged Vendor to access revisions for products owned by another Vendor.

Vvveb backend post revision operations allow a low-privileged Author to access revisions for posts owned by another Author.

The #iconClass label value is returned raw by getNoteIcon() and inserted without HTML attribute encoding into class attributes in apps/client/src/widgets/quick_search.ts and…

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Unauthenticated Arbitrary Content Deletion in Breeze <= 2.5.12 versions.

Unauthenticated Broken Authentication in SupportCandy <= 3.5.1 versions.

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Web Client - Unicode).

Vulnerability in the Oracle Demand Planning product of Oracle Supply Chain (component: Internal Operations).

Vulnerability in the Oracle HCM Common Architecture product of Oracle E-Business Suite (component: Knowledge Integration).

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server).

Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).

Vulnerability in the Oracle Partner Management product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Events).

Vulnerability in the Oracle Email Center product of Oracle E-Business Suite (component: Message Component).

Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Pod Admin).

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST).

Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: NDB Operator).

The DEVICE_WEBAPI_REQUEST and DEVICE_PROPERTY Socket.IO handlers in server/runtime/index.js omit isSocketWriteAuthorized and accept attacker-controlled property.address or endpoint connection data.

grav-plugin-api versions before 1.0.15 fail to validate Twig content in the translate() endpoint, allowing attackers with api.pages.write permission to persist pages with process.twig enabled.

Mitigation bypass in the Data Loss Prevention component.

Site isolation issue in the Audio/Video: Web Codecs component.

Clickjacking issue in the Widget component.

Site isolation issue in the Networking: Cookies component.

Site isolation issue in the WebExtensions component.

Mitigation bypass in the Safe Browsing component.

Unauthenticated Local File Inclusion in Restaurant Menu by MotoPress <= 2.4.11 versions.

Lemur manages TLS certificate creation.

Vulnerability in the PeopleSoft Enterprise FIN Common Objects product of Oracle PeopleSoft (component: Security).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client).

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Web Services Security).

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: PGC / Excel Plugin).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Web Services Manager product of Oracle Fusion Middleware (component: Web Services Security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in Oracle Application Testing Suite.

Vulnerability in the Oracle iRecruitment product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Process Manufacturing Systems product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Internet Procurement Connector product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Project Planning and Control product of Oracle E-Business Suite (component: Change Management).

Vulnerability in the Oracle Applications Platform Engineering product of Oracle E-Business Suite (component: Valid Session).

Vulnerability in the Oracle Labor Distribution product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Risk Management product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server).

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server).

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server).

Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Deployment).

Vulnerability in the Oracle Sales Foundation product of Oracle E-Business Suite (component: Security API).

Vulnerability in the Oracle Trading Community product of Oracle E-Business Suite (component: Party Search UI).

Vulnerability in the Oracle Payables product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Dell PowerStore SDNAS contains a Buffer Copy without Checking Size of Input vulnerability in NFS/RPC.

Dell PowerStore contains a Missing Authorization vulnerability.

Vulnerability in the Oracle Sales product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Lifecycle Management).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Events).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Events).

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Security).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Events).

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).

Vulnerability in the PeopleSoft Enterprise CC Common Application Objects product of Oracle PeopleSoft (component: Common Application Objects).

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).

Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).

Vulnerability in the JD Edwards EnterpriseOne Tools product of Oracle JD Edwards (component: Business Logic Infra SEC).

Vulnerability in the JD Edwards EnterpriseOne Orchestrator product of Oracle JD Edwards (component: E1 IOT Orchestrator Security).

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Integration Broker).

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Application Interface).

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Search).

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PIA Core Technology).

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

Froxlor is open source server administration software.

The Apify MCP server enables AI agents to extract data from websites using ready-made scrapers, crawlers, and automation tools available on the Apify Store.

When `goshs` is launched with WebDAV enabled (`-w`), the mode-restriction flags `--read-only`, `--upload-only`, and `--no-delete` are enforced only on the primary HTTP port.

3.22.63, and 3.23.22, the account activation flow treats email verification as sufficient proof of account ownership and automatically associates anonymous commerce data with the newly activated account.

Unauthenticated Local File Inclusion in Theme Test Drive <= 2.9.1 versions.

Unauthenticated Local File Inclusion in Vavo Core <= 2.3.0 versions.

This High severity Improper Authorization vulnerability was introduced in versions 10.0.0, 10.1.0, 10.2.0, 11.0.0, 12.0.0, and 12.1.0 of Bamboo Data Center.

Velociraptor's web GUI allows specifying a custom type for columns in tables.

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security).

Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite (component: Regression Testing).

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll - General).

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Microsoft Active Directory).

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).

sh provides Python process launching.

CodeWhale versions before 0.8.64 fail to properly validate the allow_shell configuration parameter from project config files, allowing attackers to enable arbitrary shell command execution by committing a…

CodeWhale (packages codewhale / codewhale-tui) versions >= 0.8.41 and < 0.8.64 contain a remote code execution vulnerability in the rlm_eval tool.

StructMembers() in runtime/autoload/ccomplete.vim constructs and executes a vimgrep command using an insufficiently escaped typeref: or typename: value from a tags file, allowing an unterminated collection…

The EXEC IPC handler in electron/ipc-handlers/exec.ts accepts a command string from the renderer through the IPC.EXEC channel and executes it with child_process.exec().

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

Vulnerability in the Oracle Identity Manager product of Oracle Fusion Middleware (component: Installer).

Vulnerability in the Oracle HRMS (US) product of Oracle E-Business Suite (component: US Payroll Tax Issues).

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in Oracle Application Testing Suite.

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server).

Berkeley Out-of-Order Machine (BOOM) commit 5223e44cfeb26f41380057a2eb4d651197475f69 contains a potential incorrect privilege assignment issue in the v3 and v4 NBDTLB implementations.

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).

Vulnerability in the Oracle Enterprise Manager Base Platform product of Oracle Enterprise Manager (component: Agent Next Gen).

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).

Vulnerability in the Oracle Enterprise Manager for Systems Infrastructure product of Oracle Enterprise Manager (component: Agent).

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Installation).

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In Core).

Vulnerability in the Oracle Outside In Technology product of Oracle Fusion Middleware (component: Outside In PDF Export SDK).

When Zabbix Agent was installed on Windows into a custom installation directory, the installer did not verify whether the selected directory had secure access permissions.

linuxfabrik-lib provides Python modules for database access, caching, shell execution, and API integrations, and Linuxfabrik Monitoring Plugins uses those modules to run external monitoring commands.

NVIDIA Cumulus Linux contains a vulnerability in the user management component, where an unprivileged user could use improper privilege management on the system.

ArcadeDB versions before 26.8.1 contain an arbitrary file read vulnerability in the OpenCypher LOAD CSV FROM clause that allows authenticated users to read local files.

A server-side request forgery (SSRF) vulnerability was found in AWX's webhook status callback mechanism.

Lemur manages TLS certificate creation.

Lemur manages TLS certificate creation.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Search).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System).

Vulnerability in the Oracle Payroll product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Siebel CRM End User product of Oracle Siebel CRM (component: Open UI).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle MES for Process Manufacturing product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Public Sector Human Resources product of Oracle E-Business Suite (component: Regression Testing).

Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Deployment).

Vulnerability in Oracle Autonomous Health Framework (component: Cluster Health Analyzer).

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).

Vulnerability in the Oracle Marketing Encyclopedia System product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Marketing product of Oracle E-Business Suite (component: Audience).

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: Open Integration).

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Events).

Vulnerability in the Oracle Financials Common Modules product of Oracle E-Business Suite (component: Common Components).

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Composer).

BetterDesk versions through 2.3.0 improperly invalidate deleted device identities, allowing an unauthenticated client to replay or spoof a device ID and bypass registration controls.

Grav before 2.0.15 contains a stored cross-site scripting vulnerability in the audio and video media rendering through the sourceParsedownElement method.

Interpretation of untrusted input in template engine in GBIF Integrated Publishing Toolkit versions before 3.3.4 allows remote authenticated attackers to access server-side files and state via template…

Vulnerability in the Oracle Product Lifecycle Analytics product of Oracle Supply Chain (component: Installation Issues).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Workbench).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in Oracle Application Testing Suite.

Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Transportation Execution product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Service Fulfillment Manager product of Oracle E-Business Suite (component: Fulfillment Engine).

Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Advanced Inbound Telephony product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).

The team, teamMembers.user, RESTHistory, GQLHistory, currentRESTSession, currentGQLSession, environments, globalEnvironments, and settings GraphQL paths expose another workspace member's private User data,…

Vulnerability in the Oracle Enterprise Asset Management product of Oracle E-Business Suite (component: Linear Asset Management).

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).

Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations).

4gaBoards allows an authenticated user to modify ssoGoogleId, ssoGoogleEmail, ssoGithubId, ssoGithubUsername, ssoGithubEmail, ssoMicrosoftId, ssoMicrosoftEmail, ssoOidcId, and ssoOidcEmail through PATCH…

Vvveb backend comment operations allow a low-privileged Author to manage comments under another Author's posts.

Vvveb backend product review operations allow a low-privileged Vendor to manage reviews under another Vendor's products.

Vvveb backend product question operations allow a low-privileged Vendor to manage questions under another Vendor's products.

@neo4j/graphql from 5.2.0 until the patched versions fails to enforce field-level @authentication rules on root custom-resolver fields when a type-level @authentication rule is also present on the same…

Improper handling of highly compressed data in the GZIP auto-decompression handler in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted compressed Ion…

Uncontrolled memory allocation in the binary Ion stream cursor in Amazon ion-java before 1.12.0 might allow remote actors to cause a denial of service via a crafted Ion binary document containing a…

CodeWhale versions before 0.8.64 contain an environment variable exposure vulnerability in the js_execution tool that fails to scrub parent process environment variables before spawning Node.js.

CodeWhale versions before 0.8.64 contain a path traversal vulnerability in the image_analyze tool that fails to canonicalize symlinks before reading files.

Improper input validation in the capabilities route handler in OpenSearch Dashboards - the size of the request payload is not bounded - might allow remote attackers to cause a denial of service via a…

CodeWhale versions before 0.8.64 fail to validate file paths in the project config instructions field, allowing attackers to read arbitrary files on the victim's system.

ArcadeDB before 26.8.1 contains an arbitrary file read vulnerability in the GraalVM JavaScript sandbox allowlist enforcement, which uses unescaped regular expressions to validate package names.

Denial-of-service in the Widget component.

Integer overflow in the Graphics component.

Information disclosure in the Form Autofill component.

Information disclosure in the WebRTC component.

Information disclosure due to side-channel in the Storage: Cache API component.

Site isolation issue in the Graphics: CanvasWebGL component.

SiYuan before v3.7.4 contains an incorrect authorization vulnerability in eight publish-mode reader-facing endpoints that filter results using the visibility list instead of the disabled list.

SiYuan before v3.7.4 is missing authorization checks in 17 block metadata/content endpoints in kernel/api/block.go (including getRefText, checkBlockExist, and getBlockBreadcrumb).

Unauthenticated Denial of Service Attack in Starter Templates by Kadence WP <= 2.3.3 versions.

Unauthenticated Broken Access Control in Charitable <= 1.8.11.3 versions.

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Unauthenticated Broken Access Control in Ultimate Maps by Supsystic < 1.5.0 versions.

Joomla!

Unauthenticated Arbitrary File Download in Extra Product Options & Add-Ons for WooCommerce < 7.6 versions.

Buffer Overflow vulnerability in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the NAS 5GS decoder chain, triggered when the message type byte of a NAS PDU is mutated

An issue in Open5GS v.2.7.0 allows a remote attacker to cause a denial of service via the ngap_send_to_nas() function in src/amf/ngap-path.c

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Security Component).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Server).

Vulnerability in the PeopleSoft Enterprise FIN Lease Administration product of Oracle PeopleSoft (component: Lease Administration).

Vulnerability in the Oracle Agile PLM MCAD Connector product of Oracle Supply Chain (component: CAX Client).

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: BI Platform Security).

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Security).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Forge).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Oracle Commerce Platform product of Oracle Commerce (component: Dynamo Application Framework).

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Other issue).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools).

Vulnerability in the Oracle Workflow product of Oracle E-Business Suite (component: Workflow Notification Mailer).

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in Oracle Java SE (component: 2D).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in Oracle Application Testing Suite.

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Migration).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Process Manufacturing Systems product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle SDP Number Portability product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Operations Intelligence product of Oracle E-Business Suite (component: Daily Business Intelligence).

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server).

Vulnerability in the MySQL Cluster product of Oracle MySQL (component: Cluster: General).

Vulnerability in the Oracle iSetup product of Oracle E-Business Suite (component: General Ledger Update Transform, Reports).

Vulnerability in the Oracle Sales product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Payables product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).

Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: JRI and other Java utils).

Unauthenticated SQL Injection in Depicter Slider <= 4.8.0 versions.

Expat through 2.8.3 contains a denial of service vulnerability caused by quadratic algorithmic complexity in the storeAtts() function in xmlparse.c, where processing N specified attributes with…

POST /api/refresh in server/api/auth/index.js falls back from current user data to decoded.groups, including when the user is deleted or groups is zero, and POST /api/heartbeat in server/api/index.js…

The RabbitMQ Java client library allows Java and JVM-based applications to connect to and interact with RabbitMQ nodes.

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Events).

Vulnerability in the Oracle WebCenter Sites product of Oracle Fusion Middleware (component: WebCenter Sites).

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Security).

Vulnerability in the JD Edwards EnterpriseOne US Payroll product of Oracle JD Edwards (component: Payroll).

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).

Vulnerability in the Oracle Unified Directory product of Oracle Fusion Middleware (component: OUD Core).

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Email Marketing).

Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).

Vulnerability in the Oracle WebLogic Server product of Oracle Fusion Middleware (component: Core).

Vulnerability in the Oracle Hospitality Simphony product of Oracle Food and Beverage Applications (component: POS).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Lifecycle Management).

Vulnerability in the Oracle Hyperion Financial Reporting product of Oracle Hyperion (component: Server).

8.0.10, 8.1.9, 9.0.5, and 9.1.1, Valkey's tlsProcessPendingData function iterates pending_list while an authenticated client can trigger CLIENT KILL, causing connTLSClose to delete the iterator's cached…

An unauthenticated IPv4 peer can deterministically terminate a synced Zebra node using the default Linux dual-stack listener configuration.

An issue in SJRC F11 SJ-GPS-PRO firmware build 2019-09-17 allows a remote attacker to obtain sensitive information via the tcp_actions() function

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record.

A crafted HEIF sequence accepted by heif_context_read_from_memory() with the msf1 sequence brand can cause unbounded heap allocation.

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause improper input validation.

NVIDIA Triton Inference Server for Linux contains a vulnerability where an attacker could cause an allocation of resources without limits.

Unauthenticated Broken Access Control in ThumbPress < 6.5 versions.

Unauthenticated Broken Authentication in Ezoic <= 2.22.11 versions.

Unauthenticated Broken Access Control in Online Contact Widget <= 1.3.0 versions.

Unauthenticated Sensitive Data Exposure in Duitku Payment Gateway <= 2.11.14 versions.

Unauthenticated Broken Access Control in FormyChat <= 2.15.7 versions.

Unauthenticated Broken Access Control in WP Sort Order <= 1.3.5 versions.

NVIDIA Cumulus Linux contains a vulnerability in the Link Layer Discovery Protocol (LLDP) daemon component, where an unauthenticated attacker on an adjacent network could cause buffer overflow by sending…

An unauthenticated user is able to cause disproportionate CPU load on the Frontend webserver by sending specifically crafted requests to the Frontend popup.testtriggerexpr action, leading to potential…

The Entries component in Brainstorm Force SureForms version, less than 2.12.3, does not enforce adequate limits on user-controlled form fields or submitted content during processing and rendering, which…

Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') vulnerability in AKIN Software Computer Import Export Industry and Trade Ltd.

The WPAdverts – Classifieds Plugin plugin for WordPress is vulnerable to authorization bypass in all versions up to, and including, 2.3.2.

CodeWhale versions before 0.8.64 contain an argument injection vulnerability in the git_blame tool that allows attackers to read arbitrary files by injecting git options into the unvalidated rev parameter.

Vulnerability in the Oracle Communications Unified Inventory Management product of Oracle Communications (component: Third Party).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Telecommunications Billing Integrator product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Service Contracts product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle iSupplier Portal product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in Oracle Autonomous Health Framework (component: Trace File Analyzer).

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Lemur manages TLS certificate creation.

Cross-Site Request Forgery (CSRF) vulnerability in 10Web Slider by 10Web slider-wd allows Cross Site Request Forgery.This issue affects Slider by 10Web: from n/a through 1.2.63.

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Security).

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Install and Packaging).

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST).

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST).

Vulnerability in the Siebel CRM Deployment product of Oracle Siebel CRM (component: Server Infrastructure).

Vulnerability in the Siebel CRM Integration product of Oracle Siebel CRM (component: REST).

Vulnerability in the Oracle Internet Procurement Connector product of Oracle E-Business Suite (component: Internal Operations).

Mastodon's app/models/concerns/user/ldap_authenticable.rb mutates OpenSSL::SSL::SSLContext::DEFAULT_PARAMS when LDAP authentication uses LDAP_TLS_NO_VERIFY=true, disabling SSL and TLS certificate…

ePA 3.x Integration implements the authorization workflow and writes Medical Information Objects to Germany's electronic patient record.

ArcSearch for iOS versions prior to 1.48.0 could keep the address bar hidden after a page-initiated scroll, allowing attacker-controlled content to imitate browser interface elements and increasing spoofing…

A vulnerability was identified in code-projects Task Management System 1.0.

A weakness has been identified in PHPGurukul Complaint Management System 1.0.

A security vulnerability has been detected in SourceCodester Class and Exam Timetabling System 1.0.

A weakness has been identified in SourceCodester Class and Exam Timetabling System 1.0.

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Lemur manages TLS certificate creation.

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

Vulnerability in the Oracle VM VirtualBox product of Oracle Virtualization (component: Core).

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Presentation Services).

Vulnerability in the Oracle SDP Number Portability product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Siebel CRM Cloud Applications product of Oracle Siebel CRM (component: Siebel Cloud Manager).

Dell Alienware Command Center (AWCC), versions prior to 6.14.20.0, contain a Least Privilege Violation vulnerability.

Dell AppSync Version 4.6.0.0, Dell Metro Node Version 8.0.0, Dell UCC Edge Version 3.0.1, Dell VxRail Version 8.0.322, Dell PowerMax Version 10.3.0, Dell Unity Version 5.4, Dell PowerFlex Manager Version…

A flaw was found in the legacy client-initiated account-linking endpoint of Keycloak, a widely used open-source identity and access management solution.

The Quill Forms | Conversational Multi Step Forms, Surveys & quizzes plugin for WordPress is vulnerable to Stored Cross-Site Scripting in all versions up to, and including, 5.7.1 due to insufficient input…

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Unauthenticated Remote File Inclusion in Easy Google Maps < 1.14.2 versions.

Vulnerability in the Oracle HRMS (Netherlands) product of Oracle E-Business Suite (component: Netherlands Payroll).

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Analytics Web Answers).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Endeca Application Controller).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools).

Vulnerability in the PeopleSoft Enterprise FIN Common Objects Brazil product of Oracle PeopleSoft (component: Common Objects).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Call Center Technology product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Purchasing product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Proposals product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Deployment).

Editor PHP Object Injection in OptionTree <= 2.7.3 versions.

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Cost Management product of Oracle E-Business Suite (component: Cost Planning).

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Identity Manager Connector product of Oracle Fusion Middleware (component: Core).

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: PeopleCode).

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Data Mover).

Froxlor is open source server administration software.

Unauthenticated Server Side Request Forgery (SSRF) in OttoKit <= 1.1.35 versions.

Unauthenticated Server Side Request Forgery (SSRF) in PDF Smart Viewer for Elementor <= 1.0.4 versions.

ArcadeDB before 26.8.1 (affected versions <= 26.7.3) contains a missing authorization vulnerability in the DELETE FUNCTION SQL statement.

ArcadeDB versions before 26.8.1 contain a server-side request forgery vulnerability in the IMPORT DATABASE command where the security validator resolves and checks hostnames but the subsequent connection…

grav-plugin-api (getgrav/grav-plugin-api) versions >= 1.0.0-beta.10 and <= 1.0.14 contain a path traversal vulnerability in the PagesController::batchCopy() method.

SiYuan before v3.7.4 contains a server-side request forgery (SSRF) vulnerability in the isPrivateIP function in kernel/util/net.go, used by SSRFSafeDialer to enforce SSRF protection in SafeMode.

Wazuh 4.0.0 before 4.14.6 contains a path traversal vulnerability that allows unauthenticated remote attackers to cause denial of service by enrolling an agent with a dot-sequence name such as ".." through…

Subscriber Broken Authentication in MWB HubSpot for WooCommerce <= 1.6.7 versions.

Unauthenticated Cross Site Scripting (XSS) in Subscribe2 <= 10.46 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Gemini Labs Site Reviews site-reviews allows Stored XSS.This issue affects Site Reviews: from n/a…

Unauthenticated Cross Site Scripting (XSS) in Contact Form by Supsystic < 1.10.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Ultimate Maps by Supsystic < 1.5.0 versions.

Unauthenticated Cross Site Scripting (XSS) in URL Shortify <= 2.5.0 versions.

Unauthenticated Cross Site Scripting (XSS) in Recipe Card Blocks for Gutenberg & Elementor <= 3.4.18 versions.

Unauthenticated Cross Site Scripting (XSS) in Chaty Pro <= 3.5.8 versions.

Unauthenticated Cross Site Scripting (XSS) in Affiliates Manager <= 2.9.53 versions.

Unauthenticated Cross Site Scripting (XSS) in WordPress Social Login and Register <= 7.8.1 versions.

Customer SQL Injection in License Manager for WooCommerce <= 3.0.18 versions.

Unauthenticated Cross Site Scripting (XSS) in WP Multilang <= 2.4.31 versions.

Unauthenticated Cross Site Scripting (XSS) in Autopay <= 5.0.0 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in W3 Eden WPDM – Premium Packages wpdm-premium-packages allows DOM-Based XSS.This issue affects WPDM –…

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Hyperion Data Relationship Management product of Oracle Hyperion (component: Access and security).

Vulnerability in Oracle Application Testing Suite.

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).

Vulnerability in the Oracle Loans product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Loans product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Financials for EMEA product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Financials for Asia/Pacific product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Landed Cost Management product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Financials for EMEA product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Scripting product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle E-Business Tax product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Flow Manufacturing product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Warehouse Management product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Order Management product of Oracle E-Business Suite (component: Product Diagnostic Tools).

Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Deployment).

Vulnerability in the Oracle Hyperion Profitability and Cost Management product of Oracle Hyperion (component: Deployment).

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Applications DBA product of Oracle E-Business Suite (component: Internal Operations).

Unauthenticated Cross Site Scripting (XSS) in Convert Pro <= 1.0.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Templately <= 3.7.1 versions.

Unauthenticated Cross Site Scripting (XSS) in Fluent Forms Pro Add On Pack < 6.2.12 versions.

Unauthenticated Cross Site Scripting (XSS) in Kirki <= 6.2.3 versions.

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') vulnerability in Ultimate Dashboard Ultimate Dashboard Pro ultimate-dashboard-pro allows DOM-Based XSS.This issue affects…

Vulnerability in the Oracle Reports Developer product of Oracle Fusion Middleware (component: Security and Authentication).

Vulnerability in the Oracle Sales product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Siebel CRM Administration product of Oracle Siebel CRM (component: Data Archival).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Installation and Configuration).

Vulnerability in the Oracle Hyperion Infrastructure Technology product of Oracle Hyperion (component: Common Security).

Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the Oracle Complex Maintenance, Repair and Overhaul product of Oracle E-Business Suite (component: Production).

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle WebCenter Portal product of Oracle Fusion Middleware (component: Runtime Tools).

Vulnerability in the Oracle WebCenter Content product of Oracle Fusion Middleware (component: Content Server).

Vulnerability in the Oracle Payments product of Oracle E-Business Suite (component: File Transmission).

Vulnerability in the Siebel Apps - Marketing product of Oracle Siebel CRM (component: Marketing).

Vulnerability in the Oracle General Ledger product of Oracle E-Business Suite (component: Internal Operations).

ScpClient.Download(string directoryName, DirectoryInfo directoryInfo) trusts file and directory names returned by a remote SCP server and combines them with the requested local directory without containment…

Unauthenticated Cross Site Scripting (XSS) in BP Better Messages <= 2.15.22 versions.

Unauthenticated Cross Site Scripting (XSS) in Mayosis Core <= 5.4.7 versions.

Unauthenticated Cross Site Scripting (XSS) in SSL Zen <= 4.7.43 versions.

Unauthenticated Cross Site Scripting (XSS) in Quill Forms <= 5.7.1 versions.

NVIDIA NVOS for network switches contains a vulnerability in the secure shell (SSH) server configuration component while PKA-only mode is enabled, where an administrator could inadvertently enable an…

The tar extraction routines in moby/go-archive (Unpack, UnpackLayer, Untar/UntarUncompressed, and the ApplyLayer helpers) do not confine filesystem operations to the destination directory.

CodeWhale versions >= 0.8.41 and < 0.8.64 contain a vulnerability in the exec_shell_interact (alias exec_interact) tool, whose approval_requirement returns ApprovalRequirement::Auto.

Vulnerability in the Oracle Business Intelligence Enterprise Edition product of Oracle Analytics (component: Platform Security).

Vulnerability in the Oracle Agile PLM product of Oracle Supply Chain (component: Gantt Chart).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System).

Vulnerability in the Oracle Hyperion Financial Management product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Agile Engineering Data Management product of Oracle Supply Chain (component: Engineering Communication Interface).

Vulnerability in the Oracle Hyperion Calculation Manager product of Oracle Hyperion (component: Security).

Vulnerability in the Oracle Work in Process product of Oracle E-Business Suite (component: Internal Operations).

Vulnerability in the PeopleSoft Enterprise PeopleTools product of Oracle PeopleSoft (component: Tuxedo).

Linuxfabrik Monitoring Plugins provides monitoring plugins for Icinga, Nagios, and related systems.

HTML Injection in the public subscription form in maalfer MailerUp before 1.1.3 allows unauthenticated remote attackers to have the application send a message carrying arbitrary HTML, to an attacker-chosen…

The DEVICE_BROWSE, DEVICE_NODE_ATTRIBUTE, HOST_INTERFACES, and DEVICE_TAGS_REQUEST handlers in server/runtime/index.js return device-discovery, node-attribute, host-network-interface, and device-tag…

MathAnnotationXmlElement in AngleSharp/Mathml/Dom/Internal/MathAnnotationXmlElement.cs is not treated as an HTML integration point when its encoding attribute is text/html or application/xhtml+xml, causing…

SMTP.mail(), SMTP.rcpt(), SMTP.vrfy(), and SMTP.expn() send caller-supplied addresses without rejecting embedded CR or LF bytes.

Blueprint Studio configured Git's credential.helper store when saving Git credentials, causing Git credential-store to persist usernames and access tokens in plaintext in the .git-credentials file for the…

The wyzie-open-redeem IPC handler in index.js creates the partition:wyzie-redeem Electron session and registers an onHeadersReceived hook that removes the Content-Security-Policy header from every response…

A consensus-valid block containing a long chain of transparent self-spends to one address can permanently halt Zebra nodes.

Carbone is vulnerable to Denial of Service due to lack of protection against zip bombs when processing .docx files.

Race condition in the JavaScript Engine component.

Vulnerability in the MySQL Connectors product of Oracle MySQL (component: Connector/ODBC).

Vulnerability in the Helidon product of Oracle Fusion Middleware (component: Imperative Web Server).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Experience Manager).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System).

Vulnerability in the Oracle Commerce Guided Search / Oracle Commerce Experience Manager product of Oracle Commerce (component: Content Acquisition System).